One Global Protect Portal and Two Global Protect Gateways in One Firewall

[rcandeloza]

Is this possible, One Global Protect Portal and Two Global Protect Gateways in One Firewall?

For the second gateway, I'm planning to use a loopback interface with private IP that have a NAT public IP.

The first gateway is the production VPN configured with on-demand, and MFA authentication

The second gateway will be used to test the always on.

Will this work? 

[TomYoung]

Hi @rcandeloza ,

Yes, it will work. Your scenario is a common way to test new configurations.  I assume you will use the portal agent Config Selection Criteria to send certain users to the test gateway.

Unless you have ports in your NAT configuration, the public IP will need to be different.  If the different public IP address is on the same subnet as your public interface, you can eliminate the NAT by putting the public IP /32 on the loopback.  A 2nd public IP may need a 2nd public DNS A record and 2nd certificate.

If you have 1 public IP address, you can use a different port for your gateway as shown in the URL below.   It may closely resemble what you want to do.  You cannot use a different port for the GP portal (but you can for the login web page).

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUhCAK

On a side note, you do not need a separate gateway for both full- and split-tunnel as described in the URL.  They can be done on the same gateway.

Thanks,

Tom