Number of supported Global Protect clients per box ?

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Number of supported Global Protect clients per box ?

L3 Networker

In all the specifications sheets there is a different number listed for the concurrent SSLVPN and IPSECVPN supported clients.

eg. on a 5020

  • 2,000 IPSec VPN tunnels/tunnel interfaces
  • 5,000 SSL VPN Users

I find these number very confusing :

Globalprotect uses both IPSEC and SSL ( IPSEC is preferred I was told).

So my question, how many globalprotect clients are supported then on, for example , a 5020 ? 2000 or 5000 ?


L4 Transporter

As I understand it (and as I have seen it in my lab testing) the GlobalProtect client will opportunistically use EITHER IPsec or SSL, not both at the same time. I have my GlobalProtect "allow rules" in my policy set up in a way where I only allow SSL VPN (because that's specifically what I want to test), so when the client connects it uses SSL.

When I do commits on my lab PA2050 it yells at me that I don't have an application dependency configured for the 'panos-global-protect' app, because I don't have the IPsec related protocols added, but it works fine and my client always uses SSL.

I would think that maintaining IPsec VPN tunnels incurs a higher overhead on the PA boxes versus SSL VPN (maybe they have an embedded SSL crypto card on the box?), hence the difference you see in the numbers.

Personally I only want to use SSL VPN with GlobalPrtotect, and I want to have the ability for the client to refuse to connect if the certificate isn't signed by a legitimate certificate authority (to prevent SSL man-in-the-middle).

L3 Networker

And as side question to this, how would Apple IOS clients be counterd, I guess as IPSEC clients  ? So would this mean 2000max on 5020 ?

Yes, iOS clients are counted as IPsec clients, because they take advantage of the embedded Cisco IPsec client that is bundled in with iOS (we have VPN access for iOS clients deployed, so I have direct experience with this too).

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!