Dual ISP Global Protect Redundancy

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Dual ISP Global Protect Redundancy

L3 Networker

Hi Team, 

 

I hope ye all are well. We recently worked a case for a customer that had dual ISP configuration and wanted the Palo Alto Networks device to provide redundancy for the Global Protect Portal and Gateways in the event one ISP went down. We came up with a handy way of providing this using NAT rules and a loopback and I am posting this to share with the community. 

 

There are some screenshots from the lab below. Eth1/1 & Eth1/2 represent ISP-A and ISP-B.

 

 

interfaces.PNG

 

We popped the Global Protect Portal and Gateway on a loopback interface.  

 

 

 

 

 

loopback.PNG

 

We created two NAT rules to bounce the incoming traffic whether its from ISP-A or ISP-B to the loopback address. 

 

 

 

 

natRules.PNG

 

The system has two Virtual Routers for both ISP's. VR-A and VR-B. VR-A has the loopback interface added. 

 

 

 

VirtualRouters.PNG

 

 

Virtual Router B has a static route to VR-A which has a route to the loopback interface with the Portal and Gateway. 

 

 

 

VR-b-static.PNG

 

This simple setup allows access to the portal and gateway from either ISP interfaces. We simulated one ISP failing and changed the A record of the portal fqdn to resolve to the other interface and the users could connect without any input or changes from the end user. There are a number of ways to automate dns integrity and failover to resolve to a different ip address if it can't resolve to another. Beyond the scope of Palo Alto. Infoblox and Route 53 can provide these features. If you just have MS server , changing the A record from one IP to another isn't a massive task.

 

Hope this helps few others and is nice way to provide extra layer of redundancy for networks to big to fail.

 

Best regards,

 

Robert D  

 

 

 

 

3 REPLIES 3

L1 Bithead

Great article @DonohoeRobert. Thank you for sharing this solution! Question: Even though the Portal and Gateway configurations point to the loopback interface and the loopback interface is assigned to the Global-Protect security zone, in Tunnel Settings in Agent in Gateway configuration, did you still have to configure a tunnel interface and choose it in here? Or did you leave 'Tunnel Mode' unchecked?Tunnel_Mode.JPG

Hi Mate,

 

No worries at all.. 

 

Ye need to create a tunnel interface here 100%. Gateway and portal on loopback interface is grand, but would enable tunnel mode as per normal as well. 

 

Let us know how it goes, article a little old but can mock up in the lab again if needed.

 

best regards

 

Rob 

L3 Networker

Hi DonohoeRobert,

Have you tried Redundancy for this case, you have configured only one default route(0.0.0.0/0) that belongs to Ethernet 1/1.
How will another interface(Ethernet1/2 ) route the traffic if Ethernet1/1 goes down?

 

regards,

Akash Thangavel

Network Security Engineer

 

 

Akash Thangavel, Network Security Engineer
  • 19434 Views
  • 3 replies
  • 4 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!