global protect vpn with DUAL ISP

[Marsooq-Akkaradathil]

Hi Team,

we have two isp link with ecmp load-balancing enabled. we only have one virtual router setup. we have configured GP vpn portal with one isp interface and how can i configure the GP vpn with second isp link as well. we would like to have two external Gateway.But global protect portal only showing to choose one outgoing interface.any help?

[SutareMayur]

@Marsooq-Akkaradathil,

If you're trying to configure multiple outgoing interface under single portal then it won't allow you. You can select single interface only. But you can add new Global Protect Portal which will be used for 2nd ISP interface.

One question here, do you need both VPN setups separate or you are looking for something like failover?

Mayur

[Marsooq-Akkaradathil]

@SutareMayur 

can we supposed to have more than one GP portal on the same device? yes, we are looking for fail-over setup.

[SutareMayur]

@Marsooq-Akkaradathil,

Yes you can have multiple GP portals on same gateway. This shouldn't create any issue. I had done one of such POC in my environment and everything was fine. But i had kept both VPN setups separate. There was nothing like failover.

For failover part, you can refer below KB article.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClU8CAK

Mayur

[andeporter]

Marsooq,

I have the setup you are describing and Sutare is correct. You would have to have multiple Portals (for each ISP) for your GlobalProtect users. 

HTH. 

Thx,

Ap.

[projxit]

I know this is an old question, but the way I've done this in the past is:

1. Put the Portal and GW onto a loopback adapter
2. Setup 2 NAT rules, 1 for each ISP, to forward GlobalProtect ports (443, 4501 etc)
3. In the VR - ECMP setting, ensure you have Asynchronous return checked