topic Palo RAVPN connection profiles? in GlobalProtect Discussions

Palo RAVPN connection profiles?

routereigrp50 — Fri, 06 Oct 2023 10:05:53 GMT

Hi,

I'm taking my first steps in palo and trying to understand RA VPN configuration.

I used to work with cisco devices where i have possibility to create different connection profiles for users and when they connect to vpn they can choose group where they want to connect. Example bellow:

I thought i will be able to configure something like that by creating one GPPortal and two GPGateways but as far as i checked i have no possibility to create two gateways on same IP Address.

Is something like that avaiable to configure?

Re: Palo RAVPN connection profiles?

reaper — Mon, 09 Oct 2023 08:48:43 GMT

if you need 2 gateways, you can attach one gateway to a loopback interface, and use a PAT rule to translate (for example) port 5000 externally to port 443 on the loopback. you can then add both IP's to the portal external gateway list, adding :5000 to the one on the loopback

Re: Palo RAVPN connection profiles?

routereigrp50 — Tue, 10 Oct 2023 07:23:41 GMT

@reaper

Yeah but those gateways will have different IP addresses then? If not and just nat is there to do the job what is loopback for?

Re: Palo RAVPN connection profiles?

reaper — Wed, 11 Oct 2023 13:45:05 GMT

if you want them to have the same IP, you can run the first gateway on the external interface listening on port 443, then have a NAT rule that translates the external IP:5000 to loopbackIP:443

your portal config will look like this:

the first gateway is the regular fqdn, connecting to port 443, the second one is running on port 5000

You only need 1 IP this way, but the drawback is that the second gateway can't support IPSec

the alternative is to get an additional public IP address