Gateway Priority in a Multiple Gateway Configuration

To enable secure access for your mobile workforce no matter where they are located, you can strategically deploy additional Palo Alto Networks next-generation firewalls and configure them as GlobalProtect gateways. To determine the preferred gateway to which your agents connect, add the gateways to a portal agent configuration and assign each gateway a connection priority. See Define the GlobalProtect Agent Configurations.
If a GlobalProtect portal agent configuration contains more than one gateway, the agent will attempt to connect to all gateways listed in its agent configuration. The agent will then use priority and response time as to determine the gateway to which to connect. The agent connects to a lower priority gateway only if the response time for the higher priority gateway is greater than the average response time across all gateways.
For example, consider the following response times for gw1 and gw2:
Name
Priority
Response Time
gw1
Highest
80 ms
gw2
High
25 ms
The agent determines that the response time for the gateway with the highest priority (higher number) is greater than the average response time for both gateways (52.5 ms) and, as a result, connects to gw2. In this example, the agent did not connect to gw1 even though it had a higher priority because a response time of 80 ms was higher than the average for both.
Now consider the following response times for gw1, gw2, and a third gateway, gw3:
Name
Priority
Response Time
gw1
Highest
30 ms
gw2
High
25 ms
gw3
Medium
50 ms
In this example, the average response time for all gateways is 35 ms. The agent would then evaluate which gateways responded faster than the average response time and see that gw1 and gw2 both had faster response times. The agent would then connect to whichever gateway had the highest priority. In this example, the agent connects to gw1 because gw1 has the highest priority of all the gateways with response times below the average.

Related Documentation