topic Re: Redundancy for Global protect VPN in General Topics

Redundancy for Global protect VPN

ChandrashekharD — Tue, 13 Feb 2024 17:52:37 GMT

Dear Friends,

We have a customer who is Currently configured with GP- Global Protect for VPN is connecting with ISP-1, one Public IP / One ISP-Internet Service Provider.

Requirement is, can we configure as backup or as redundant with another ISP-2 ?

Purpose : Once One ISP is down, then GP- Global Protect users will not disconnect from remote VPN service. It will redirect with ISP-2 as like failover.

Please confirm once, Is it possible?

Re: Redundancy for Global protect VPN

Claw4609 — Tue, 13 Feb 2024 19:09:25 GMT

Hello,

Would this be for the GlobalProtect portal or the gateway? You could have you Globalprotect attached to a loopback interface and follow the steps from this post: LIVEcommunity - Nominated Discussion: Dual ISP Global Protect Redundancy - LIVEcommunity - 520124 (paloaltonetworks.com)

If you're just worried about the Gateway and not the Portal you could have multiple Gateways created as well so in the event one goes down the clients will reconnect to the second gateway. If the portal is down in this scenario new users wouldn't be able to connect until thats back up but the active users shouldnt notice a difference.

I've seen posts previously saying people have done two separate portals and did a DNS round robin, however I personally haven't tested this.

Re: Redundancy for Global protect VPN

ChandrashekharD — Sat, 17 Feb 2024 07:37:38 GMT

Thanks for responding, this is for global protect gateway..

Re: Redundancy for Global protect VPN

TomYoung — Sun, 18 Feb 2024 03:32:19 GMT

Hi @Claw4609 and @ChandrashekharD ,

I have tested option 1 in this doc, and it works! https://www.wandynamics.com/blog/ensuring-high-availability-globalprotect-vpn-portals

If you configure 2 gateways and save user name, the client caches the gateways. If the portal is down, the client automatically connects to the 2nd gateway. Configure portal and gateway on ISP-1. Configure 2nd gateway on ISP-2. List both gateways under the portal. You could give gateway 1 the highest priority.

The doc also has options 2 and 3, which are (2) manually change portal and (3) GSLB.

Thanks,

Tom

Re: Redundancy for Global protect VPN

Igor_Bartak — Mon, 09 Jun 2025 18:24:18 GMT

Hi @Claw4609 and @ChandrashekharD ,

I've just put my insights/observations regarding redundancy of GP here: https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-dual-isp-global-protect-redundancy/ta-p/520124

I would appreciate any other thoughts or counter-opinions.

Regards

Igor