maximum number of GlobalProtect VPN tunnels for PA-5450

[RomainCouvreur]

Hello PA community ,

Our customer is looking for the maximum limit for GlobalProtect Gateways on PA-5450.

The most recent KB we found was this which covers 5250, but we would very much like to verify if it is still the same or more for 5450:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClidCAC

we checked also compare link and PA-5400 Series Firewall Overview but no clue.

https://www.paloaltonetworks.com/products/product-selection#

Thanks in advance for your help on this.

Best regards.

[kiwi · Accepted solution]

Hi @RomainCouvreur ,

You can check the device limits via cli using the command :

> show system state filter cfg.general.max*

Check out this KB: What is the Command to Display System Limits? 

Check for the value next to 'cfg.general.max-ssl-portal'

Kind regards,

-Kiwi.

[TomYoung]

Hi @RomainCouvreur ,

The PA-5450 can have 60K GlobalProtect clients.  Many of the max #s can be found on the Product Selection page -> https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-5450,pa-5410.

Thanks,

Tom

[RomainCouvreur]

Hello Team ,

Thank you for your feedback.

However , I m not asking about how many GlobalProtect clients can be connected at one time.

What I need to know is how many GlobalProtect portals and/or Gateways can be configured on the device before we will reach a limit?

The reason being is customer is a MSP and might be deploying one portal and gateway per customer.

Thanks in advance for your assistance.

Best regards.

[TomYoung]

Hi @RomainCouvreur ,

Yeah, I was curious if you were asking about tunnels (mentioned in topic) or gateways (mentioned in post).  Looking at the URL you posted, I should have known you were talking about gateways.  My bad!

What you're really saying is that PANW needs to update the KB!

I did use @kiwi 's command on a PA-220 we have.

> show system state filter cfg.general.max* | match portal
cfg.general.max-ssl-portal: 6

The number of portals matches the number of gateways listed in the KB URL.  I wonder if the max GP portals and gateways is the same?  You could check the results on other NGFWs if you have it.  If they match, go with @kiwi 's answer and mark it as the solution.

Thanks,

Tom

[RomainCouvreur]

Hello Tom ,

We checked the output on others NGFWs and it matches the number of gateways listed in the KB URL.

Thanks again for your help and for sure I will mark kiwi 's answer as the solution.

Have a nice day ahead.

Best regards.