GlobalProtect Design Question

[LeifAlire]

We have two on-premises GlobalProtect Portals on two different HA systems in different locations in the state, we would like a simple process to handle when/if a site goes down for the end-users.

Both portals are named different:

East-Portal

West-Portal

Is it possible to have an AWS Application Load Balancer send traffic to the portals? Has anyone done this and would we have to use a SAN cert on the portals, since the names are different?

[CosminM]

Hello @LeifAlire 

While AWS LB could help you to effectively manages GlobalPortal portal  selection, but if you already have a Panorama, the NGFW support for Prisma Access Agent provides a more integrated, feature-rich, and centrally managed solution that extends beyond basic connectivity to offer enhanced security, user experience, and operational efficiency across diverse deployment scenarios.

NGFW support for Prisma Access Agent offers several advantages over a traditional portal load balancer by providing a more unified, comprehensive, and streamlined security and management solution. While a a load balancer primarily focuses on directing clients to the optimal portal, Prisma Access Agent integrates a broader set of advanced capabilities and operational efficiencies.

Here are the key reasons why NGFW support for Prisma Access Agent is considered beneficial:

• Unified Agent for SASE and NGFW Use Cases The Prisma Access Agent is a next-generation unified agent designed for both Secure Access Service Edge (SASE) and Next-Generation Firewall (NGFW) deployments. It integrates security and networking capabilities into a single platform, offering a holistic approach to network security for cloud, on-premises, and hybrid environments. This unification helps eliminate security gaps .
• Streamlined IT Operations and Centralized Management Prisma Access Agent simplifies IT management and operations through a single cloud-based management web interface, Strata Cloud Manager. This platform serves as a central hub for managing Prisma Access Agent-specific settings, including user authentication, agent configurations, and infrastructure details for NGFW deployments, leading to faster mean time to resolution for issues.
• Enhanced User Experience and Always-On Connectivity The agent improves the end-user experience by ensuring always-on connectivity and enabling seamless, controlled upgrades. It provides continuous secure access for users regardless of their location.
• Robust Traffic Steering and Policy Enforcement The agent intelligently steers all traffic to the best available enforcement node for inspection and control, offering multiple traffic steering options. It enforces traffic policies to prevent security bypasses, blocking, sinkholing, and forwarding traffic to Prisma SASE or NGFW for real-time security inspection and enforcement. The gateway selection algorithm for Prisma Access Agent considers factors like source region and priority.
• Seamless Coexistence and Gradual Migration NGFW support for Prisma Access Agent allows it to coexist with GlobalProtect in the same deployment, providing a gradual migration strategy. This means organizations can maintain their existing NGFW setup while introducing advanced Prisma Access Agent capabilities. The Prisma Access Agent license also replaces the GlobalProtect Gateway License. Furthermore, Prisma Access Agent can leverage existing GlobalProtect portal LDAP authentication infrastructure, simplifying the transition.
• Advanced Features Beyond Basic Connectivity Prisma Access Agent offers a range of advanced features, including:
• Pre-logon support: Establishes a secure connection before user authentication, enabling management and updates of remote devices
• Endpoint insights: Collects comprehensive data for troubleshooting endpoint access issues
• IPv6 Sinkholing: Enhances security for dual-stack endpoints by sinkholing IPv6 traffic
• Captive Portal Support: Automatically detects and handles captive portal authentication within its embedded browser
• Embedded Browser Support for SAML Authentication: Provides a consistent in-app experience for logins, simplifying administration and enhancing security
• Transparent Proxy Support: Offers always-on internet security and private app access, even coexisting with third-party VPN agents

NGFW Support for Prisma Access Agent

[JustinWoodman]

My company doesn't use AWS, but azure.  Azure doesn't allow you to use external ips that aren't associated with your tenant.  I would check and see if AWS cares where its pointed to our not first.  The certificate type doesn't seem to matter, as we use a wildcard cert.  We have dedicate url for the web gp portals(the main urls), and then use a different hostnames for the actual gateways(where the clients actually connect too).  Then on both devices you setup all the different urls and weights on the gp portals->gp portal configuration->agent(you have to set each you have defines)->external->external gateways.  On both devices list out all the direct gp portal ip based urls(not the load balancer), that are vpn connectable.  Your main web gp url will be different ip since its going to be pointed to a load balancer. Your web port is where your gp clients get the list of portal urls to connect to and configuration. Basically all you care about ha'ing is the web gp portal part, not the ipsec/ssl vpn ports.

On azure if you are multiple regional its complicated because you have two regional app gateways, and they have there own urls and public ips, and then you have a global app gateway, that load balances between the two regions, and it has its own ips and urls. You can't skip the regional step. If its a single region then you just need the one regional app gateway url. 

Its neat to watch stuff failover.  I don't believe you actually need to do this.  If you clients have already download there configuration, then it knows about all the external gateways urls, and can handle that part on its own. I believe this is really needed for initial connection and configuration.

Disclaimer, I don't use clientless vpn or satellite, and I'm not sure how that would play in.  Would you use the load balancer or not. 

[PavelK]

Hello @LeifAlire @JustinWoodman 

sorry to step into this discussion.

Similar discussion came up in this post: Advice on dual isp, getting dns to work. In Azure, Traffic Manager can be used for health check + failover of VPN portals. Although, I do not have real world experience with the same deployment in AWS, Route 53 can serve the same purpose.

Kind Regards

Pavel