About stef

if both ISPs have a different zone assigned to their interface, you should not need to change the NAT rules' order if both need to have the same zone, make sure you set the destination interface properly in each NAT rule, that way NAT is applied not only by zone but also by interface the traffic is egressing out of i.e. rule1 from LAN to ISP1 dst-interface 1/1 | nat src-interface1/1DIPP rule2 from LAN to ISP2 dst-interface 1/2 | nat src-interface1/2DIPP ... View more

@stef, There's no built-in limitation on a single public IP address having multiple GlobalProtect sessions associated, that's actually really common to come across. The first thing that I would look at is if it's just this one router in question, or if you can actually duplicate this behavior. It's possible that the NAT type of the home router simply isn't allowing anyone else to form a tunnel to the same public IP address. The other thing to look at, however if enabled I would hope you would be getting alerts for it, is if you're possibly hitting a DoS limit you have configured. You could have a max-concurrent limit configured so your firewall isn't allowing any additional sessions from that public IP address or something similar.  ... View more

Hello,   updating panorama to 9.1.6 and Restart configd daemon fixed the issue . Thank you all ... View more