topic Re: External up but, internal Outage, Migrating Users in General Topics

External up but, internal Outage, Migrating Users

nicford — Thu, 11 Jan 2018 16:20:14 GMT

Hi,

I am looking to explore options that in a situation when the External Edge may be "up" but, the internal resources have failed. For example, a core switch has crashed but, the firewalls and internet routers are still online. Users will connect to the gateway via GP but, no be able to access resources. What is a way to migrate users dynamically or stop advertising a gateway for a period to avoid new connections?

Re: External up but, internal Outage, Migrating Users

Mick_Ball — Thu, 11 Jan 2018 17:14:11 GMT

Hi, i don't have an answer but have posted here for any further updates.

I could never find an easy way to prevent users from connecting to a particular gateway.

I have removed the gateway from GP portal settings but this seems to take days to fully propogate.

the only solution I have used in the past is to change the IP address on the offending gateway. this prevents GP users from getting the initial SSL handshake and thus prevents any further connections. it also forces a rediscover (if set to always on) and users will auto migrate to another gateway.

I am however only able to do this as we have dedicated PA's for our gateway services with no other incoming traffic.

hopefully ther is a friendlier option......

Re: External up but, internal Outage, Migrating Users

nicford — Thu, 11 Jan 2018 19:35:18 GMT

My SE told me PAN has no feature for this scenario and recommend a script to disable the gateway.

Re: External up but, internal Outage, Migrating Users

BPry — Thu, 11 Jan 2018 19:39:08 GMT

@nicford,

I don't think there is anything built in that has this ability. However you could likely script something using the API that would trigger on certain conditions that would perform @Mick_Ball's suggestion.

*edit

You must have updated right before I posted this. Let me know if you want/need any help with the API commands @nicford