Palo RAVPN connection profiles?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Palo RAVPN connection profiles?

L0 Member

Hi,

I'm taking my first steps in palo and trying to understand RA VPN configuration.

I used to work with cisco devices where i have possibility to create different connection profiles for users and when they connect to vpn they can choose group where they want to connect. Example bellow:

obraz_2023-10-06_120323612.png

I thought i will be able to configure something like that by creating one GPPortal and two GPGateways but as far as i checked i have no possibility to create two gateways on same IP Address.

Is something like that avaiable to configure?

3 REPLIES 3

Cyber Elite
Cyber Elite

if you need 2 gateways, you can attach one gateway to a loopback interface, and use a PAT rule to translate (for example) port 5000 externally to port 443 on the loopback. you can then add both IP's to the portal external gateway list, adding :5000 to the one on the loopback

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L0 Member

@reaper 

Yeah but those gateways will have different IP addresses then? If not and just nat is there to do the job what is loopback for?

Cyber Elite
Cyber Elite

if you want them to have the same IP, you can run the first gateway on the external interface listening on port 443, then have a NAT rule that translates the external IP:5000 to loopbackIP:443

 

your portal config will look like this:

2023-10-11_15-42-23.png

the first gateway is the regular fqdn, connecting to port 443, the second one is running on port 5000

You only need 1 IP this way, but the drawback is that the second gateway can't support IPSec

 

the alternative is to get an additional public IP address

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 938 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!