topic Re: maximum number of GlobalProtect VPN tunnels for PA-5450 in General Topics

maximum number of GlobalProtect VPN tunnels for PA-5450

RomainCouvreur — Thu, 16 Feb 2023 09:27:41 GMT

Hello PA community ,

Our customer is looking for the maximum limit for GlobalProtect Gateways on PA-5450.

The most recent KB we found was this which covers 5250, but we would very much like to verify if it is still the same or more for 5450:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClidCAC

we checked also compare link and PA-5400 Series Firewall Overview but no clue.

https://www.paloaltonetworks.com/products/product-selection#

Thanks in advance for your help on this.

Best regards.

Re: maximum number of GlobalProtect VPN tunnels for PA-5450

kiwi — Thu, 16 Feb 2023 13:11:49 GMT

Hi @RomainCouvreur ,

You can check the device limits via cli using the command :

> show system state filter cfg.general.max*

Check out this KB: What is the Command to Display System Limits?

Check for the value next to 'cfg.general.max-ssl-portal'

Kind regards,

-Kiwi.

Re: maximum number of GlobalProtect VPN tunnels for PA-5450

TomYoung — Thu, 16 Feb 2023 15:57:49 GMT

Hi @RomainCouvreur ,

The PA-5450 can have 60K GlobalProtect clients. Many of the max #s can be found on the Product Selection page -> https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-5450,pa-5410.

Thanks,

Tom

Re: maximum number of GlobalProtect VPN tunnels for PA-5450

RomainCouvreur — Fri, 17 Feb 2023 12:35:34 GMT

Hello Team ,

Thank you for your feedback.

However , I m not asking about how many GlobalProtect clients can be connected at one time.

What I need to know is how many GlobalProtect portals and/or Gateways can be configured on the device before we will reach a limit?

The reason being is customer is a MSP and might be deploying one portal and gateway per customer.

Thanks in advance for your assistance.

Best regards.

Re: maximum number of GlobalProtect VPN tunnels for PA-5450

TomYoung — Fri, 17 Feb 2023 14:26:51 GMT

Hi @RomainCouvreur ,

Yeah, I was curious if you were asking about tunnels (mentioned in topic) or gateways (mentioned in post). Looking at the URL you posted, I should have known you were talking about gateways. My bad!

What you're really saying is that PANW needs to update the KB!

I did use @kiwi 's command on a PA-220 we have.

> show system state filter cfg.general.max* | match portal
cfg.general.max-ssl-portal: 6

The number of portals matches the number of gateways listed in the KB URL. I wonder if the max GP portals and gateways is the same? You could check the results on other NGFWs if you have it. If they match, go with @kiwi 's answer and mark it as the solution.

Thanks,

Tom

Re: maximum number of GlobalProtect VPN tunnels for PA-5450

RomainCouvreur — Tue, 21 Feb 2023 08:57:41 GMT

Hello Tom ,

We checked the output on others NGFWs and it matches the number of gateways listed in the KB URL.

Thanks again for your help and for sure I will mark kiwi 's answer as the solution.

Have a nice day ahead.

Best regards.