Override url ocsp and responder ocsp global protect VPN

[HAINVH]

Hi everyone,

present, i have VPN global protec

Authentication two factor with certificate and radius, by interface management 

The current setup is as follows:

• The Palo Alto firewall acts as both the gateway and the OCSP responder.
• The OCSP responder is configured to use the management IP address, and the OCSP Override URL also points to the management IP.

Because certificate validation relies on the management IP, a failover to the HA peer causes certificate validation to fail. In addition, having only a single management link creates a potential single point of failure.

To improve resiliency, I would like to use either a data-plane IP address or a loopback IP address as the OCSP responder, and configure the OCSP Override URL to point to that loopback or data-plane IP instead.

However, I’ve tried several configurations without success.

Could you please help me understand how to achieve this?

with 1000user i dont want create new all

[JayGolf]

Hi @HAINVH ,

What have you tried so far?

You should be able to host OCSP on an alternate interface instead of tying it to the management IP.

A few things I would be mindful of:

• The interface should have an Interface Management Profile applied with HTTP OCSP enabled.
• The OCSP responder hostname/IP should resolve to the data-plane or loopback interface.
• Routing and security policy need to allow the OCSP traffic.