third party VPN clients with PanOS 7.0.3

[alowther_chatham]

I was curious if anybody else has seen this issue, or could perhaps try to duplicate it.

I have a problem with third party VPN clients after upgrading from PanOS 6.1.6 to 7.0.3 on our PA-3020s.  Specifically, the built-in IPSec VPN client on Mac OSX (10.11/el capitan) and iOS (9.1).  They can connect, but a simple ping test shows packet loss near 50%.

I've been able to duplicate with 4 different clients and 2 different sites.  Strangely, I can NOT duplicate the problem when connecting to sites with PA-200s.  All sites are setup as an HA pair.  All firewalls are running 7.0.3

I was also not able to duplicate the issue with the ShrewSoft VPN client on Windows 7.

Global Protect client works fine on the OSX devies.

Packet captures on the firewall don't indicate any issue.  All packets seem to traverse properly.

The problem started right after the PanOS upgrade.

I have an open support case with PaloAlto, but I wanted to see if anybody in the forums has seen this.  I noticed the other threads indicating problems with 7.0.x, but nothing related to this.

client (version) + site (model) = result
---
Mac OSX (10.11) + site_A (PA-3020) = problem
iOS (9.1) + site_A (PA-3020) = problem
Mac OSX (10.11) + site_B (PA-3020) = problem
iOS (9.1) + site_B (PA-3020) = problem

Mac OSX (10.11) + site_C (PA-200) = ok
iOS (9.1) + site_C (PA-200) = ok
Mac OSX (10.11) + site_D (PA-200) = ok
iOS (9.1) + site_D (PA-200) = ok

Windows 7 w/ Shrew Soft VPN Client (2.1.7) + site_A (PA-3020) = ok
Windows 7 w/ Shrew Soft VPN Client (2.1.7) + site_B (PA-3020) = ok
Windows 7 w/ Shrew Soft VPN Client (2.1.7) + site_C (PA-200) = ok

[Remo]

hello,

I don't know if we have the same issue, I also experienced some other bug with GP and because of them I had to downgrad to 6.1.8. But thank you for the information, this would be another reason for not upgrading 😛

Do you configured your globalprotect gateways on loopback interfaces? if yes, then the problem might be the known issue 69458: Traffic for third-party IPSec clients is not routed correctly when using a loopback interface for a GlobalProtect gateway.

Workaround: Use a physical interface instead of a loopback interface as the GlobalProtect gateway for third-party IPSec clients. Alternatively, configure the loopback interface that is used as the GlobalProtect gateway to be in the same zone as the physical ingress interface for third-party IPSec traffic.

[alowther_chatham]

Thanks for the tip.  The gateway is configured on a physical interface, so that bug wouldn't seem to apply.