topic Re: GlobalProtect gateway limit in GlobalProtect Discussions

GlobalProtect gateway limit

Peter_Tan — Wed, 01 Jul 2020 17:53:11 GMT

We have a pair of PA-850 firewalls, and we are running into an error when pushing configuration from Panorama that contains 7 GP gateways (6 external and 1 internal), and 6 portals.

. global-protect -> global-protect-gateway -> GlobalProtect AlwaysOn constraints failed : Maximum number of GlobalProtect gateway configuration exceeded

The only related documentation I can find is https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClidCAC, which states that the number of "external" gateways for a PA-850 is limited to 12. We have spoken with support, and they insist that the limit is gateway + portal, even though I can continue to add ports and push the config to our PA-850 with no issues, and that it is in direct contradiction with what the published documentation states. I have also tested by deleting 2 portals (4 remaining) and still cannot add a 6th external gateway, with 1 internal gateway.

We are getting no help from support, and getting frustrated with the lack of a path to resolution. I can accept it if the gateway limit is indeed 6 (or combined limit of 12 for gateway + portal), as long as it is states clearly as such in any published documentation.

Anyone else ran into a similar situation?

Re: GlobalProtect gateway limit

abahrami — Wed, 01 Jul 2020 23:00:55 GMT

Hello Peter ,

Hope you are doing good.

I just wanted to update you that I am checking internally regard this issue and I am trying to replicate this problem in my lab device.

I’ll update you as soon as I have further information.

Thank you!

Re: GlobalProtect gateway limit

Peter_Tan — Mon, 06 Jul 2020 17:04:57 GMT

Hi Abahrami,

Thank you for looking into this for me.

Peter

Re: GlobalProtect gateway limit

Chris_Johnston — Tue, 20 Jul 2021 19:15:34 GMT

Did you ever get an answer? I have a case opened today for adding a 7/8th gateway to an 850 running 9.0.12 with the same error message failing.

Re: GlobalProtect gateway limit

Peter_Tan — Tue, 20 Jul 2021 19:25:27 GMT

unfortunately, no. We never got a response/solution out of support. I have tested this again today, and we still have the same limit

Re: GlobalProtect gateway limit

Chris_Johnston — Tue, 20 Jul 2021 19:28:17 GMT

I'll update you on my case status when I get one. As of right now, it noted it *should* be fixed in 9.1.11

PAN-112175
Fix in 9.1.11 ETA 8/5/21

Re: GlobalProtect gateway limit

Chris_Johnston — Tue, 27 Jul 2021 12:56:48 GMT

Just an update - asked TAC to confirm bugID was correct.

Engineering did duplicate it to previously found PAN-112175.
Fix in 9.1.11 ETA 8/5/21

No plans to backport to 9.0.x yet.