topic Re: global protect vpn with DUAL ISP in General Topics

global protect vpn with DUAL ISP

Marsooq-Akkaradathil — Thu, 07 May 2020 17:50:06 GMT

Hi Team,

we have two isp link with ecmp load-balancing enabled. we only have one virtual router setup. we have configured GP vpn portal with one isp interface and how can i configure the GP vpn with second isp link as well. we would like to have two external Gateway.But global protect portal only showing to choose one outgoing interface.any help?

Re: global protect vpn with DUAL ISP

SutareMayur — Thu, 07 May 2020 18:11:23 GMT

@Marsooq-Akkaradathil,

If you're trying to configure multiple outgoing interface under single portal then it won't allow you. You can select single interface only. But you can add new Global Protect Portal which will be used for 2nd ISP interface.

One question here, do you need both VPN setups separate or you are looking for something like failover?

Mayur

Re: global protect vpn with DUAL ISP

Marsooq-Akkaradathil — Thu, 07 May 2020 18:21:43 GMT

@SutareMayur

can we supposed to have more than one GP portal on the same device? yes, we are looking for fail-over setup.

Re: global protect vpn with DUAL ISP

SutareMayur — Thu, 07 May 2020 19:05:48 GMT

@Marsooq-Akkaradathil,

Yes you can have multiple GP portals on same gateway. This shouldn't create any issue. I had done one of such POC in my environment and everything was fine. But i had kept both VPN setups separate. There was nothing like failover.

For failover part, you can refer below KB article.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClU8CAK

Mayur

Re: global protect vpn with DUAL ISP

andeporter — Fri, 08 May 2020 20:57:23 GMT

Marsooq,

I have the setup you are describing and Sutare is correct. You would have to have multiple Portals (for each ISP) for your GlobalProtect users.

HTH.

Thx,

Ap.

Re: global protect vpn with DUAL ISP

projxit — Sat, 19 Jun 2021 01:04:10 GMT

I know this is an old question, but the way I've done this in the past is:

Put the Portal and GW onto a loopback adapter
Setup 2 NAT rules, 1 for each ISP, to forward GlobalProtect ports (443, 4501 etc)
In the VR - ECMP setting, ensure you have Asynchronous return checked