Global Protect VPN Client - 3day bridge running Sev-A
Users recently migrated FROM Cisco Anyconnect VPN client -TO- Palo Alto Global Protect (GP).
This case is not for the faint hearted.
Remote working end-user can connect with GP to local wifi hotspot using mobile date, no problems at all.
But when connecting to local 'home router' with either wired or wireless, most GP connection attempts fail, that is most not all.
Looking at capture below (had to cut out IPs), I suspect problems with the GP application. Essentially I am observing a series of the following:
- syn
- syn-ack
- ack
- fin-ack (client)
- fin-ack
- ack
Regarding FIN, this is just something general, I have always see FIN-ACK, but never a FIN, I suspect that is TCP standards, but it would be nice to see FIN handshake is the same fashion as we see SYN start-up. Both use three packets to complete so I don't see the need for only FIN-ACKs.
Turning now back to the original problem here is the packet capture snippet:
(You need onedrive account I think)
I have query around tcp port 'reuse'.
we see a syn just above the first 'retransmission', nothing is received back so the client issues another syn and then another.
In terms of the IP header the ID increments by one after each packet ...
would i be right is asserting that the client is misbehaving, or am I missing something here ...