In all the specifications sheets there is a different number listed for the concurrent SSLVPN and IPSECVPN supported clients.
eg. on a 5020
I find these number very confusing :
Globalprotect uses both IPSEC and SSL ( IPSEC is preferred I was told).
So my question, how many globalprotect clients are supported then on, for example , a 5020 ? 2000 or 5000 ?
As I understand it (and as I have seen it in my lab testing) the GlobalProtect client will opportunistically use EITHER IPsec or SSL, not both at the same time. I have my GlobalProtect "allow rules" in my policy set up in a way where I only allow SSL VPN (because that's specifically what I want to test), so when the client connects it uses SSL.
When I do commits on my lab PA2050 it yells at me that I don't have an application dependency configured for the 'panos-global-protect' app, because I don't have the IPsec related protocols added, but it works fine and my client always uses SSL.
I would think that maintaining IPsec VPN tunnels incurs a higher overhead on the PA boxes versus SSL VPN (maybe they have an embedded SSL crypto card on the box?), hence the difference you see in the numbers.
Personally I only want to use SSL VPN with GlobalPrtotect, and I want to have the ability for the client to refuse to connect if the certificate isn't signed by a legitimate certificate authority (to prevent SSL man-in-the-middle).
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!