Redundancy for Global protect VPN

[ChandrashekharD]

Dear Friends,

We have a customer who is Currently configured with GP- Global Protect for VPN is connecting with ISP-1, one Public IP / One ISP-Internet Service Provider.

Requirement is, can we configure as backup or as redundant with another ISP-2 ?

Purpose : Once One ISP is down, then GP- Global Protect users will not disconnect from remote VPN service. It will redirect with ISP-2 as like failover. 

Please confirm once, Is it possible? 

[Claw4609]

Hello,

Would this be for the GlobalProtect portal or the gateway? You could have you Globalprotect attached to a loopback interface and follow the steps from this post: LIVEcommunity - Nominated Discussion: Dual ISP Global Protect Redundancy - LIVEcommunity - 520124 (p...

If you're just worried about the Gateway and not the Portal you could have multiple Gateways created as well so in the event one goes down the clients will reconnect to the second gateway. If the portal is down in this scenario new users wouldn't be able to connect until thats back up but the active users shouldnt notice a difference.

I've seen posts previously saying people have done two separate portals and did a DNS round robin, however I personally haven't tested this. 

[ChandrashekharD]

Thanks for responding, this is for global protect gateway..

[TomYoung]

Hi @Claw4609 and @ChandrashekharD ,

I have tested option 1 in this doc, and it works!  https://www.wandynamics.com/blog/ensuring-high-availability-globalprotect-vpn-portals

If you configure 2 gateways and save user name, the client caches the gateways.  If the portal is down, the client automatically connects to the 2nd gateway.  Configure portal and gateway on ISP-1.  Configure 2nd gateway on ISP-2.  List both gateways under the portal.  You could give gateway 1 the highest priority.

The doc also has options 2 and 3, which are (2) manually change portal and (3) GSLB.

Thanks,

Tom