GlobalProtect don't access LAN

[Amaro123]

Hi all,

I'm relatively new to Palo Alto solutions and I run into a problem that I can't find which may be causing the connection to fail.

I have a configured GP gateway and in it I have 3 pools with different subnets. One of these networks cannot access services on the LAN. I see in the logs the access being accepted in the policies but the connection is not established.
I revalidated the settings and didn't find what could be a failure. Any idea what it might be?

[MikeC]

Does the LAN have a route to that GP subnet?

[Amaro123]

Hi MikeC,

Describing the settings a little more, the 3 networks I have configured in the GP are 10.x.x.x / 24, / 25 and / 27. In the routing table I have a route for 10.0.0.0/8 and that route points to one of the ethernet interfaces and not to the tunnel.

[Amaro123]

Hi Connelly,

I find it strange as it is because there have been no changes in the firewall since December and this problem arose yesterday, in addition other networks in the pool of the same GP gateway are working perfectly.

[Amaro123]

Still in this investigation I noticed a strange new behavior.

This is the scenario:
- I have gateways 01 and 02 for the GP.
- AD groups called Grupo1 and Grupo2.
- Test user named Fred.

When user Fred is in Group1 he has normal access to the environment through the two gateways.
When that same user is in Group2 he has normal access only through gateways 01. If you use 02 he does not access anything.

I reviewed the LDAP settings but did not find any unique references to the groups I have.

What can I not be seeing?