topic Re: GP portal with multiple gateway can automate failover between multiple gateways when highest priority gateway gets down ? in GlobalProtect Discussions

GP portal with multiple gateway can automate failover between multiple gateways when highest priority gateway gets down ?

ShivaVaishya — Thu, 26 Aug 2021 12:57:27 GMT

whether GP portal (containing Multiple GP Gateways) can automate enforcement of GP Gateways in the event when primary GP Gateway gets down due to any undesired reason.

If the failover between gateways is automatic; without users noticing that they have been disconnected and re-connected to the other gateway >

Re: GP portal with multiple gateway can automate failover between multiple gateways when highest priority gateway gets down ?

Mick_Ball — Sat, 28 Aug 2021 07:06:06 GMT

No this is not possible. The user may not notice if they are just browsing or using a local app but if they are using for example .. video streaming or RDP then they will be disrupted.

GP will retry the current gateway a number of times before trying another gateway. This process time can be reduced in the GP portal config settings. This may speed the process up but be careful not to force GP refresh for slight network glitches.

Re: GP portal with multiple gateway can automate failover between multiple gateways when highest priority gateway gets down ?

ShivaVaishya — Mon, 30 Aug 2021 04:05:28 GMT

Thanks MickBall. Please check below concern,

When GP portal has multiple Gateways, if Gateway with highest priority gets down and its not coming up, then Gateway with less priority with respect to highest one will address/assess all GP clients traffic. So, while this happen , whether users have to enter their credentials again in their GP client Application to get authenticated in order keep using GP ssl-vpn ? ( While 2nd Gateway with less priority with respect to highest one takes over, does it remain transparent to end users ? While this failover happens whether GP portal/GP client application asks/forces users to authenticate again for continuing to use GP ssl-vpn ?

For GP end users , how we can have auto failover between multiple gateways in above scenario so that users do not have to authenticate again or users need not to put their GP credentials in their GP client application in continuation to use GP ssl-vpn ?

Thanks in advance !!

Shiva Vaishya

Re: GP portal with multiple gateway can automate failover between multiple gateways when highest priority gateway gets down ?

Mick_Ball — Tue, 31 Aug 2021 15:18:22 GMT

You can generate cookies from the portal login, you can then allow gateways to accept the cookies for authentication. It is called authentication override. We use it for one time passcodes. Works great... I would suggest that you do not accept cookies auth on portal and tick box portal as per my below...

Re: GP portal with multiple gateway can automate failover between multiple gateways when highest priority gateway gets down ?

ShivaVaishya — Tue, 31 Aug 2021 15:44:27 GMT

Hi Mickball,

Thanks for response!!

Since its not safe to enable cookies auth override for my requirement, Is their any other Safe way to fulfill this requirement where GP end users do not have to authenticate themselves when they are connected a GP portal which contains multiple GP Gateways and when their is failover from primary Gateway next reachable Gateway for redundancy purpose ?

Re: GP portal with multiple gateway can automate failover between multiple gateways when highest priority gateway gets down ?

Mick_Ball — Tue, 31 Aug 2021 16:20:11 GMT

I cannot understand your reasoning with cookies... another option would be to save user credentials but that would not be advisable, thats why theyboffer cookies.

another option would be to use certificate authentication to the gateways. Either use a domain issued cert or self signed.