Gloabl Protect -Gateway selection

VivekMs — Sat, 25 Oct 2025 07:14:25 GMT

Hello,

As per the PA document -

GlobalProtect uses a network discovery method to select the best available gateway from the available multiple gateway options. GlobalProtect attempts to communicate with all the gateways and uses criteria such as gateway priority, load, and response time from the gateway to determine the best available gateway to connect.

Can someone clarify which load is checked—endpoint load (CPU, etc.) or gateway firewall load (CPU, utilization, etc.)?

Re: Gloabl Protect -Gateway selection

kiwi — Fri, 31 Oct 2025 15:59:53 GMT

Hi @VivekMs ,

The goal is to prevent a client from connecting to a gateway that is already near its maximum concurrent tunnel limit or is under heavy processing strain.

The most critical metrics typically considered include:

Session Capacity/Utilization: The percentage of its licensed VPN tunnel capacity that the gateway is currently using (e.g., if it has a max of 2,000 tunnels and is currently handling 1,800, its load is high).
System Health: While not strictly "load," the gateway's overall health and ability to respond to requests are factored in, often via response time. High CPU or session utilization on the firewall's data or control plane can lead to a longer response time, which is the primary and most measurable factor.

Hope this helps,

-Kim.

topic Gloabl Protect -Gateway selection in GlobalProtect Discussions

Gloabl Protect -Gateway selection

Re: Gloabl Protect -Gateway selection