Gateway Priority in a Multiple Gateway Configuration
To enable secure access for your mobile workforce no matter where they are located, you can strategically deploy additional Palo Alto Networks next-generation firewalls and configure them as GlobalProtect gateways. To determine the preferred gateway to which your agents connect, add the gateways to a portal agent configuration and assign each gateway a connection priority. See Define the GlobalProtect Agent Configurations.
If a GlobalProtect portal agent configuration contains more than one gateway, the agent will attempt to communicate with all gateways listed in its agent configuration. The agent will then use priority and response time as to determine the gateway to which to connect. With GlobalProtect agent 4.0.2 and earlier releases, the agent connects to a lower priority gateway only if the response time for the higher priority gateway is greater than the average response time across all gateways.
For example, consider the following response times for gw1 and gw2:
The agent determines that the response time for the gateway with the highest priority (higher number) is greater than the average response time for both gateways (52.5 ms) and, as a result, connects to gw2. In this example, the agent did not connect to gw1 even though it had a higher priority because a response time of 80 ms was higher than the average for both.
Now consider the following response times for gw1, gw2, and a third gateway, gw3:
In this example, the average response time for all gateways is 35 ms. The agent would then evaluate which gateways responded faster than the average response time and see that gw1 and gw2 both had faster response times. The agent would then connect to whichever gateway had the highest priority. In this example, the agent connects to gw1 because gw1 has the highest priority of all the gateways with response times below the average.
In addition to gateway priority, you add one or more source regions to an external gateway configuration, GlobalProtect recognizes the device region and only allows uses to connect to gateways that are configured for that region. For gateway choices, source region is considered first, then gateway priority.
In GlobalProtect agent 4.0.3 and later releases, the GlobalProtect agent prioritizes the gateways assigned highest, high, and medium priority ahead of gateways assigned a low or lowest priority regardless of response time. The GlobalProtect agent then appends any gateways assigned a low or lowest priority to the list of gateways. This ensures that the agent first attempts to connect to the gateways that you configure with a higher priority.
GlobalProtect Portals Agent External Tab
GlobalProtect Portals Agent External Tab Select Network GlobalProtect Portals Agent External to configure the settings for external gateways for an agent configuration. GlobalProtect Portal External ...
External Gateway Priority by Source Region
External Gateway Priority by Source Region GlobalProtect can now use the geographic region of the GlobalProtect client to determine the best external gateway. By including ...
Gateway Selection Enhancement
Gateway Selection Enhancement Software support : GlobalProtect agent 4.0.3 and later releases with PAN-OS 6.1 and later releases OS support : All To improve the ...
GlobalProtect Multiple Gateway Configuration
GlobalProtect Multiple Gateway Configuration In GlobalProtect Multiple Gateway Topology , a second external gateway has been added to the configuration. Multiple gateways are supported in ...
Types of Gateways
Types of Gateways GlobalProtect gateways provide security enforcement for traffic from GlobalProtect agents/apps. Additionally, if the HIP feature is enabled, the gateway generates a HIP ...
GlobalProtect Gateway Concepts
GlobalProtect Gateway Concepts These sections provide information about gateway connection priority in a multiple gateway configuration and MIB support for GlobalProtect gateways. Types of Gateways ...
GlobalProtect Portal Satellite Configuration Tab
GlobalProtect Portal Satellite Configuration Tab A satellite is a Palo Alto Networks® firewall—typically at a branch office—that acts as a GlobalProtect agent to enable the ...
Define the GlobalProtect Agent Configurations
Define the GlobalProtect Agent Configurations After a GlobalProtect user connects to the portal and is authenticated by the GlobalProtect portal, the portal sends the agent ...
End User Experience
End User Experience End users who are remote (not inside the corporate network) connect to one of the gateways in AWS or Azure. When you ...