Reach Management Interface via SSL-VPN

[triitech]

Hi all,

I have a little problem, I've installed a PA-500 and configured SSL-VPN, it works fine, I can reach the internal network correctly but I can't reach the management Interface.

This is the scenario:

VPN Clients:

IP: 10.31.31.10-10.31.31.254

Management Interface:

IP: 10.7.10.251

Gateway: 10.7.10.3

The gateway already knows the routes to reach 10.31.31.0/24 via Ethernet1/2 of PAN.

I can see in Traffic Log that packets pass through Interface tunnel.1 to Ethernet1/2 (Trust to Trust), but nothing came back.

Have you any idea about?

[mharding]

Do you have the management interface locked down to certain IP addresses?

[dagibbs · Accepted solution]

triitech wrote:
Hi all,
I have a little problem, I've installed a PA-500 and configured SSL-VPN, it works fine, I can reach the internal network correctly but I can't reach the management Interface.
This is the scenario:
VPN Clients:
IP: 10.31.31.10-10.31.31.254
Management Interface:
IP: 10.7.10.251
Gateway: 10.7.10.3
The gateway already knows the routes to reach 10.31.31.0/24 via Ethernet1/2 of PAN.
I can see in Traffic Log that packets pass through Interface tunnel.1 to Ethernet1/2 (Trust to Trust), but nothing came back.
Have you any idea about?

What security policy do you have on your SSL VPN? Does it allow https to the network range (or specific IP address) your management interface is connected to?

[triitech]

Thanks for all replies,

the problem was that was missing the correct policy to permit traffic from tunnel to management interface for class 10.31.31.0/24.

Now I can reach the managemente interface without problems.

Regards

Alessio