0

I have a remote computer behind a VPN (which I have no control of). The IT team of the remote factory wanted me to install Palo Alto Networks' Global Protect program to access the VPN, which is working fine.

This program creates a new network interface with IP 192.168.20.58. Also when I look at the route table of my computer I can see a line with destination 10.0.0.0/8 should use the interface 192.168.20.58. So, as I understand it routes the traffic through this network adapter whenever I want to reach the remote computer, which has an IP of 10.11.88.3.

This remote computer also has access to a local private network (which I have control) through another network interface on the remote computer which has the IP 172.16.224.1 and there are 4 other devices on this network.

I was searching a way to directly access these 4 devices from my computer when I had this idea: What if I add an entry to the route table of my computer as 172.16.0.0/16 as destination and 10.11.88.3 as a gateway. I think I also need to add another rule to the remote computer to route between two network interfaces on it, but I cannot figure out what it is.

So the questions are:

  1. Is it even possible to access to these remote devices in this setting?
  2. If so, can my idea work with correct settings and what are these settings?
  3. Can you suggest another way for accessing these devices?

Edit. Trace route of the remote computer. enter image description here

  • Can you add the output of traceroute from your computer to 10.11.55.3? – Ankit Badani Mar 2 at 7:50
  • @AnkitBadani I have added it. Also I misremembered the numbers and fixed it in the question. – obareey Mar 2 at 8:01
  • First, that is not a traceroute, that is a routing table. Next, please, never use an image for text. Simply copy the text and paste it into the question and use the Preformatted-text option ({}). Last. host/server configurations are off-topic here, and you can ask about those on Server Fault for a business network. – Ron Maupin Mar 2 at 15:04
0

You cannot configure a gateway that you cannot talk to locally (on-link).

As it is, you've got two gateways:

  1. your default gateway pointing to WAN
  2. the tunnel gateway pointing through VPN

What you were trying to accomplish is called source routing which is long obsolete and only very rarely supported nowadays.

If you want to access more networks via VPN you need to use the VPN gateway - the same as for 10.0.0.0/8. Routing beyond the tunnel cannot be controlled by you and must be done by the VPN gateway or beyond.

Whether simply setting that gateway route does or doesn't works depends on the VPN settings on the far end. Contact the admin for further information.

| improve this answer | |
0

The way GlobalProtect works is while handing out SSL VPN IP addresses to client, it acts as the default gateway for the routes configured with GlobalProtect Gateway. Now, if you are reaching 10.11.88.3, packets will be sent to Palo Alto GlobalProtect Gateway and then to the inside interface after gong through all the security policies and hitting an allow policy.

In your case, while sending traffic to and from 172.16.224.1, according the 0.0.0.0/0 route, remote PC will send everything to 10.11.88.1. First do a source ping from 172.16.224.1 to 10.11.88.1 to check whether that internal routing has been enabled. If it has been enabled, you need to ask the firewall administrator to add/allow that network for GlobalProtect VPN. If you are not able to source ping, you will not be able to reach those remote computer secondary NIC and computers in 172.16.0.0/16 subnet.

| improve this answer | |
  • I tried source ping to 10.11.88.1 but it didn't work. – obareey Mar 2 at 14:15
  • It is possible that Palo Alto or 10.11.88.1 does not have a route back to 172.16.0.0/16. – Ankit Badani Mar 2 at 14:28
  • This is the point. They are two separate networks. 10.11.88.1 doesn't even know 172.16 exists. The idea was that I can add a route rule to make that happen. – obareey Mar 2 at 14:31
  • You have answered your own question it seems. I am explaining why it won't work. – Ankit Badani Mar 2 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.