topic Re: Global Protect with Second ISP which not have a default route to internet in General Topics

Global Protect with Second ISP which not have a default route to internet

sambhusarath — Fri, 25 Nov 2022 09:30:12 GMT

The issue is due to the static route of 0.0.0.0 is through the First ISP. Tried to add the PBF but still the same behavior even with symmetric return

Any advise ? Know the option if another Virtual router , but with one single VR , is there any way ?

Re: Global Protect with Second ISP which not have a default route to internet

Bharat_Rajwanshi — Fri, 25 Nov 2022 14:27:30 GMT

Well this look little challenging but I am guessing you are trying route GP traffic via second ISP. Did you try with PAT for second ISP?

let's say your GP source subnet is 192.168.10.0/24, and Zone is GP

Your PAT -

Source GP Zone / 192.168.10.0/24

Destination Outside Zone / Public IP

Same for Security Policy rule for accepted outbound traffic

Re: Global Protect with Second ISP which not have a default route to internet

aleksandar.astardzhiev — Sun, 27 Nov 2022 10:09:13 GMT

Hi @sambhusarath ,

Can you share your PBF configuration?

Following link describe setup similar to what you want to achieve - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClF5CAK

As you can see PBF with Enforce Symmetric return should provide you with required result - return the replies from GP via secondary ISP.

So I am assuming something is not configured properly with your PBF. Try to follow the setups from the link and if still not working we can try to troubleshoot.

Re: Global Protect with Second ISP which not have a default route to internet

sambhusarath — Tue, 26 Nov 2024 16:23:47 GMT

Can you reshare this KB ?

Re: Global Protect with Second ISP which not have a default route to internet

OtakarKlier — Tue, 26 Nov 2024 22:51:50 GMT

Hello,

If you have two ISP's and just want failover, use PBF for the primary with the policy to shut down if path not detected. Then the default route points to the second ISP.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLL8CAO

Regards,