Global Protect license usage and behavior on running out

[MichaelMedwid]

How can you view the peak number of global protect licenses are being consumed

on a PAN? And when those licenses are consumed, what is the behavior of the GP

clients that connect beyond the limit? For example the 3220 allows for 1024 GP

connections simultaneously from what I understand. What happens to the 1025th

GP client that attempts to connect? TY

[TomYoung · Accepted solution]

Hi @MichaelMedwid ,

I don't think the firewall records the peak users, but you can check current or previous -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClorCAC.  Previous should show the "peak" from a unique username count.  I would hope that an NMS could graph GP users via SNMP.

The maximum GP users is a hardware limit.  If it is exceeded the gateway will refuse the connection.  See the picture in this thread -> https://live.paloaltonetworks.com/t5/general-topics/global-protect-firewall-behavior-after-reaching-....

Thanks,

Tom

[AnalysisMan · Accepted solution]

Hi @MichaelMedwid 

I presumed that the 1025th session would be dropped due to the hardware limitation.
Here are the SNMP OIDs that you can draw SNMP graphs for the GlobalProtect sessions, and you may set up a threshold alert when it reaches a specific value like 800 sessions.

GlobalProtect gateway % utilization	panGPGWUtilizationPct.0	1.3.6.1.4.1.25461.2.1.2.5.1.1	PAN-COMMON-MIB
GlobalProtect gateway max tunnels	panGPGWUtilizationMaxTunnels.0	1.3.6.1.4.1.25461.2.1.2.5.1.2	PAN-COMMON-MIB
GlobalProtect gateway active tunnels	panGPGWUtilizationActiveTunnels.0	1.3.6.1.4.1.25461.2.1.2.5.1.3	PAN-COMMON-MIB

You can simply test with a snmpwalk query for the active GP connections.
snmpwalk -v3 -l authPriv -u SNMPUser -a SHA -A "Auth_Password" -x AES -X "Priv_Password" 192.168.1.1 .1.3.6.1.4.1.25461.2.1.2.5.1.3

FYI, for the SNMP setup
Device -> Setup -> Operations -> Miscellaneous -> SNMP Setup

Thanks,