topic Re: Need a setting to change interfaceMetric 1 to a higher value in GlobalProtect Discussions

Need a setting to change interfaceMetric 1 to a higher value

basinilya2 — Tue, 25 Nov 2025 18:05:59 GMT

Hi Community.

Every time when GP connects it sets its interfcaceMetric to 1. However, I have a nested VPN with even higher priority so every time I have to manually change the PANGP interface metric to a higher value e.g. 400. My wired connection already has metric 8500.

Do you know if there's a setting for that?

Re: Need a setting to change interfaceMetric 1 to a higher value

BPry — Mon, 01 Dec 2025 22:53:59 GMT

@basinilya2,

Assuming that you don't actually manage the GlobalProtect environment and you already have permission to do so locally on the endpoint, why wouldn't you just use a script to do this when you connect? Look into post-vpn-connect and run a post connection script locally if just running the script manually doesn't suite your needs, but this isn't something GlobalProtect just natively supports modifying.

Re: Need a setting to change interfaceMetric 1 to a higher value

phbrown — Fri, 05 Dec 2025 19:58:09 GMT

@basinilya2,

Rather than trying to configure a lower metric metric, you can create more specific routes. More specific routes takes precedence over metrics. So if the GlobalProtect has the subnet of 10.0.0.0/8, creating the more specific static routes of 10.0.0.0/9 and 10.128.0.0/9 will give it precedence.

Re: Need a setting to change interfaceMetric 1 to a higher value

basinilya2 — Sat, 06 Dec 2025 07:57:51 GMT

@phbrown I need a higher priority for the DNS server associated with the nested VPN. More specific routes don't fix this. Only the metric does. Windows has this poorly documented, but from my experience it can work simultaneously only with DNS servers of the two network interfaces with the highest priority and in case of disagreement the response from the first interface is used.

Re: Need a setting to change interfaceMetric 1 to a higher value

basinilya2 — Sat, 06 Dec 2025 08:03:23 GMT

@BPry

Thanks didn't know about post-vpn-connect. Indeed I wrote a script and added it to the Windows Task Scheduler, but post-vpn-connect seems like a better option.

# # Set PANGP adapter metric to a higher value so nested VPNs can work # # # Note that a race condition may occur if metric is set too early while GP is connecting # C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log # # Good: # des=0.0.0.0, mask=0.0.0.0, nextHop=10.41.224.68, ifidx=7, forwardType=3, forwardProto=3, age=0, nextHopAs=0, matrix=1,0,0,0,0 # number of route is 3 # Set route successfully. ForwardDest = 0.0.0.0, metric 1. # # Bad: # des=0.0.0.0, mask=0.0.0.0, nextHop=10.41.224.68, ifidx=7, forwardType=3, forwardProto=3, age=0, nextHopAs=0, matrix=400,0,0,0,0 # SetRoutes: CreateIpForwardEntry(0.0.0.0) failed (One or more arguments are not correct.) # $adapters = Get-NetAdapter | Where-Object { $_.ComponentID -eq "pangpd" } foreach ($interface in $adapters) { # Set IPv4 and IPv6 metrics to 400 Set-NetIPInterface -ErrorAction Continue -InterfaceIndex $interface.ifIndex -AddressFamily IPv4 -InterfaceMetric 400 Set-NetIPInterface -ErrorAction Continue -InterfaceIndex $interface.ifIndex -AddressFamily IPv6 -InterfaceMetric 400 Write-Output "Set IPv4 and IPv6 metrics to 400 for adapter: $($interface.Name) ($($interface.InterfaceDescription))" }

P.S. why are they premoderating my replies?