GlobalProtect intrazone access

Reply
Highlighted
L1 Bithead

GlobalProtect intrazone access

Is it possible to create a rule to allow certain intrazone traffic for GlobalProtect clients. E.g. so that client1 on GP can ping client2s GP interface. I tried creating a specific rule that would allow traffic from GlobalProtect security zone to GlobalProtect security zone but no luck. Is this type of functionality achievable with GlobalProtect?

Highlighted
L2 Linker

Hello,

 

If there is an clean up rule before default rules, which allows intrazone traffic. There shoud be a specific rule above cleanup rule in oreder to allow ping, icmp and trace route. You can try this allowing gp-zone to gp-zone; source as any and destination as any, service as application default and application any (to monitor what happens).

 

Also check the windows firewall if windows firewall is on, host machines not reply ping request. 

UP
Highlighted
L1 Bithead

Hi, I have tried this without success with the configuration show in the attached image. The source and destination address are the GlobalProtect subnet 10.10.1.0/24 which I can't imagine is a problem. Windows firewall is also set to allow this traffic.

 

Screenshot 2020-06-22 at 12.57.01.png

Highlighted
L7 Applicator

This is showing policy 17. The count is zero. Do you have a policy before this that is denying gp    Traffic.

Highlighted
L1 Bithead

No setting denying anything from the GP zone in this list of policies except default rule found at the end which is for interzone.

Highlighted
L7 Applicator

ok so override the two default policies and log session start, don't bother forwarding logs.

then on the firewall you will see what is happening to the pings.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!