For details on cookie usage on our site, read our Privacy Policy
Multiple Global Protect gateways on same firewall
- LIVEcommunity
- Discussions
- General Topics
- Multiple Global Protect gateways on same firewall
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-22-2015 01:52 PM
I have a PA-3020 that will have two ISP connections. Primary ISP interface will be used for the Global Protect Portal and Primary Gateway using tunnel.1. Is it possible to have a second gateway using tunnel.2 on the same firewall using the secondary ISP interface?
Also, if the Portal is only on the primary ISP interface and that connection is down making the Portal unreachable, will the GP Client still connect to the secondary Gateway?
- Labels:
-
GlobalProtect
Accepted Solutions
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-22-2015 02:05 PM
Yes you can have multiple gateways.
Just run it on interface of diferent isp connection.
Clients should cache gateway information they get from portal so even if portal is down they try to connect to gateways they have in their cache.
ACE, PCNSE, PCNSI
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-22-2015 02:05 PM
Yes you can have multiple gateways.
Just run it on interface of diferent isp connection.
Clients should cache gateway information they get from portal so even if portal is down they try to connect to gateways they have in their cache.
ACE, PCNSE, PCNSI
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-22-2015 02:06 PM
I know I have used the following to help me out in the past. It should be possible, but its gonna task some whiteboarding to making it work properly.
Hope this helps...
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-22-2015 04:26 PM
I was going to use PBF rules to manage the traffic. Would it be better to have two VRs to handle each ISP routing table?
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-23-2015 06:42 AM
You can use just one, especially if you are using dynamic routing such as OSPF (I have had issues with this in the past without using physical interfaces. There are documents out there that show how to do this with one VR.
- VM - Series firewall Untrust nic subnet full ip used need to attache new subnet in Best Practice Assessment Discussions
- High Bandwidth Utilization & Data Plane Restart in Next-Generation Firewall Discussions
- Deleting multiple rules associated to a single ip from panorama in Panorama Discussions
- ECMP in General Topics
- AiOPS Alert Management - disable alerts for specific profiles/configuration in AIOps for NGFW Discussions
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
