About knutelde

update when running cli command show running routes i got a lot of routes for the 192.168.120.0/24 range, one that looks OK, and the rest of the rutes I am not sure if they should be there (see attached screenshot) I still cant quite figute out where I can set, edit or delete routes, like you would using add route in windows cmd shell, or route add in ,linux shell ?? ... View more

hi and again thanks for really good feedback ! comments on points above: 1) i see the routing information, both in the GP client troubleshooting tab, and in windows cmd, and there are no specific route to the 192.168.1.0 range in finland. I could add a static route to test but I am not qiute sure what to set the gateway ip to. I have tried the gateway ip adress for finland 192.168.1.1 and the GP local gw IP 192.168.120.1 locally to a latop but both failed. So I can find the routing information for a GP client, but I am not sure how I can verify if it is pushed by the gateway or not. And where can I add a route to be pushed from the gateway ? 2) both tunels are configured with the same virtual router, and a security zone. there is a policy allowing traffic from the GP zone to the ip range in finland. I cannot choose a tunell interface as a destinaton in a policy, so i allow trafic from the gp zone to the ip range in finland 3) where should I define next hop from GP range 192.168.120.0/24 - I will take a look at the Source NAT option you mantion, maybe this is the solution I am looking for. I will post back how that work out. 4) there seems to be some missing repsonse packets yes, please see my attached pictures, showing ping test, session browser and trafic monitor for both ways, working one way but not the other way 5) In PAFW we use 192.168.120.0/24 only as GP ip range, and there is one listing of this in the virtual router, it looks to me like packets are going through the default route, because it finds no match to a specific routing rule, 6) I do not get the information i need from tracert, it only shows start and end adress and start inbetween, I have attached pictures of ping and tracert tomillustrate my point. ... View more

update, one thing works though - teamviewer, takes the route from tunel 1 (gp tunell) to tunell 15 (fixed ip sec vpn tunell norway-finland) - that I hope the rest of the trafic from gp protect would take, but I cannot succed in accheiving ... View more

Hi Krpakash, and thank you for a quick and informative reply. allow me to ellaborate \ specify the details in my setup : I have one PA500, here in Norway, and we have a production office in finland. all the users are connected to the same windows active directory domain, and there is a fixed IPsec vpn tunell between offices in norway and finland. employees in both countries connect to the same global protect. global protect users have their own IP range 192.168.120.0/24 and their own security zone. in finland the local ip range are 192.168.1.0/24 I can connect from finland to global connect, for example ping from 192.168.1.4 to 192.168.120.12 but not the other way, the trafic mnitor shows the traficc beeing sent but no packets come back to me it looks like a routing issue, and that machines in the Global protect zone does not know where the packets to the 192.168.1.4 range in finland should go. but I may be wrong. all input and ideas are appreciated knut ... View more

hi Hardik I am running into a routing issue with my global protect clients, how can I add routes in the ruting table ?? the route I need are not there Knut ... View more