topic Re: PBF with Dual ISP. Once Enabled GlobalProtect Clients no longer can connect. in General Topics

PBF with Dual ISP. Once Enabled GlobalProtect Clients no longer can connect.

blohrer — Fri, 13 Jul 2018 17:24:33 GMT

We have setup a PBF to route traffic to a new ISP link we have in case our primary fails.

Both ISP interfaces are in one virtual router.

Once we change the default route to the Backup ISP and enable the PBF to forward all traffic to the Primary unless it fails, users can no longer connect to our GlobalProtect portal with the GlobalProtect client.

I know it is because of the new default route pointing at the secondary ISP, but is there a route I can create to fix?

Re: PBF with Dual ISP. Once Enabled GlobalProtect Clients no longer can connect.

Retired Member — Fri, 13 Jul 2018 17:42:06 GMT

Hi,

create 2 virtual routers with 2 seperate default gateways.That will be better. you can then create 2 different global protect 1 for main,1 for second isp.your Lan and isp1 will be at default, your isp2 will be at new virtual router.Then you will also add a LAN- next vr default vr route at new virtual router.

you can use pbf for main with monitor and 2nd pbf rule will route clients to isp2

Regards

Re: PBF with Dual ISP. Once Enabled GlobalProtect Clients no longer can connect.

BPry — Sat, 14 Jul 2018 20:34:59 GMT

@blohrer,

Unless you are advertizing the same range with both ISPs then I would do exactly what @Retired Member is recommending.

Re: PBF with Dual ISP. Once Enabled GlobalProtect Clients no longer can connect.

blohrer — Mon, 23 Jul 2018 12:50:48 GMT

The only thing I have tried as of yet, is to move the Global Protect Gateway and Portal to the ISP two connection. When I did this, the clients could successfully connect. The only problem I had at that point was that once connected, the users could not access the local network.

The VPN is used by a small number of users. The second ISP is only used to roll over for outbound access for internal users.

Is there a routing issue I am missing to allow the VPN to work on the second ISP?