Change ISP

[Si_Infrastructure]

we're upgrading the internet link in one of our offices...so qwe purchased a new link from a different provider...and I was thinking of unplugging the old link, plugin the new link, remove the old public IP address and then add the IP address of the new link, change the default route...the firewall is PA-200 version 7.1.14...has anyone done this before? is this a good practise? 

[reaper]

If you have a maintenance window where you can perform a cutover, this would be a good way to go about your migration (don't forget NAT and security policies)

This will be the quickest way, but will require some downtime (and you'll need to make sure you have OOB acccess or can be on-site to perform this)

alternatively you can plug the new ISP in a free interface and set it up from scratch (new zone, add the sone to existing security policies, create new NAT rules, add default route with slightly higher metric and commit)

after the commit you can first run a few tests and will retain access to the office through the original ISP, until you shut off the original interface and the NEW ISP will take over

[RobinClayton]

A great deal depends on what your doing,

Do you have inbound rules for NAT to inside hosts?

Do any of the third parties you connect to have IP address restrictions?

A "Cutover" period migration from one to the other would be ideal rather than a Straight complete swap over.

Both can run at the same time, and you can use PBF to move traffic out the second link.

Rob

[LukeBullimore]

Make sure to check your default outgoing NAT rule as well. If it is set to source translate to the interface address then you will be fine, otherwise the configuration will need to be amended to your new public IP range.

[Si_Infrastructure]

I am not in the office...we can afford some downtime...i just need to do this quickly...

We have a VPN tunnle with another office so i need to change that as well...

if I use PFB, Can i remove it later without any downtime?

also, when I access the firewall public IP...i am redirected to Global Protect Page, not the firewall GUI page...any idea how to access it?

I think I need to change the below:

- Interface IP

-Global Protect portal

- Global protect gateway

- IKE Gateway

- One NAT policy

- Default route..

Can you think of something else? 

Will the VPN work after changing the IP address and resetting it?

[Si_Infrastructure · Accepted solution]

ISP was changed successfully...for all of the network engineers out there...

- Change the interface IP

- Chane the default route

- Change GlobalProtect settings

- Issue a new cert. for GlobalProtect

- Change the polices

-No need to reset the VPN