topic Multiple GlobalProtect Gateways on same interface? in General Topics

Multiple GlobalProtect Gateways on same interface?

welly_59 — Wed, 10 Oct 2018 09:26:45 GMT

We recently (today) configured pre-logon VPN, but have come across what could be a show stopper. As its currently configured we have configured:

Gateway > (gateway name) > Authentication > Certificate Profile > (a client cert signed by our infrastructure)

If a machine has this cert installed it now succesfully connects via "pre-logon", and once signed into Windows it all works as expected.

If a machine doesnt have this cert installed then "pre-logon" does not work, but additionally they are unable to sign in once in Windows as they are presented with an error stating cert is missing.

Is this how it should be configured or have i missed a step somewhere?

The issue is we have a requirement for some non-domain users/assets to be able to connect to the VPN. As it stands with the way i have configured pre-logon they cant connect, as the cert is missing.

What is the correct way to resolve this and keep pre-logon?

I was thinking to create a second gateway, on the same interface as the current one, but assign a secondary IP to the interface. I would more or less copy the config from the existing gateway, but not assign a certificate profile to it.

The portal agent config for these external users would then be configured to use the newly created gateway.

Is this how to solve this problem?

Re: Multiple GlobalProtect Gateways on same interface?

Brandon_Wertz — Wed, 10 Oct 2018 12:58:56 GMT

@welly_59 wrote:

What is the correct way to resolve this and keep pre-logon?

I was thinking to create a second gateway, on the same interface as the current one, but assign a secondary IP to the interface. I would more or less copy the config from the existing gateway, but not assign a certificate profile to it.

The portal agent config for these external users would then be configured to use the newly created gateway.

Is this how to solve this problem?

This should work. This is what I was thinking as well.

Re: Multiple GlobalProtect Gateways on same interface?

BPry — Wed, 10 Oct 2018 13:40:42 GMT

@welly_59,

As @Brandon_Wertz mentioned this would work perfectly fine and accomplish exactly what you are looking to do without issue.

Re: Multiple GlobalProtect Gateways on same interface?

welly_59 — Wed, 10 Oct 2018 13:50:58 GMT

Excellent news. While waiting for an answer here though ihave succesfuly configured it using a loopback interface on the FW (public IP on it, we have loads), and it all works