I was looking at some of the comments/questions on the PaloAlto community board trying to figure this out. But I've confused myself. IPSEC is a layer 3 protocol and SSL operates at layers 5 and 6. As a “fall back” protocol for GP – is that in case if there are problems with establishing the tunnel through the end user’s ISP (as one comment indicated) or is it in case of authentication problems due to  latency and degradation of the tunnel as it passes from inside to outside. I can see the L3 IPSEC tunnel being best for outside endpoint connections. And as far as SSL, since it works more at an application layer, using it for navigating the internal network, such as file shares and applications that aren’t web-based. (Can there be a mid-transmission switch like that?)  So, in essence running both protocols being dependent on type of data access. But wouldn’t that kind of transition cause latency against wire speed transmissions?   I just don’t understand the “fall back” aspect. Are we expecting that in some circumstances IPSEC will fail? ... View more