SSL VPN with Global Protect Agent 1.2.0 on different port

[LCMember17002]

Hello there,

on a PA-500 we're running our Global Protect portal and gateway on port 8443 according to https://live.paloaltonetworks.com/docs/DOC-3457 .

This worked well up to agent version 1.7.0. Since version 1.2.0 the agent ignores to port configuration and always tries to connect to port 443.

I've seen numerous log entries on the webserver running on port 443 like "/ssl-vpn/prelogin.esp" and "/ssl-vpn/login.esp" with UserAgent "PAN+GlobalProtect".

Going back to version 1.1.7. solved this.

Is there anybody else who can confirm this, or did I miss a new configuration option in PANOS 5.0?

Thanx

[LCMember17002]

Any updates on this?

[panos]

you can see on doc comments there is a bug has not been fixed .you cannot write port inside client configuration gateway tab.so maybe for agent version also there is something wrong.but after 5.0.2 I could not use that port option.Waiting for fix.Opened a case.Support told they will fix that.

(learned that this bug fixed with 5.0.6)

[emr_1]

If you are talking about bug#50133, it was fixed on v5.0.6.

50133—When configuring a GlobalProtect portal and adding an external gateway address for GlobalProtect clients, the IP format ip-address:port could not be added. Update made to allow this format.

Regards

[panos]

yes this one.if this works with 5.0.6 then admin@peri what is your version ?

[panos]

I replicated this with version 1.2.4 and 1.2.5(using a local interface)

you are right it still tried to connect for ssl 443 port and it gave certification error( because port 443 is busy for another service in our test lab)

so I installed 1.1.7 and it worked !!!

After that I tried with loopback interface.And it is working.I tried with ppoe interface.I don't know why we could not connect with Lan interface instead of loopback but that is working fine.

[LCMember17002]

I'm on version 5.0.6 since a few weeks. Is it fixed with the latest 5.0.7 version? According to this post (Can GlobalProtect Portal Page be Configured to be Accessed on any Port?) yes, but can someone verify?

[panos]

with loopback interface it is working fine.I am using with 5.0.6