Clientless VPN - Application is not accessible

[akilan.r@tutelartechlabs.com.panwpartner]

Hello All,

This is my topology I have configured Clientless VPN hosting two application as, paloaltonetworks.com (external-application) and amazon.forest.in (internal hosted application). But i am unable to access the application that hosted inside. In this question have attached my configuration also.  other than that there is no sent byte for clientless-VPN traffic also.

External application works but no sent bytes ?

ISSUE NOTE : 1.External Application working but there is no sent bytes

                         2.Internal Application not accessible

[nikoolayy1]

This sigfnals a routing issue or DNS issue as 0 bites are send. Check if the DNS resolution is working for the Palo Alto as maybe the routing or Service route is wrong (palo alto by default uses the managment):

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/service-routes

Also check the config:

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-clientless-vp...

Finally just check the global counters, tcdump for drops and the security policy:

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-palo-alto-checking-for-drops-r...

Also there are a lot of articles for debuging web issues for clientless vpn and try using different browsers:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPizCAG

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-clientless-vp...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POjmCAG&lang=en_US%E2%80%A...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLSiCAO

[nikoolayy1]

Hello, Did you test the DNS resolution and routing are correct ?  If so using another browser as your error seems to be seen a lot for chrome browser and then finally doing tcpdump/pcap capture for the rewrite action to see how Palo Alto rewrites the HTTP/HTML content and you can find this from the links I shared and also using Fiddler to see how direct access to application looks like without the Clientless VPN and with it and to compare.