topic Re: Adding PA DR site globalprotect SSL-VPN gateway in GlobalProtect Discussions

Adding PA DR site globalprotect SSL-VPN gateway

MRamadanAHafiez — Thu, 06 Nov 2025 07:56:52 GMT

Hello Team,

Currently we are duscussing adding a DR site for our network.

currently in the main datacenter we have globalprotect SSL-VPN configured.

and now we are about to add a new PA-1410 in the DR site, and also configuring the Gateway for our employees.

now we will have 2 portal IPs, the main and the DR one.

Is there a way to make it automatic switching between the clients installed globalprotect to switch from the main site IP and connect to the DR globalprotect IP in case the main site was not responding "DR site active now". and vice versa, to connect to the main GP IP when it respored back running?.

TIA

Re: Adding PA DR site globalprotect SSL-VPN gateway

reaper — Thu, 06 Nov 2025 09:01:58 GMT

you don't need to add a portal component to the DR site necessarily. Clients will retain their configuration if the portal is down so they'll be able to connect to the DR gateway if the main gateway is down.

You can set up the main gateway with highest priority and the DR site gateway with lowest priority so clients only connect to the DR when the primary is unavailable

if you want to be able to run a portal on the DR; you can configure it to be an exact copy of the main portal and change the DNS A record in case of extended outage

Re: Adding PA DR site globalprotect SSL-VPN gateway

MRamadanAHafiez — Thu, 06 Nov 2025 13:57:41 GMT

then the idea is configuring the main site "the currently working now with the current fqdn and IP x.x.x.x" and configuring the DR site with fully configured portal but for sure with another fqdn and IP y.y.y.y address and add both to the globalprotect at the client, and in case of main site failure "totally unreachable", then it will automatically connect to the lower priority portal "DR".

if I got ur point right, how to configure this priority in the panos?

--------------------------Adding-------------------

I have found the option to change the priority now, but it seems that this is portal config option, not option that will affect the client performnce "choosing the higher priority then failing to the DR if not available.

Re: Adding PA DR site globalprotect SSL-VPN gateway

reaper — Fri, 14 Nov 2025 13:14:51 GMT

no, that is not how portals in GlobalProtect work unfortunately, each portal is considered a standalone entity. only gateways can be set up to have preference