Global Protect Pre-logon load balancing across 2 separate PA5020s

[Gurminder_Birdee]

HI, We currently have DNS round robin configured for our on-demand GP connections across 2 separate locations which host different PA5020 firewalls. We have a public A record pointing to both public firewall IPs and the clients then connect to either gateway location dependent on which IP they resolve at that time. this works fine for the on-demand connection method however I'm having issues using this approach for the pre-logon connection method. once the client has authenticated to one location it then appears to cache the gateway so every subsequent logon attempt forces the connection back to the gateway it has cached. i assume this is when it adds the portal value in the registry so on the windows logon it just uses the same portal address. 

is there a way to dynamically load balance this GP pre-logon connection. 

[BPry]

@Gurminder_Birdee,

Pre-logon, at least in my experience, has been pretty "sticky" when it comes to which portal it connects to due to that registry value. However this generally wouldn't be a big issue, because you would do the gateway selection at the portal level instead of doing the DNS round robin that you have configured at the moment. 

[Gurminder_Birdee]

Hi @BPry  thanks for your response, the issue with carrying out gateway selection at the portal level is say for example that "Portal A" is unreachable due to internet issues, how can you re-direct users to connect to Gateway B ? we've overcome this issue by using DNS round robin for the on demand connection method as previously mentioned. 

[FlorinBarhala]

Hello,

We are using an A-P pair of FWs and keep portal on them.

If one FWs fail then there's the other and if both FWs fail then there's the cached portal credentials.

Behind the portal sit several gateways.

Hope it helps!