Multi-VSYS, Shared Gateway, IPSec and GlobalProtect, GP return traffic blackholed.

[adrianchung]

I'm troubleshooting a configuration that consists of a Palo Alto 3020 with multiple virtual systems enabled.

Currently configured are:

• shared gateway vsys
• one main vsys
• IPSec site-to-site tunnels terminating on SG interface/zone/vsys
• GlobalProtect gateway

Internet traffic to the main vsys works, as does regular site-to-site IPSec traffic, which terminates in the SG vsys, but happily routes using the default virtual router to any subnets reachable within the vrouter.

For GlobalProtect, because it needs to terminate on an interface/IP within the vsys, and can't be in the SG, I created a loopback interface in the untrust zone within the main vsys, and also a tunnel interface in the trust zone (for simplicity) within the main vsys.

I created a NAT rule in the SG vsys that destination NATs a second public IP address to the loopback IP within the vsys for UDP/500 and UDP/4500.

I also created a security rule within the vsys allowing the same services to the loopback IP.

The problem I'm having is that VPN clients authenticate and connect, however can't pass any traffic successfully.

I'm testing using a simple ping from the VPN client to a switch behind the firewall.

After having done extensive captures from both ends and troubleshooting, I have verified the following:

• Client traffic is encapsulated into UDP/4500 packets and sent to the firewall.
• The firewall receives this traffic, decapsulates it and sends the ICMP echo request to the switch.
• The switch sends an ICMP echo reply back to the client, which the firewall receives on the tunnel interface, but never encapsulates it and sends it back to the client.
• I don't see anything in the logs in terms of drops or errors (though maybe I'm not looking in the right place).
• The firewall itself can't ping the IP of the VPN client when connected (GP is configured in tunnel mode with an IP pool)

This shouldn't be a complicated setup, I have the exact same setup running on a firewall without multiple virtual systems enabled, and it works just fine, including being able to ping the same VPN client.

It just seems as though once the return traffic hits the tunnel interface, it either doesn't make it back to the loopback, or the loopback can't encapsulate and send back to the SG zone and out.

If anyone has any tips on troubleshooting this or something simple I might be overlooking, much appreciated.

[adrianchung]

Actually, looks like this may be related to 6.1.7 known issue 69458.