Global Protect firewall allowed rule

[momoo168]

Hi,

I'm creating a firewall rule to allow TCP 443/UDP 4501 (Global Protect) to go through the firewall, and I want to know if I need to allow bidirectional for the UDP 4501?

Thank you,

[reaper]

firewalls are bidirectional, you never need a 'return' rule

To go "through" the firewall you need app-id 'ipsec-esp-udp' and 'ssl', with service application-default (or other ports if it's running on a different port)

To terminate GP on the firewall use  'ssl', panos-global-protect' and 'ipsec-esp-udp' app-id with service 'application-default'

instead of portbased