Global Protect multiple gateway setup

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Global Protect multiple gateway setup

L0 Member

I have an existing setup of Global protect Portal and gateway on first Firewall, I have created a New gateway on another Firewall and added that gateway to the portal of first firewall under Agent---> External gateway.

When I am connecting to Global protect from the app i am getting an IP address from the pool of first gateway which is the older one but not the new one which I have configured.

3 REPLIES 3

Cyber Elite
Cyber Elite

Check "Manual" checkbox on External Gateway tab.

This allows you manually choose which gateway you want to connect to.

Otherwise GlobalProtect app will look at priority and latency.

If gateway priority is same then app will connect to gateway with lowest latency.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

L6 Presenter

Note that the way the gateway selection algorithm works, the "Highest", "High", and "Medium" priorities are essentially the same. Assuming all gateways are reachable, it falls purely to the calculated latency as to which is selected by the client. If none of those are available then it selects from the "Low" and "Lowest" priorities based on latency. You can see the calculated latencies in the PanGPS.log file on the client under Troubleshooting.

Cyber Elite
Cyber Elite

Gateway priority/latency selection logic:

https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000ClVz

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 1104 Views
  • 3 replies
  • 0 Likes
  • 47 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!