For details on cookie usage on our site, read our Privacy Policy
Troubleshooting GlobalProtect
- LIVEcommunity
- Discussions
- General Topics
- Re: Troubleshooting GlobalProtect
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-11-2018 08:36 AM
PA220, 8.1.1, GPClient 4.1.1, GP license activated.
Connecting to the GPportal/gateway works fine. Traffic routes as expected.
We're still testing, so access is severly limited and policies wide open once connected. Literally, everything is allowed for GP users.
However, when i attempt to access an internal SSL-protected site, the traffic is denied.
I can even change the rule to expressly allow SSL & web-browsing to that device and it still hits the DenyAll rule at the bottom.
What am I missing in my setup?
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-11-2018 11:51 AM
Looking at your screenshot it looks like the log in question is being identified as looking for dst port 7443 right? Regardless the application-default port for SSL identified traffic is only 443; so if you want to allow it on 8443/7443 or whatever you need to actually specify that. As your current security policy is written this traffic doesn't match your policy.
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-11-2018 11:53 AM
Even though I have the apps set to 'any'?
huh.
Let me look at the logs again, I'm pretty sure 443 traffic was failing too
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-11-2018 11:55 AM
Yes; this is due to specifying the service as application-default. Since the app-id is being identified as 'ssl' the only default service that is going to be allowed is 443.
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-11-2018 11:56 AM
Hmm, okay. I'll test further and will update.
Thank you for your help!
- GlobalProtect IPv6 findings in GlobalProtect Discussions
- Device Block List for GlobalProtect - where is it in v10.x? in GlobalProtect Discussions
- Azure AD + Globalprotect = unable to filter the client settings in GlobalProtect Discussions
- Global Protect Virtual adapter not installed on ARM64 win 11 device in GlobalProtect Discussions
- unable to add new object address to existing object address group in General Topics
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
