Why does the IP address range assigned from GlobalProtect gets subdivided into smaller subnets on the firewall routing table.
16052
Created On 11/07/19 21:40 PM - Last Modified 03/19/20 22:52 PM
Question
Why does the IP address range assigned from GlobalProtect gets subdivided into smaller subnets on the firewall routing table? or
How does the firewall route the client IP pool addresses when an IP address range is specified in the client IP pool?
Environment
- Palo Alto Networks firewall.
- Any PAN-OS.
Answer
When a GlobalProtect Client IP pool is defined as a range under configuration GUI: Network > GlobalProtect > "GlobalProtect-Gateway" > Agent > Client IP Pool
The routing table of the firewall is modified so as to include all possible subnets in the client IP Pool address range. This is to ensure all the IP addresses in the ip pool are reachable. The following examples will show how the routing table is updated based on configured client IP pool range.
Note: tunnel.11 will be the GlobalProtect gateway tunnel interface used for terminating client IPSec connections.
Prior to adding IP Pool the routing table is as follows.
> show routing route
flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,
Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast
VIRTUAL ROUTER: default (id 1)
==========
destination nexthop metric flags age interface next-AS
0.0.0.0/0 10.46.40.1 10 A S ethernet1/3
10.46.40.0/23 10.46.41.77 0 A C ethernet1/3
10.46.41.77/32 0.0.0.0 0 A H
192.168.254.0/24 192.168.254.111 0 A C tunnel.100
192.168.254.111/32 0.0.0.0 0 A H
total routes shown: 5
Example 1: After adding Client IP Pool range 10.0.0.0-10.255.255.255
> show routing route | match tunnel.11
10.0.0.0/8 10.0.0.0 10 A S tunnel.11
Example 2: After adding Client IP Pool range 10.0.0.1 - 10.255.255.255. Note the beginning IP changed to .1. the routing for the tunnel is shown below:
> show routing route | match tunnel.11
10.0.0.1/32 10.0.0.1 10 A S tunnel.11
10.0.0.2/31 10.0.0.2 10 A S tunnel.11
10.0.0.4/30 10.0.0.4 10 A S tunnel.11
10.0.0.8/29 10.0.0.8 10 A S tunnel.11
10.0.0.16/28 10.0.0.16 10 A S tunnel.11
10.0.0.32/27 10.0.0.32 10 A S tunnel.11
10.0.0.64/26 10.0.0.64 10 A S tunnel.11
10.0.0.128/25 10.0.0.128 10 A S tunnel.11
10.0.1.0/24 10.0.1.0 10 A S tunnel.11
10.0.2.0/23 10.0.2.0 10 A S tunnel.11
10.0.4.0/22 10.0.4.0 10 A S tunnel.11
10.0.8.0/21 10.0.8.0 10 A S tunnel.11
10.0.16.0/20 10.0.16.0 10 A S tunnel.11
10.0.32.0/19 10.0.32.0 10 A S tunnel.11
10.0.64.0/18 10.0.64.0 10 A S tunnel.11
10.0.128.0/17 10.0.128.0 10 A S tunnel.11
10.1.0.0/16 10.1.0.0 10 A S tunnel.11
10.2.0.0/15 10.2.0.0 10 A S tunnel.11
10.4.0.0/14 10.4.0.0 10 A S tunnel.11
10.8.0.0/13 10.8.0.0 10 A S tunnel.11
10.16.0.0/12 10.16.0.0 10 A S tunnel.11
10.32.0.0/11 10.32.0.0 10 A S tunnel.11
10.64.0.0/10 10.64.0.0 10 A S tunnel.11
10.128.0.0/9 10.128.0.0 10 A S tunnel.11
Example 3: After adding Client IP Pool range 192.168.113.0 - 192.168.113.255, the routing for the tunnel is shown below:
> show routing route | match tunnel.11
192.168.113.0/24 192.168.113.0 10 A S tunnel.11
Example 4: After adding Client IP Pool range 192.168.113.1 - 192.168.113.255 , the routing for the tunnel is shown below:
> show routing route | match tunnel.11
192.168.113.1/32 192.168.113.1 10 A S tunnel.11
192.168.113.2/31 192.168.113.2 10 A S tunnel.11
192.168.113.4/30 192.168.113.4 10 A S tunnel.11
192.168.113.8/29 192.168.113.8 10 A S tunnel.11
192.168.113.16/28 192.168.113.16 10 A S tunnel.11
192.168.113.32/27 192.168.113.32 10 A S tunnel.11
192.168.113.64/26 192.168.113.64 10 A S tunnel.11
192.168.113.128/26 192.168.113.128 10 A S tunnel.11
192.168.113.192/27 192.168.113.192 10 A S tunnel.11
192.168.113.224/28 192.168.113.224 10 A S tunnel.11
192.168.113.240/29 192.168.113.240 10 A S tunnel.11
192.168.113.248/30 192.168.113.248 10 A S tunnel.11
192.168.113.252/31 192.168.113.252 10 A S tunnel.11
192.168.113.254/32 192.168.113.254 10 A S tunnel.11
Example 5: After adding Client IP Pool range 192.168.113.5 - 192.168.113.254, the routing for the tunnel is shown below:
> show routing route | match tunnel.11
192.168.113.5/32 192.168.113.5 10 A S tunnel.11
192.168.113.6/31 192.168.113.6 10 A S tunnel.11
192.168.113.8/29 192.168.113.8 10 A S tunnel.11
192.168.113.16/28 192.168.113.16 10 A S tunnel.11
192.168.113.32/27 192.168.113.32 10 A S tunnel.11
192.168.113.64/26 192.168.113.64 10 A S tunnel.11
192.168.113.128/26 192.168.113.128 10 A S tunnel.11
192.168.113.192/27 192.168.113.192 10 A S tunnel.11
192.168.113.224/28 192.168.113.224 10 A S tunnel.11
192.168.113.240/29 192.168.113.240 10 A S tunnel.11
192.168.113.248/30 192.168.113.248 10 A S tunnel.11
192.168.113.252/31 192.168.113.252 10 A S tunnel.11
192.168.113.254/32 192.168.113.254 10 A S tunnel.11