Number of supported Global Protect clients per box ?

[Bart_Jocque]

In all the specifications sheets there is a different number listed for the concurrent SSLVPN and IPSECVPN supported clients.

eg. on a 5020

• 2,000 IPSec VPN tunnels/tunnel interfaces
• 5,000 SSL VPN Users

I find these number very confusing :

Globalprotect uses both IPSEC and SSL ( IPSEC is preferred I was told).

So my question, how many globalprotect clients are supported then on, for example , a 5020 ? 2000 or 5000 ?

[ericgearhart]

As I understand it (and as I have seen it in my lab testing) the GlobalProtect client will opportunistically use EITHER IPsec or SSL, not both at the same time. I have my GlobalProtect "allow rules" in my policy set up in a way where I only allow SSL VPN (because that's specifically what I want to test), so when the client connects it uses SSL.

When I do commits on my lab PA2050 it yells at me that I don't have an application dependency configured for the 'panos-global-protect' app, because I don't have the IPsec related protocols added, but it works fine and my client always uses SSL.

I would think that maintaining IPsec VPN tunnels incurs a higher overhead on the PA boxes versus SSL VPN (maybe they have an embedded SSL crypto card on the box?), hence the difference you see in the numbers.

Personally I only want to use SSL VPN with GlobalPrtotect, and I want to have the ability for the client to refuse to connect if the certificate isn't signed by a legitimate certificate authority (to prevent SSL man-in-the-middle).

[Bart_Jocque]

And as side question to this, how would Apple IOS clients be counterd, I guess as IPSEC clients  ? So would this mean 2000max on 5020 ?

[ericgearhart]

Yes, iOS clients are counted as IPsec clients, because they take advantage of the embedded Cisco IPsec client that is bundled in with iOS (we have VPN access for iOS clients deployed, so I have direct experience with this too).