topic Re: Change ISP in General Topics

Change ISP

Si_Infrastructure — Sun, 10 Jun 2018 18:44:02 GMT

we're upgrading the internet link in one of our offices...so qwe purchased a new link from a different provider...and I was thinking of unplugging the old link, plugin the new link, remove the old public IP address and then add the IP address of the new link, change the default route...the firewall is PA-200 version 7.1.14...has anyone done this before? is this a good practise?

Re: Change ISP

reaper — Mon, 11 Jun 2018 09:26:26 GMT

If you have a maintenance window where you can perform a cutover, this would be a good way to go about your migration (don't forget NAT and security policies)

This will be the quickest way, but will require some downtime (and you'll need to make sure you have OOB acccess or can be on-site to perform this)

alternatively you can plug the new ISP in a free interface and set it up from scratch (new zone, add the sone to existing security policies, create new NAT rules, add default route with slightly higher metric and commit)

after the commit you can first run a few tests and will retain access to the office through the original ISP, until you shut off the original interface and the NEW ISP will take over

Re: Change ISP

RobinClayton — Mon, 11 Jun 2018 13:33:19 GMT

A great deal depends on what your doing,

Do you have inbound rules for NAT to inside hosts?

Do any of the third parties you connect to have IP address restrictions?

A "Cutover" period migration from one to the other would be ideal rather than a Straight complete swap over.

Both can run at the same time, and you can use PBF to move traffic out the second link.

Rob

Re: Change ISP

LukeBullimore — Mon, 11 Jun 2018 15:29:44 GMT

Make sure to check your default outgoing NAT rule as well. If it is set to source translate to the interface address then you will be fine, otherwise the configuration will need to be amended to your new public IP range.

Re: Change ISP

Si_Infrastructure — Mon, 11 Jun 2018 15:29:48 GMT

I am not in the office...we can afford some downtime...i just need to do this quickly...

We have a VPN tunnle with another office so i need to change that as well...

if I use PFB, Can i remove it later without any downtime?

also, when I access the firewall public IP...i am redirected to Global Protect Page, not the firewall GUI page...any idea how to access it?

I think I need to change the below:

- Interface IP

-Global Protect portal

- Global protect gateway

- IKE Gateway

- One NAT policy

- Default route..

Can you think of something else?

Will the VPN work after changing the IP address and resetting it?

Re: Change ISP

Si_Infrastructure — Thu, 28 Jun 2018 19:23:05 GMT

ISP was changed successfully...for all of the network engineers out there...

- Change the interface IP

- Chane the default route

- Change GlobalProtect settings

- Issue a new cert. for GlobalProtect

- Change the polices

-No need to reset the VPN

Re: Change ISP

Dars_Em — Wed, 09 Apr 2025 07:48:43 GMT

Hi Reaper, is the new Zone required (ex. I have existing "Untrust-A", I will create new "Untrust-B") is it required to have this working if I plug the new internet line in a free interface (eg. eth1/2)? Should I add the new Zone in every rule with existing Untrust?