topic Re: Global Protect multiple gateway setup in GlobalProtect Discussions

Global Protect multiple gateway setup

SyedFaizuddin — Fri, 21 Apr 2023 11:22:15 GMT

I have an existing setup of Global protect Portal and gateway on first Firewall, I have created a New gateway on another Firewall and added that gateway to the portal of first firewall under Agent---> External gateway.

When I am connecting to Global protect from the app i am getting an IP address from the pool of first gateway which is the older one but not the new one which I have configured.

Re: Global Protect multiple gateway setup

Raido_Rattameister — Fri, 21 Apr 2023 12:35:00 GMT

Check "Manual" checkbox on External Gateway tab.

This allows you manually choose which gateway you want to connect to.

Otherwise GlobalProtect app will look at priority and latency.

If gateway priority is same then app will connect to gateway with lowest latency.

Re: Global Protect multiple gateway setup

Adrian_Jensen — Fri, 21 Apr 2023 17:12:08 GMT

Note that the way the gateway selection algorithm works, the "Highest", "High", and "Medium" priorities are essentially the same. Assuming all gateways are reachable, it falls purely to the calculated latency as to which is selected by the client. If none of those are available then it selects from the "Low" and "Lowest" priorities based on latency. You can see the calculated latencies in the PanGPS.log file on the client under Troubleshooting.

Re: Global Protect multiple gateway setup

Raido_Rattameister — Fri, 21 Apr 2023 17:17:57 GMT

Gateway priority/latency selection logic:

https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000ClVz