Global Protect Behind NAT

[chris_brighton]

I have a PA-800 with global protect configured in an internal network. A 1to1 NAT has been setup to map a public IP address to the internal IP address of the external interface of the PA. The 1to1 NAT is on a Cisco ASA5508X with direct passthrough on 443. I set the same internal IP address on the portal and the gateway. When authenticating from the internet, I get to the portal and enter my credentials, it then pushes down a gateway address which is the internal IP address and for obvious reasons fails to setup the tunnel.

I thought the solution would be to connect to the PA from a host in the internal network which can access that internal IP, and via the management interface, change the gateway local IP, from the internal IP address to the public IP address. However, when I try to change the gateway IP from the internal IP to the public IP it fails to allow me to change that setting. Is this because I've connected via global protect to make this config change? Could there be any other reason I can't change the local IP on the gateway?

Thanks in advance for any help.

[chris_brighton · Accepted solution]

Found the solution. The external gateway in the client configuration of the global protect portal was the part that needed to have a public IP. See the following article; https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKHCA0