Testing the quality of the main link

[D.Drzyzga]

Hello,

The ISP had a failure on its side, which involved slow connection, which made it difficult for people inside the company and those working on VPN to work. We have a backup connection that switches in the event of a failure of the main connection. Is it possible to introduce a mechanism that tests the throughput of the main connection and, in the event of a drop in speed and quality, switches to the second one.

Additionally, can I configure one portal in Global Protec that will refer to two addresses? So that when it is not possible to connect to the first address, it will try to connect to the second one?

[BPry]

@D.Drzyzga,

Slow connections isn't something that the firewall can really monitor by itself. You would need an outside process such as a monitoring script(s) that can monitor both connections and that could then either alert you of a potential issue, or automatically failover traffic via the API if you wish to bring things that far. The firewall can monitor for an entire failure through path monitoring, but that external step is needed to true performance monitoring.

As for your GlobalProtect question, the firewall itself can't push out an agent configuration that has two addresses tied to a single portal address. You would generally utilize something like a load-balancer or dynamic DNS to perform something like that so you could quickly migrate traffic to that portal address to your other address.

Keep in mind that portal caching is a thing, so if you have multiple gateways configured (one on each connection) your portal doesn't really need to be active for existing endpoints. The GlobalProtect agent will use the cached portal configuration when the portal is not reachable, and if you have both of your gateways included it will connect to the gateway that is online. Keep in mind that in the scenario that you're describing where you don't have a full outage, you'll need to manually down the portal/gateway to get this to behave properly. A slow connection is one of those things that kind of requires manual interaction on your end more than an actual failure would, as you want to identify that and just bring that bad connection down.