Global Protect for Google Chrome Client connects successfully but unable to connect to the internet- assigned IP 100.115.92.2

[Siji2_Osundina]

Our Google Chrome client are not able to access any network resources including the internet after connecting to Global Protect app. I noticed that the following IP address was assigned 100.115.92.2 as opposed to the expected IP address from the configured pool subnet.

It appears as though there is some kind of segregation on the Google Chrome side- is there something I should be doing differently?

[OtakarKlier]

Hello,

I would start by checking the traffic logs to see if/where the traffic is getting blocked.

Regards,

[Siji2_Osundina]

Thanks,

I actually did check the logs before making this post- the traffic appears not to be making it to the firewall due to the weird assigned IP address of 100.115.92.2.

The current connected client list shows the correct assigned IP address on the firewall but there is no traffic matching this expected IP in the traffic log.

[Adrian_Jensen]

The IP 100.115.92.2 is a private CGNAT address range (all of 100.64.0.0/10 in fact). This IP space is typically used by cell providers and large consumer networks with customers behind a Carrier-Grade NAT (instead of using 10.0.0.0, 172.16.0.0, etc.). A 100.115.x.x is not internet routable, the internet IP will be something else.

[Mick_Ball]

have you tried overiding the interzone-default policy and set logging to session start.  this will show any explicit denies by the Palo.

you could also run tracepath on the local device to see if it's heading the right way...

[Siji2_Osundina]

Thanks everyone- I am looking for a way to stop Google Chrome from assigning the IP address 100.115.92.2. I have tested every other endpoint (iPhone, MacBook, Windows) successfully.