To enable secure access for your mobile workforce no matter where they are located, you can strategically deploy additional Palo Alto Networks next-generation firewalls and configure them as GlobalProtect gateways. To determine the preferred gateway to which your apps connect, add the gateways to a portal agent configuration, and then assign each gateway a connection priority. See Define the GlobalProtect Agent Configurations.

If a GlobalProtect portal agent configuration contains more than one gateway, the app attempts to communicate with all gateways listed in its agent configuration. The app uses the priority and response time to determine the gateway to which to connect. With GlobalProtect app 4.0.2 and earlier releases, the app connects to a lower priority gateway only if the response time for the higher priority gateway is greater than the average response time across all gateways.

For example, consider the following response times for gw1 and gw2:

The app determines that the response time for the gateway with the highest priority (higher number) is greater than the average response time for both gateways (52.5 ms) and, as a result, connects to gw2. In this example, the app did not connect to gw1 even though it had a higher priority because a response time of 80 ms was higher than the average for both.

Now consider the following response times for gw1, gw2, and a third gateway, gw3:

In this example, the average response time for all gateways is 35 ms. The app would then evaluate which gateways responded faster than the average response time and see that gw1 and gw2 both had faster response times. The app would then connect to whichever gateway had the highest priority. In this example, the app connects to gw1 because gw1 has the highest priority of all the gateways with response times below the average.

In addition to gateway priority, you can add one or more source regions to an external gateway configuration. GlobalProtect recognizes the source region and only allows uses to connect to gateways that are configured for that region. Regarding gateway selection, source region is considered first, then the gateway priority.

In GlobalProtect app 4.0.3 and later releases, the GlobalProtect app prioritizes the gateways assigned highest, high, and medium priority ahead of gateways assigned a low or lowest priority regardless of response time. The GlobalProtect app then appends any gateways assigned a low or lowest priority to the list of gateways. This ensures that the app first attempts to connect to the gateways that you configure with a higher priority.

When multiple gateways are assigned equal priority, the GlobalProtect app determines the best gateway by measuring the SSL/TLS handshake response time. This behavior can be impacted by the TLS version in use. TLSv 1.3 has lower latency than TLSv 1.2 due to a more efficient handshake, which requires only one round trip compared to two. Gateways configured for TLSv 1.3 will inherently report faster handshake times than gateways using non-TLSv 1.3, even if the non-TLSv 1.3 gateway is geographically closer. This can cause the TLSv 1.3 gateway to be selected as the best available gateway, which may result in the GlobalProtect app connecting to a gateway that is not the geographically closest. If you want to connect to the geographically closest gateway regardless of TLS version, you can manually assign gateway priorities based on region.

Alternatively, if you are using GlobalProtect app version 6.3.1 or later, you can modify the best gateway selection criteria setting in the portal by changing the value from the default, Load & response time, to Response time.