Global Protect with multiple portals and gateways.

[inderjit21]

I have a working portal and gateway on PA3020 running 8.0.12.

I want to setup another portal and geteway and repliciate all the settings.

Second GP will be used for testing purposes.

Only changes would be to use another public ip ,create another tunnel and loopback interface and ip pool.

Just want to make sure I dont break prod global protect while creating test GP.

[BPry · Accepted solution]

@inderjit21,

If you do it like this you won't have any issues with your prod environment. 

[Aymeric_Bride]

Hello,

I'd like to do the same thing—create a new portal and a new gateway with a different IP address but on same virtual router. However, I'd like to know whether users who are currently connecting to the first gateway will see a drop-down list in the GlobalProtect agent, allowing them to choose which gateway to connect to.

My goal is for this second portal and gateway to be used only for testing and to be available exclusively to a specific group of users.

[Adrian_Jensen]

Portals must be added by the end user to show up in the drop-down menu (unless you push these out via an install script/etc. separately). Gateways visible/selectable to the end user are configured by the Portal the user attaches to:

  Network -> GlobalProtect -> Portals -> Agent -> <agent-config> -> External

Only Gateways which have been setup in the Portal config will be available to the end user. If the "Manual" checkbox is selected the end user can manually switch to that Gateway, otherwise the Gateway is auto-selected. You can have multiple Gateways per Portal config and those Gateways can be on the same or a completely different PaloAlto. In my setup I have 4 different firewalls, 4 Portals, 4 Gateways; one Portal/Gateway is setup for test, the other 3 Portals allow round-robin to any available Gateway:

Portal A

  -> agent config

    Gateway A - high priority

    Gateway B - high priority

    Gateway C - low priority, no manual select

Portal B

  -> agent config

    Gateway A - high priority

    Gateway B - high priority

    Gateway C - low priority, no manual select

Portal C

  -> agent config

    Gateway A - high priority

    Gateway B - high priority

    Gateway C - low priority, no manual select

Portal D

  -> agent config

    Gateway D