topic Re: GP gateways under the same ISP in General Topics

GP gateways under the same ISP

GeorgiosFakis — Fri, 30 Aug 2019 07:34:04 GMT

Hello ,

I have setup for the company portal and gateway with a specific IP pool and there is one pulbic IP on the ISP. Now they want partners to connect as well and I was wondering if is possible to have either on the same gateway another VPN IP pool and setting like DNS or I can make another gateway under the same IP with another port.

Re: GP gateways under the same ISP

Chacko42 — Fri, 30 Aug 2019 08:05:03 GMT

@GeorgiosFakis: Both is possible, but I think the first one is more elegant.

So you create a second network config for the second vpn-users group and assign them a own network config (External GW > Agent > Client Settings).

Using different DNS servers per client settings is supported from PAN-OS 9.0 on. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/globalprotect-features/dns-configuration-assignment-based-on-users-or-user-groups.html

Re: GP gateways under the same ISP

GeorgiosFakis — Fri, 30 Aug 2019 08:24:29 GMT

But what if I have PAN-OS version 8.1 ?

Re: GP gateways under the same ISP

Chacko42 — Fri, 30 Aug 2019 08:30:26 GMT

Then you can only create agent settings regarding ip-pools and routing.

If a different DNS server is mandatory for you, you need to create a second external gateway and assign it to the vpn-users group in portal. You can use a loopback IP for second external Gateway and create a NAT-Policy (if untrust > untrust custom-port.... than DNAT to Loopback-IP:443)

Re: GP gateways under the same ISP

GeorgiosFakis — Fri, 30 Aug 2019 08:33:22 GMT

I was thinking about that different port that could work , thanks .

Re: GP gateways under the same ISP

Chacko42 — Fri, 30 Aug 2019 08:37:28 GMT

Right, you can define a custom-port like 666 which you then DNAT to the correct external-gw2.

Two external gateways on the same public IP are not possible, because the Palo couldn't make the difference which gw to use. There you have to use a dummy-IP/Loopback or a second public-ip