topic Re: Multiple global protect portals and gateway in General Topics

Multiple global protect portals and gateway

Matteo — Sun, 22 Mar 2020 22:03:02 GMT

Hello,

we have 2 palo 850 with 2 isp:

primary 1.1.1.1/28

backup 2.2.2.2/28

most of the zones navigate with the primary and few with the backup

We have a failover to the backup in case the primary isp goes down.

We have globalprotect portal and gateway with a loopback interface all on the primary (1.1.1.5/32) vpn.domain.it

This days we are all smartworking because of the global pandemie ,conected via the global protect client .

Our concern is that if the primary isp goes down we have to suspend our smartworking because we can not connect anymore .I read the discussions and documentation on multiple isp globalprotect configuration faillover and all talk about configuring 2 VR and i must say that they are too complicated for my level of knowledge and i don't want to mess up the actual working configuration.

In order to solve the problem i tryed to clone the portal gateway and loopback on the backup isp(2.2.2.5/32)vpn2.domain.it, but it doesn't work. I see the requests in allow but aged-out. Where am i wrong? Is it possible to have a seccond globalprotect vpn gateway?

Re: Multiple global protect portals and gateway

Matteo — Thu, 19 Mar 2020 01:13:06 GMT

So after hours of tests i ended up with this problem. I configured and test The solution of using 2 virtual router( i can connect with Globalprotect client) but i have The problem that alll routes are on The first VR so i cant reach my lan. I backend up and restore The configurații with one router but în this case it has 2 0.0.0.0/0 routes for each ISP controlled by metric so i think it only works when The primary ISP goes down. I Reed somethig about dynamic routing and ospf but i cant understand how to make it work.

Re: Multiple global protect portals and gateway

PaulStein — Tue, 02 Jun 2020 20:21:45 GMT

Just pass the traffic from one vr to the other. IE Subnet x.x.x.x/xx is on VR1. You just have to be sure to pass the traffic back to the other VR for the return.

Re: Multiple global protect portals and gateway

jdelio — Thu, 04 Mar 2021 21:42:54 GMT

Just to let everyone know that a Blog has been written about this subject here:

https://live.paloaltonetworks.com/t5/blogs/multiple-globalprotect-portals-and-gateways/ba-p/360452

Please be sure to check it out.