Clientless VPN - Application is not accessible

[akilan.r@tutelartechlabs.com.panwpartner]

Hello All,

This is my topology I have configured Clientless VPN hosting two application as, paloaltonetworks.com (external-application) and amazon.forest.in (internal hosted application). But i am unable to access the application that hosted inside. In this question have attached my configuration also.  other than that there is no sent byte for clientless-VPN traffic also.

External application works but no sent bytes ?

ISSUE NOTE : 1.External Application working but there is no sent bytes

                         2.Internal Application not accessible

[nikoolayy1]

This sigfnals a routing issue or DNS issue as 0 bites are send. Check if the DNS resolution is working for the Palo Alto as maybe the routing or Service route is wrong (palo alto by default uses the managment):

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/service-routes

Also check the config:

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-clientless-vp...

Finally just check the global counters, tcdump for drops and the security policy:

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-palo-alto-checking-for-drops-r...

Also there are a lot of articles for debuging web issues for clientless vpn and try using different browsers:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPizCAG

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-clientless-vp...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POjmCAG&lang=en_US%E2%80%A...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLSiCAO

[nikoolayy1]

Hello, Did you test the DNS resolution and routing are correct ?  If so using another browser as your error seems to be seen a lot for chrome browser and then finally doing tcpdump/pcap capture for the rewrite action to see how Palo Alto rewrites the HTTP/HTML content and you can find this from the links I shared and also using Fiddler to see how direct access to application looks like without the Clientless VPN and with it and to compare.

[raghavendra.badiger]

I am having different issue, not sure if this is only for me or other users as well. If my issue is faced by everyone then I am not sure how clientless VPN is helpful.

So I will take example of above images:

User logs in to Clientless VPN at https://192.168.29.245 and on portal page, user clicks on Palo Alto tile. This opens a new tab with URL as https://192.168.29.245/https/www.paloaltonetworks.com/ , as shown in above image.

Now the issue is - On the Palo Alto page if I click on any link(for example 'Sign in', then it takes to login page. However on the browser URL appears to be https://signin.palolaltonetworks.com not https://192.168.29.245/https/signin.paloaltonetworks.com .

Former URL is not going via firewall rather it goes directly from user machine to the webpage, how can I ensure any link on the page is prefixed by VPN portal "https://192.168.29.245"?

Support isnt able to solve the problem from past 1 week. I am using stable PAN-OS 11.1.3 and Clientless app version 98-260(latest).

Thanks.