topic Re: GlobalProtect, multiple user-selectable endpoints? in General Topics

GlobalProtect, multiple user-selectable endpoints?

bradenmcg — Wed, 14 Jan 2015 08:06:56 GMT

I'm trying to setup two different versions of GlobalProtect SSLVPN endpoints. I already have a single portal + gateway configuration that only routes specific /24s through the VPN. I want to add a second setup that doesn't split-tunnel and instead passes all traffic through the VPN (for use on untrusted networks like public wifi).

Do I need to create an entirely separate Portal as well as Gateway config? Or can I have a single Portal, but multiple gateway configurations, and depending on which hostname is entered in the client config it will change the behavior?

It would be nice to be able to share a public IP for this, but if that's not possible it isn't a deal-breaker (we have a /24). I *can* reuse the same SSL certificate because it is a wildcard, so different hostnames for the different endpoints isn't a problem.

Re: GlobalProtect, multiple user-selectable endpoints?

pulukas — Wed, 14 Jan 2015 11:31:57 GMT

When configuring multiple gateways they cannot be on the same ip address.

Re: GlobalProtect, multiple user-selectable endpoints?

Wenar — Wed, 14 Jan 2015 13:24:28 GMT

It is possible to have more than one gateway on a public IP, but you have to use different ports, loopback interfaces and NAT:

Can GlobalProtect Portal Page be Configured to be Accessed on any Port?

Do you expect the user to chose the right VPN for himself? I don't think they will even care to change the configuration just because they are in an untrusted network. Or do you have users who know that they shouldn't access the company network from untrusted networks?

You can only have one portal/gateway if you don't have a portal license.

I hope this helps.