topic Global Protect gateway configuration in General Topics

Global Protect gateway configuration

ChanaBaljit — Wed, 31 Jul 2024 14:30:15 GMT

Hi Guys

I'm hoping someone can help me with an issue that is constantly being reported by our users. We have Global Protect rolled out to all of our users. On a regular basis, perhaps 2-3 times per week, I come across reports of slowness, poor performance, etc. Speed test download speeds with GP enabled show between 5-25Mb, but when GP is disabled it shoots up to 100Mb+ for most users. I understand there'll be a reduction due to inspection, etc but this seems drastic.

I spotted this on our client today. Our UK users are connected to a UK gateway but the Gateway Location is UK Northeast. Is that to be expected?

Many thanks

Re: Global Protect gateway configuration

Claw4609 — Fri, 02 Aug 2024 19:29:48 GMT

Hello,

I am assuming you are utilizing Prisma Access gateways as that looks to be a Palo Alto IP address. Do you have a US gateway configured? And do you allow users to manually select gateways or is everything automatic?

Where is that gateway IP address located in terms of country? I would just ping it and check the firewall logs for the destination country if something like ARIN or other sites doesnt show the country.

You could also pull a clients debug logs and take a look at specifically the pangps and pangpa logs to see if anything is failing or see specifically what gateway its connecting to.

Re: Global Protect gateway configuration

BPry — Tue, 06 Aug 2024 22:04:36 GMT

@ChanaBaljit,

We get these speedtests all the time and I've had people stop reporting them, it's not helpful from a troubleshooting aspect. Monitor your tunnel latency reports for clients when they're affected and ensure that you have the description field enabled so you're actually seeing the latency report.

Re: Global Protect gateway configuration

PhilipScott — Wed, 14 Aug 2024 10:52:40 GMT

Thanks for the advice, I will keep it in mind.