Global Protect, same IP pool with 2 gateways on a firewall

[M.Pahlavanzadeh]

Hi all,

I have two external gateways on the same firewall, and I’m wondering whether I can reuse the same Client IP Pool for two different tunnel interfaces (on two different external gateways) on the same firewall.

I have already done that via SCM and committed the changes, but I'm not sure whether it'll work or not.

[BPry]

@M.Pahlavanzadeh,

I've never tried to do this previously, but how would you handle any sort of routing to the connected endpoints? Just from a support aspect, this seems like it would be a pretty bad idea since you wouldn't be able to connect to these endpoints at all even if the FIB actually allowed this to work in practice. It certainly isn't something that I would recommend you knowingly and actively do. 

[M.Pahlavanzadeh]

Thanks for the response. I wanted to use the second gateway for the failover only. However, yes, it doesn't make sense as the firewall itself is going to install both subnets in its RIB and FIB with the same metric, and it's definitely a messy routing approach. I'm using a different subnet for every single gateway.