Gateway Priority in a Multiple Gateway Configuration
To enable secure access for your mobile workforce no
matter where they are located, you can strategically deploy additional
Palo Alto Networks next-generation firewalls and configure them
as GlobalProtect gateways. To determine the preferred gateway to
which your apps connect, add the gateways to a portal agent configuration,
and then assign each gateway a connection priority. See Define
the GlobalProtect Agent Configurations.
If a GlobalProtect portal agent configuration contains more than
one gateway, the app attempts to communicate with all gateways listed
in its agent configuration. The app uses the priority and response
time to determine the gateway to which to connect. With GlobalProtect
app 4.0.2 and earlier releases, the app connects to a lower priority
gateway only if the response time for the higher priority gateway
is greater than the average response time across all gateways.
For example, consider the following response times for gw1 and
The app determines that the response time for the gateway with
the highest priority (higher number) is greater than the average response
time for both gateways (52.5 ms) and, as a result, connects to gw2.
In this example, the app did not connect to gw1 even though it had
a higher priority because a response time of 80 ms was higher than
the average for both.
Now consider the following response times for gw1, gw2, and a
third gateway, gw3:
In this example, the average response time for all gateways is
35 ms. The app would then evaluate which gateways responded faster
than the average response time and see that gw1 and gw2 both had
faster response times. The app would then connect to whichever gateway
had the highest priority. In this example, the app connects to gw1
because gw1 has the highest priority of all the gateways with response
times below the average.
In addition to gateway priority, you can add one or more source
regions to an external gateway configuration. GlobalProtect recognizes
the source region and only allows uses to connect to gateways that
are configured for that region. Regarding gateway selection, source
region is considered first, then the gateway priority.
In GlobalProtect app 4.0.3 and later releases, the GlobalProtect
app prioritizes the gateways assigned highest, high, and medium priority
ahead of gateways assigned a low or lowest priority regardless of
response time. The GlobalProtect app then appends any gateways assigned
a low or lowest priority to the list of gateways. This ensures that
the app first attempts to connect to the gateways that you configure
with a higher priority.