Configuring Local Loopback Ping with GlobalProtect

====================================================

Introduction

----------

In this article, we will walk through the process of configuring local loopback ping within a GlobalProtect setup when using only one public-facing IP address to host both SSL-based and non-SSL applications.

Prerequisites

----------------

Before proceeding, ensure you have already set up your environment with necessary software installed. Additionally, make sure that you are familiar with basic networking concepts such as interfaces, service groups, and how they interoperate within the context of a GlobalProtect setup.

Step 1: Create Required Services & Service Group

----------------------------------------------

Firstly, create three new services on your firewalls or any device managing network traffic:

* `gp_portal` - This will act as our Portal service.

```bash

# Create gp_portal service for global protect portal

/usr/local/crmd/bin/haclient -n --add-port 443/tcp \

--start-delay 30s --state start \

--virtualipset=gp-vips \

--interface=rearmdelay=-1\

--interface=lo0:80,keepalive=true,retries=3,\

retrywait=5m,tcpkeepalive=yes

```

* `gp_gw` - This will act as our Gateway service.

```bash

# Create gp_gateway for global protect gateway

/usr/local/crmd/bin/haclient \

--start-delay 30s --state start \

--virtualipset=gp-vips \

--interface=rearmdelay=-1\

--interface=eth0:80,keepalive=true,retries=3,\

retrywait=5m,tcpkeepalive=yes

```

* `gp_servicegroup` - This will be our service group that contains both the Portal and Gateway services.

```bash

# Create gp_service_group for global protect portal gateway group

/usr/local/crmp/bin/hacluster \

--add-requires 'port-443-tcp:10.100.0.1' \

--virtualipset=gp-vips \

--interface=rearmdelay=-1\

--interface=eth0,keepalive=true,retries=3,\

retrywait=5m,tcpkeepalive=yes

```

* Assign loopback interface as the Gateway address for `gp_servicegroup`.

```bash

# Update /etc/ha.d/corosync.conf to set bond1.100 ipaddress and vipscript0 correctly

...

network:

...

bridgebonding:

...

etherBondLacPetherBond4lacpport=10

lacpports='bond1'

modestaticmacaddresses=''00:25:A8:01:b3:d5''

bondslaves=bond1 bondname=gigabit0-eth2-gb-e

-t4-lag40-ge100-fi-c6-agg5-a9f7f89e-bd44-405c-

98a3-d41bfec8be34

...

```

Step 2: Configure Loopback Interface for Portal & Gateway Services

----------------------------------------------------------------

1. Create a second loopback interface in addition to the first one used for the portal.

```bash

# Create eth0-10 on both hosts and assign IP address from same subnet as existing eth0 interface.

ip link add dev eth0-10 type bond bond slaves 'eth3,eth4' bond mode 802.5-daisy bond-slaves 'bond1,bond2'

```

Step 3: Configure GlobalProtect Portal Page to be Accessed on any Port

---------------------------------------------------------------------

Please follow Knowledge Base article 'How to Configure GlobalProtect Portal Page to be Accessed on any Port'(https://kb.paloaltonetworks.com/202000_201999/kb20700\_how-to-configure-globalprotectportal-page-to-be-accessed-on-any-port) with a slight modification:

1. Add the following lines under `'service:hacluster'` in `/etc/corosync/` directory to allow `ping` traffic on any interface.

```bash

# Allow ping traffic on all interfaces for HA purposes.

service_ensure='yes'

...

```

Step 4 (Optional): Verify Configuration & Testing

---------------------------------------------

Once you have completed these steps, verify that the following conditions are met:

* Ensure both local and remote nodes can reach each other via their respective IP addresses without any issues.

```bash

# Test connectivity between hosts.

ping -c1

```

If everything has been set up correctly, you should now be able to access both SSL-based and non-SSL applications hosted on different ports using a single public-facing IP address.

-------

In conclusion, this article provides step-by-step instructions for configuring local loopback ping within a GlobalProtect setup when only one public-facing IP address is available. By following these steps carefully and making necessary modifications based upon your specific environment requirements, you should be able to successfully host both SSL-based and non-SSL applications on the same network interface while maintaining proper HA (High Availability) features.

Hope this article has been helpful in understanding how to configure local loopback ping with GlobalProtect. If you have any further questions or need additional information regarding this topic please feel free to leave a comment below!

Local loopback ping