GlobalProtect Gateway Selection (Multi-Gateway Configuration) [2024] 

I will try to do it soon

Thank you! If you're configuring Prisma Access using Panorama, you are able to change the portal configuration in the template Mobile_User_Template (under Network). There you can configure the Gateway priorities. Or did you mean using Strata Cloud Manager?

You're right, I meant location, not gateway. Funny, I have a client that has prisma access enterprise, and I was sure you could configure the location priorities on Panorama, under network -> portal. But again, I don't have much experience with prisma access. :-)

Hi. I will keep that in mind, thanks!

I also would like this. how to choose a gateway on the 2nd ISP

You could allow the users to choose the gateways, would it be a solution for your environment? Or you set the priority of the second gateway to lowest, so that clients only connect to it if the first gateway or ISP is down.

Hi. Thank you, I'm glad you like the videos. Regarding your question, external gateways provide remote access to your network. The internal gateways are usually implemented to gather User-IP mappings from people already inside your network.

Hi.. I am also very keen to know more about Internal gateway, its use cases, what other components required to work with the Internal gateway and how to implement. Thanks a lot

Hi, thank you for the suggestion. Since there is interest from you guys, we will be making a video soon about internal gateway.

I'm not sure I understand your question. It doesn't matter if the routes to the gateways are configured on the same VR or not, the important thing is that the clients are able to reach the gateways.

@netsums thanks! Anyway are we able to do Dual ISP/gateway using one portal? So they can do a auto failover

If a client cannot connect to the first gateway, it tries the second one. So with dual ISP, it would be no problem. The only problem there is the GlobalProtect Portal. Usually a client saves the last configuration it downloaded from the portal. But if a client is connecting for the first time, and the portal is not available, the client won't be able to connect. For a portal redundancy you would probably need to setup DNS with some sort of monitoring, if you want an automatic solution.

@@netsums I configured path monitoring in the VR for both ISP.

Hi. Thank you, that's a good suggestion, I will have to implement it for a customer soon. I will put it in my video list. :-)

Hi, sorry for the late reply. You are right, you need both portals and gateways to be reachable. In theory, if the portal is not reachable, the GlobalProtect app would use a cached portal configuration, if available, and try to connect to a gateway (I haven't tried it in practice yet). One possibility would be to have a High Availability firewall pair. Another one would be to use DNS to balance the load for you with firewalls in different sites.

Hi, if I understood you correctly, you would like to access the gateway directly. I think it's only possible if the portal is not accessible. In this case, the GlobalProtect app should use cached portal configuration and try to connect to the gateway directly.

Hi. I'll take a look at it, I need to see how I can do it in my lab. Did you mean with static routes?

That would be awesome! thank you. Yes two ISP's, static routes, maybe use case of ECMP? @@netsums