GP gateways under the same ISP

[GeorgiosFakis]

Hello ,

I have setup for the company portal and gateway with a specific IP pool and there is one pulbic IP on the ISP. Now they want partners to connect as well and I was wondering if is possible to have either on the same gateway another VPN IP pool and setting like DNS or I can make another gateway under the same IP with another port.

[Chacko42]

@GeorgiosFakis: Both is possible, but I think the first one is more elegant.

So you create a second network config for the second vpn-users group and assign them a own network config (External GW > Agent > Client Settings).

Using different DNS servers per client settings is supported from PAN-OS 9.0 on. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/globalprotect-features/dns-configur...

[GeorgiosFakis]

But what if I have PAN-OS version 8.1 ? 

[Chacko42 · Accepted solution]

Then you can only create agent settings regarding ip-pools and routing.

If a different DNS server is mandatory for you, you need to create a second external gateway and assign it to the vpn-users group in portal. You can use a loopback IP for second external Gateway and create a NAT-Policy (if untrust > untrust custom-port.... than DNAT to Loopback-IP:443)

[GeorgiosFakis]

I was thinking about that different port that could work  , thanks .

[Chacko42]

Right, you can define a custom-port like 666 which you then DNAT to the correct external-gw2.

Two external gateways on the same public IP are not possible, because the Palo couldn't make the difference which gw to use. There you have to use a dummy-IP/Loopback or a second public-ip