GlobalProtect Multiple Gateway Configuration
In GlobalProtect Multiple Gateway Topology, a second external gateway has been added to the configuration. Multiple gateways are supported in all of the preceding example configurations. Additional steps include configuring a second firewall as a GlobalProtect gateway. In addition, when configuring the client configurations to be deployed by the portal you can decide whether to allow access to all gateways, or specify different gateways for different configurations.
If a client configuration contains more than one gateway, the agent will attempt to connect to all gateways listed in its client configuration. The agent will then use priority and response time as to determine the gateway to which to connect. The agent connects to a lower priority gateway only if the response time for the higher priority gateway is greater than the average response time across all gateways. For more information, see Gateway Priority in a Multiple Gateway Configuration.
- In this configuration, you must set up interfaces on each firewall hosting a gateway.Use thedefaultvirtual router for all interface configurations to avoid having to create inter-zone routing.On the firewall hosting the portal/gateway (gw1):
On the firewall hosting the second gateway (gw2):
- Selectand configure ethernet1/2 as a Layer 3 Ethernet interface with IP addressNetworkInterfacesEthernet198.51.100.42and assign it to the l3-untrust security zone and the default virtual router.
- Create a DNS “A” record that maps IP address198.51.100.42to gp1.acme.com.
- Selectand add the tunnel.2 interface and add it to a new zone calledNetworkInterfacesTunnelcorp-vpn. Assign it to the default virtual router.
- Enable User Identification on the corp-vpn zone.
- Selectand configure ethernet1/5 as a Layer 3 Ethernet interface with IP addressNetworkInterfacesEthernet192.0.2.4and assign it to the l3-untrust security zone and the default virtual router.
- Create a DNS “A” record that maps IP address192.0.2.4to gp2.acme.com.
- Selectand add the tunnel.1 interface and add it to a new zone calledNetworkInterfacesTunnelcorp-vpn. Assign it to the default virtual router.
- Enable User Identification on the corp-vpn zone.
- Purchase and install a GlobalProtect gateway subscription on each gateway if you have users who will be using the GlobalProtect app on their mobile devices or if you plan to use HIP-enabled security policy.After you purchase the GlobalProtect license and receive your activation code, install the license on the firewall hosting the portal as follows:
- SelectActivate feature using authorization code.
- When prompted, enter theAuthorization Codeand then clickOK.
- Verify that the license was successfully activated.
- On each firewall hosting a GlobalProtect gateway, create security policy.This configuration requires policy rules to enable traffic flow between the corp-vpn zone and the l3-trust zone to enable access to your internal resources ().PoliciesSecurity
- Obtain server certificates for the interfaces hosting your GlobalProtect portal and each of your GlobalProtect gateways using the following recommendations:On each firewall hosting a portal/gateway or gateway, selectto manage certificates as follows:DeviceCertificate ManagementCertificates
- Obtain a server certificate for the portal/gw1. Because the portal and the gateway are on the same interface you must use the same server certificate. The CN of the certificate must match the FQDN, gp1.acme.com. To enable clients to connect to the portal without receiving certificate errors, use a server certificate from a public CA.
- Obtain a server certificate for the interface hosting gw2. Because this interface hosts a gateway only you can use a self-signed certificate. The CN of the certificate must match the FQDN, gp2.acme.com.
- Define how you will authenticate users to the portal and the gateways.You can use any combination of certificate profiles and/or authentication profiles as necessary to ensure the security for your portal and gateways. Portals and individual gateways can also use different authentication schemes. See the following sections for step-by-step instructions:You will then need to reference the certificate profile and/or authentication profiles you defined in the portal and gateway configurations you define.
- Configure the gateways.On the firewall hosting gp1, selectand configure the gateway settings as follows:NetworkGlobalProtectGatewaysInterface—ethernet1/2IP Address—198.51.100.42Server Certificate—GP1-server-cert.pem issued by GoDaddyTunnel Interface—tunnel.2IP Pool—10.31.32.3 - 10.31.32.118On the firewall hosting gp2, selectand configure the gateway settings as follows:NetworkGlobalProtectGatewaysInterface—ethernet1/2IP Address—192.0.2.4Server Certificate—self-signed certificate, GP2-server-cert.pemTunnel Interface—tunnel.1IP Pool—10.31.33.3 - 10.31.33.118
- Selectand add the following configuration:NetworkGlobalProtectPortals
- Interface—ethernet1/2IP Address—198.51.100.42Server Certificate—GP1-server-cert.pem issued by GoDaddy
- The number of client configurations you create depends on your specific access requirements, including whether you require user/group-based policy and/or HIP-enabled policy enforcement.
- Save the GlobalProtect configuration.ClickCommiton the firewall hosting the portal and the gateway(s).
Mixed Internal and External Gateway Configuration
Mixed Internal and External Gateway Configuration In a GlobalProtect mixed internal and external gateway configuration, you configure separate gateways for VPN access and for access ...
Remote Access VPN (Authentication Profile)
Remote Access VPN (Authentication Profile) In the Figure: GlobalProtect VPN for Remote Access , the GlobalProtect portal and gateway are configured on ethernet1/2, so this ...
Remote Access VPN (Certificate Profile)
Remote Access VPN (Certificate Profile) With certificate authentication, the client must present a valid client certificate that identifies the user to the GlobalProtect portal or ...
Remote Access VPN with Two-Factor Authentication
Remote Access VPN with Two-Factor Authentication If you configure a GlobalProtect portal or gateway with an authentication profile and a certificate profile (which together can ...
GlobalProtect for Internal HIP Checking and User-Based Acce...
GlobalProtect for Internal HIP Checking and User-Based Access When used in conjunction with User-ID and/or HIP checks, an internal gateway can be used to provide ...
Pre-logon then On-Demand Connect Method
Pre-logon then On-Demand Connect Method This feature requires Content Release version 590-3397 or later. You can now configure a new hybrid connect method called pre-logon ...
Remote Access VPN with Pre-Logon
Remote Access VPN with Pre-Logon Pre-logon is a connect method that establishes a VPN tunnel before a user logs in. The purpose of pre-logon is ...
Basic LSVPN Configuration with Static Routing
Basic LSVPN Configuration with Static Routing This quick config shows the fastest way to get up and running with LSVPN. In this example, a single ...
Prerequisite Tasks for Configuring the GlobalProtect Portal
Prerequisite Tasks for Configuring the GlobalProtect Portal Before you can configure the GlobalProtect Portal , you must complete the following tasks: Create the interfaces (and ...