Global Protect Gateway Priority Question

palomed — Fri, 13 May 2022 17:52:38 GMT

I see that gateway priority options are Highest, High, Medium, Low and Lowest.

The articles I'm seeing on this property have mostly do with regions. But
in my case I'm just trying to influence more traffic to another gateway. And

if that second gateway is not available say to having all of its licenses in

use I then want to to choose another gateway. Would this be effected

by having the preferred gateway with Highest priority and the spillover

gateway to have a High priority? Or would the spillover gateway have

a Low priority? Insight appreciated.

Re: Global Protect Gateway Priority Question

Adrian_Jensen — Mon, 16 May 2022 23:25:56 GMT

Theoretically yes, I think (but not sure) that having no connections left would count as a gateway error, the same as being unreachable. The GP client would try to connect to the Highest priority gateway, find that it can't connect, and then go to the High priority gateway to try and connect.

However... For the initial gateway selection with a small number of gateways with roughly equal latency, there are effectively only 2 selections that guaranty one gateway gets chosen over the other in non-error conditions: Highest/High/Medium or Low/Lowest. This is because of the way the selection algorithm works. The Highest/High/Medium gateways are all lumped together and a latency check to each is performed (assuming in the correct region). The average latency to all is calculated and those gateways over the average are temporarily excluded. The Highest/High/Medium priorities are then applied to the remaining gateways and connections attempted to each in order of priority. If none of the chosen initial gateways are reachable, then the excluded gateways and Low/Lowest are attempted in order of priority.

For example, if you have 2 gateways, one set to Highest and the second set to Medium, with roughly equal latency, then the first connection attempt is always whichever gateway has a lower latency at the moment (because the slightly higher latency gateway is greater than the average latency). In order to force the priority one has to be in the Highest/High/Medium group, and the second in the Low/Lowest group.

This can lead to some non-ideal or unexpected gateway connection ordering when dealing with gateways that have similar latency (where the difference between is mostly determined by measurement jitter).

Ideal gateway selection:

Gateway	Priority	Latency
gw1	Highest	50ms
gw2	High	60ms
gw3	Medium	75ms	initially excluded
gw4	Low	100ms
gw5	Lowest	150ms

Highest-Medium average latency = 62ms, Gateway connection order (gw1 -> gw2) -> (gw3 -> gw4 -> gw5)

Ideal 2 gateway selection:

Gateway	Priority	Latency
gw1	Highest	50ms
gw2	Medium	60ms	initially excluded

Highest-Medium average latency = 55ms, Gateway connection order (gw1) -> (gw2)

Unexpected 2 gateway selection due to latency:

Gateway	Priority	Latency
gw1	Highest	60ms	initially excluded
gw2	Medium	50ms

Highest-Medium average latency = 55ms, Gateway connection order (gw2) -> (gw1)

Forcing 2 gateway selection regardless of latency:

Gateway	Priority	Latency
gw1	Highest	60ms
gw2	Low	50ms

Highest-Medium average latency = 60ms, Gateway connection order (gw1) -> (gw2)

Unexpected 5 gateway selection with normally high priority gateways experiencing high latency:

Gateway	Priority	Latency
gw1	Highest	120ms	initially excluded
gw2	High	90ms	initially excluded
gw3	Medium	50ms
gw4	Low	30ms
gw5	Lowest	35ms

Highest-Medium average latency = 87ms, Gateway connection order (gw3) -> (gw1 -> gw2 -> gw4 -> gw5)

topic Re: Global Protect Gateway Priority Question in GlobalProtect Discussions

Global Protect Gateway Priority Question

Re: Global Protect Gateway Priority Question