when connected to global protect VPN unable to see other devices on network

[fatboy1607]

when connected to global protect VPN unable to see other devices on network

[Fahad-Khan]

is Internet connnectivity established when you connect the link ???

[fatboy1607]

Yes Interent is fine, i am able to connect to global protect Gateway also , able to access intranet resources.

Only thing is unable to access local resources like local printer etc.

Thanks in Advance.

[kiwi]

Hi @fatboy1607,

Did you disable access to the local subnet ?

Disable access to local network

Depending on your PAN-OS version :

PAN-OS 7.0 : Network tab > GlobalProtect > Gateways > <Your Gateway> > Client Configuration > Network Settings > <Your Config> > Network Settings

PAN-OS 7.1 : Network tab > GlobalProtect > Gateways > <Your Gateway> > Agent > Client Settings > <Your Config> > Network Settings

If that's the case then this article might be useful for you :

GlobalProtect Disable Local Subnet Access

I hope this helps,

-Kim.

[fatboy1607]

Thanks Kim

But we have enabled that feature. still local network is not accessible.

[kiwi]

Did you mean disabled ? If the checkbox is checked, then you won't have access to your local resources.

If you want access to your local network, the option needs to be disabled (= not checked).

Hope this helps,

-Kim.

[fatboy1607]

it is not checked .

[kiwi]

Hi,

Any access routes configured ?

I'd check my routing table when connected.  Are you egressing the expected interface while connected ?

-Kim.

[fatboy1607]

yes Egress interface is correct.

and I can see local routes learned gateway type On-link.

[DonohoeRobert]

Hi, 

As its a gp connection its probably arriving on a different zone. Do you have rules in place to allow the traffic ? 

Enable the interzone logging rule and set it to log at session end. Do you see the traffic hit this rule ? 

Replicate trying to access machines on the network and filter by the user in the traffic logs , ping a screenshot up as a reply .. 

also make sure no denies hitting the threat logs or url logs .. 

kind regards

robert D