Need a setting to change interfaceMetric 1 to a higher value

[basinilya2]

Hi Community.

Every time when GP connects it sets its interfcaceMetric to 1. However, I have a nested VPN with even higher priority so every time I have to manually change the PANGP interface metric to a higher value e.g. 400. My wired connection already has metric 8500.

Do you know if there's a setting for that?

[BPry · Accepted solution]

@basinilya2,

Assuming that you don't actually manage the GlobalProtect environment and you already have permission to do so locally on the endpoint, why wouldn't you just use a script to do this when you connect? Look into post-vpn-connect and run a post connection script locally if just running the script manually doesn't suite your needs, but this isn't something GlobalProtect just natively supports modifying. 

[phbrown]

@basinilya2,

Rather than trying to configure a lower metric metric, you can create more specific routes.  More specific routes takes precedence over metrics.  So if the GlobalProtect has the subnet of 10.0.0.0/8, creating the more specific static routes of 10.0.0.0/9 and 10.128.0.0/9 will give it precedence.

[basinilya2]

@phbrown I need a higher priority for the DNS server associated with the nested VPN. More specific routes don't fix this. Only the metric does. Windows has this poorly documented, but from my experience it can work simultaneously only with DNS servers of the two network interfaces with the highest priority and in case of disagreement the response from the first interface is used.

[basinilya2]

@BPry 

Thanks didn't know about post-vpn-connect. Indeed I wrote a script and added it to the Windows Task Scheduler, but post-vpn-connect seems like a better option.

#
# Set PANGP adapter metric to a higher value so nested VPNs can work
#

#
# Note that a race condition may occur if metric is set too early while GP is connecting
# C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log
# 
# Good:
#   des=0.0.0.0, mask=0.0.0.0, nextHop=10.41.224.68, ifidx=7, forwardType=3, forwardProto=3, age=0, nextHopAs=0, matrix=1,0,0,0,0
#   number of route is 3
#   Set route successfully. ForwardDest = 0.0.0.0, metric 1.
# 
# Bad:
#   des=0.0.0.0, mask=0.0.0.0, nextHop=10.41.224.68, ifidx=7, forwardType=3, forwardProto=3, age=0, nextHopAs=0, matrix=400,0,0,0,0
#   SetRoutes: CreateIpForwardEntry(0.0.0.0) failed (One or more arguments are not correct.)
#

$adapters = Get-NetAdapter | Where-Object { $_.ComponentID -eq "pangpd" }

foreach ($interface in $adapters) {
    # Set IPv4 and IPv6 metrics to 400
    Set-NetIPInterface -ErrorAction Continue -InterfaceIndex $interface.ifIndex -AddressFamily IPv4 -InterfaceMetric 400
    Set-NetIPInterface -ErrorAction Continue -InterfaceIndex $interface.ifIndex -AddressFamily IPv6 -InterfaceMetric 400
    
    Write-Output "Set IPv4 and IPv6 metrics to 400 for adapter: $($interface.Name) ($($interface.InterfaceDescription))"
}

P.S. why are they premoderating my replies?