One Global Protect Portal and Two Global Protect Gateways in One Firewall

Showing results for 
Show  only  | Search instead for 
Did you mean: 

One Global Protect Portal and Two Global Protect Gateways in One Firewall

L0 Member

Is this possible, One Global Protect Portal and Two Global Protect Gateways in One Firewall?

For the second gateway, I'm planning to use a loopback interface with private IP that have a NAT public IP.

The first gateway is the production VPN configured with on-demand, and MFA authentication

The second gateway will be used to test the always on.

Will this work? 




Cyber Elite
Cyber Elite

Hi @rcandeloza ,


Yes, it will work. Your scenario is a common way to test new configurations.  I assume you will use the portal agent Config Selection Criteria to send certain users to the test gateway.


Unless you have ports in your NAT configuration, the public IP will need to be different.  If the different public IP address is on the same subnet as your public interface, you can eliminate the NAT by putting the public IP /32 on the loopback.  A 2nd public IP may need a 2nd public DNS A record and 2nd certificate.


If you have 1 public IP address, you can use a different port for your gateway as shown in the URL below.   It may closely resemble what you want to do.  You cannot use a different port for the GP portal (but you can for the login web page).


On a side note, you do not need a separate gateway for both full- and split-tunnel as described in the URL.  They can be done on the same gateway.





Help the community: Like helpful comments and mark solutions.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!