How to setup SSLVPN and MGMT on the same IP?

[ifpilm]

Hello,

How to setup SSLVPN portal and managment on same IP. Because now I don't have https managment on my firewall.

Regards

Piotr Bratkowski

[nrice]

Assuming you had management enabled prior to configuring SSLVPN, management will move from port 443 to port 4443 when SSLVPN is configured on the same interface.  SSLVPN will use port 443.  Try connecting to port 4443 in your browser.

e.g. https://externalIPaddress:4443

[ifpilm]

Thanks for anwer. It worked, but I've clicked wrong star:]

[jochristian]

What if the SSLVPN was configured first?

I can't connect to 4443 now when SSLVPN and management is on the same port.

SSLVPN is working fine.

Regards

Jo Christian

[nrice]

As of 3.1.0 it is no longer possible to configure SSL VPN and management on the same port.  You may want to configure a loopack with an external IP address for the SSL VPN.

[jochristian]

We don't want the management on the same port, it is not possible to run management on port 4443?

Well loopback with external IP would have been an option if we got more public ip-address'es, but we only got one.

Regards

Jo Christian

[mjacobsen]

This is a bug that is being fixed in 3.1.3. You should be able to have back the 4443 management port with that release.

Mike

[kbrazil]

I wonder if you could create a port-based NAT rule to forward traffic destined to an arbitrary port translated to the loopback ip/port for management?

Cheers,

Kelly

[jochristian]

Great 🙂

We will wait for version 3.1.3 then.

Regards

Jo Christian

[bbokhorst]

Hi,

Yes you can, what we have done is setting up a destination nat to the managment port. You can use any arbitrary port on the outside and nat it to port 443 of the managment IP.

Best regards,

Bart.

[migration]

What about  configuring SSL-VPN, HTTPS Management and a destination NAT on 443 port on the same "single" public IP address?

I think this is not possible at the moment.

I think there should be an option to change port number for SSL-VPN and HTTPS management ports.  So I can leave port 443 for destination NAT.

Thanks

Ismail YENIGUL

[kbrazil]

Hi Ismail,

I don't see any reason why you could not do that, so long as you make sure to define unique listening ports for the NAT port translation for each service/server.  This way you are essentially modifying the listening port for the service.

Cheers,

Kelly

[migration]

First of all, I am running PAN 3.1.3 on PA-2050

Here is my test procedure:

Test 1. configure only SSL-VPN on untrust ethernet1 (IP:10.0.0.77, no 443 dest nat, no https management on this interface)

type on brower  https://mypan, SSL-VPN page will be opened. this is OK.

Test 2.  Configure Destination NAT on 443, keep SSL-VPN

     rule2      L3-Untrust L3-Untrust  any      any      l3-untrustIP-10.0.0.77  service-https      none      dmzwebserver-192.168.100.100 : 8443

Result: I can access to dmzwebserver HTTPS server running on 8443 by typing https://10.0.0.77  in the browser.

But I can't access to SSL-VPN on 4443. This is not OK

Test 3. Disable SSP-VPN and enable HTTPS management on ethernet1, no change on dest NAT configuration.

I can access to webserver and PAN management interface. This is also OK.

Test 4: Enable SSL-VPN again (HTTPS management and dest NAT is already configured)

I can access to webserver and PAN management interface.  but can't access to SSL-VPN

Test 5: Keep  SSL-VPN and HTTPS management, disable dest NAT

I can access to SSL-VPN and HTTPS management.

As a result, If I enable dest NAT for port 443, I can't access to SSL-VPN.

As I stated in my previous post, If you can provide an option to change SSL-VPN port, this problem will be solved.

Thanks.

Ismail YENIGUL

PS: It will be great, if you can provide an option to disable SSL-VPN. At the moment, I have to delete SSL VPN settings to disable

PS2: As far as I know, the following detail is not mentioned PAN documents. but it should be mentioned.

"Assuming  you had management enabled prior to configuring SSLVPN, management will  move from port 443 to port 4443 when SSLVPN is configured on the same  interface.  SSLVPN will use port 443.  Try connecting to port 4443 in your browser.

e.g. https://externalIPaddress:4443"

[kbrazil]

Hi Ismail,

I was thinking you could do a port translation dst NAT from the external interface to the internal mgt interface (or any other interface that has management enabled) and use any arbitrary port.

Then assign the SSL VPN portal to a loopback interface or any other L3 interface and then do a port translation dst NAT from the external interface to it.  I don't believe you can change the SSL VPN port since the client will always try 443.

Then you can do a normal dst nat with some other port to an internal SSL server.

Service	Outside Port	NAT to Inside
Management	44443	Mgt Interface on port 443
SSL VPN	443	Loopback Interface on port 443
Web Server	4443	Internal IP on port 443

Cheers,

Kelly