topic Re: Globalprotect in A-A in General Topics

Globalprotect in A-A

gksnl11 — Sat, 29 Aug 2020 08:26:05 GMT

Hi, I have some question.

If I have configure Active-Active HA and two GP portals with PA-3260.

e.g. fw1's portal : 111.111.111.111

fw2's portal : 222.222.222.222

(limitation of SSL VPN concurrent user from PA3260: 2048 ssl-tunnels)

When fw1,2 are in operation, can fw support about 2,000 user per one portal?

Or do they share the number of tunnels?

Re: Globalprotect in A-A

BPry — Tue, 01 Sep 2020 00:24:36 GMT

@gksnl11,

Depends on how you have things configured. If you have these configured with Floating IP Addresses then the tunnel information is shared between each unit, but they otherwise will be completely independent of each other.

Just keep in mind that you aren't really getting any additional capacity by going active/active, as if you have a hardware failure you all of the sudden don't have enough capacity for your entire environment if you can't work within the 2048 limit on the 3260s.