When possible it’s always a good idea to test any software upgrades, because you just never know what your going to get. That was the case recently when I upgraded our test PA-220 from 9.1.7 to 9.1.12-h3 and seemingly breaks all GlobalProtect VPN functionality. The portal doesn’t respond on TCP/443 at all, so it looks like the firewall itself is dropping the traffic.
The issue turned out to be Strict IP Address Check which was just “resolved” or enabled in 9.1.12.
AN-175934 Fixed an issue where packed-based zone protectio settings (such as
Strict IP Address Check) were not applied to return traffic.
When I disabled Strict IP Address Check on the zp_untrusted zone protection profile GlobalProtect started working again.
What is Strict IP Address Check?
Check that both of the following conditions are true:
- The source IP address is not the subnet broadcast IP address of the ingress interface.
- The source IP address is routable over the exact ingress interface.
If either condition is not true, discard the packet.
Looks like a bug to me.