Gateway Priority in a Multiple Gateway Configuration
To enable secure access for your mobile workforce no
matter where they are located, you can strategically deploy additional
Palo Alto Networks next-generation firewalls and configure them
as GlobalProtect gateways. To determine the preferred gateway to
which your agents connect, add the gateways to a portal agent configuration
and assign each gateway a connection priority. See Define the GlobalProtect Agent Configurations.
If a GlobalProtect portal agent configuration contains more than
one gateway, the agent will attempt to communicate with all gateways
listed in its agent configuration. The agent will then use priority
and response time as to determine the gateway to which to connect.
With GlobalProtect agent 4.0.2 and earlier releases, the agent connects
to a lower priority gateway only if the response time for the higher
priority gateway is greater than the average response time across
For example, consider the following response times for gw1 and
The agent determines that the response time for the gateway with
the highest priority (higher number) is greater than the average
response time for both gateways (52.5 ms) and, as a result, connects
to gw2. In this example, the agent did not connect to gw1 even though
it had a higher priority because a response time of 80 ms was higher
than the average for both.
Now consider the following response times for gw1, gw2, and a
third gateway, gw3:
In this example, the average response time for all gateways is
35 ms. The agent would then evaluate which gateways responded faster
than the average response time and see that gw1 and gw2 both had
faster response times. The agent would then connect to whichever
gateway had the highest priority. In this example, the agent connects
to gw1 because gw1 has the highest priority of all the gateways
with response times below the average.
In addition to gateway priority, you add one or more source regions
to an external gateway configuration, GlobalProtect recognizes the
device region and only allows uses to connect to gateways that are
configured for that region. For gateway choices, source region is
considered first, then gateway priority.
In GlobalProtect agent 4.0.3 and later releases, the GlobalProtect
agent prioritizes the gateways assigned highest, high, and medium priority
ahead of gateways assigned a low or lowest priority regardless of
response time. The GlobalProtect agent then appends any gateways
assigned a low or lowest priority to the list of gateways. This
ensures that the agent first attempts to connect to the gateways
that you configure with a higher priority.