VPN Global Protect Portal two VR and one VR environments

VPN Global Protect Portal two VR and one VR environments

Hello, good afternoon.

As always, thanks for the help, the support, your time and collaboration always.

I tell you I have the following case, which has me very restless, since I always try to understand what and why of what I implement and configure, I do not like to leave things that work by magic, since at the time of the tshoot It is important to know how they are armed.

Finally, let's get to the point:

I have already had to implement and/or support multiple platforms in Palo Alto, where in many cases it has been necessary to implement two ISPs and each one offers the obvious service of Internet access, but above all, access to each one of its Global Protect VPN Portal, which is the focus of this issue.

Well that is what I always do, I implement two Virtual Routers, one for each ISP, and one of them with their corresponding return routes to the other VR, from the networks that do not live in said VR, also for the issue of not dealing with implement ECMP for the issue of default routes. In other cases I also implement ECMP and at the request of the clients, I implement ECMP with a single virtual router and both links in the same virtual router.

Then normal and general environment Operating and running OK:

Scenario/environments/Infra 1:

-Two VRs, each VR with its ISP, a Global Protect VPN Portal for each ISP, each VR with its corresponding default route (0.0.0.0/0) to its respective ISP, since each VR has its own independent and particular routing table . Its corresponding NAT and policies, all OK. Operating and running.

Environments 2/Another environment:

-A single VR, with both ISPs connected to the same VR, ECMP enabled, each ISP connection with its corresponding VPN Portal. Their corresponding NAT and policies, all OK. Operating and running.

So far, all good, both scenarios all Ok, operating and working correctly.

Now I come across a firewall that has the following scenario:

- A single VR with both ISPs configured. No ECMP configuration enabled ( ECMP disabled ). Two ISPs with their corresponding Global Protect VPN Portal. Only one default route to the main Internet link and no other default route ( only one route 0.0.0.0/0 there is no other ). Here comes my big doubt and headache, I have tried to implement this scenario and without having the ECMP enabled, to use both links, it does not work. After enabling ECMP if possible due to the issue of routes and metrics. But in this firewall, which is the headache ( PA-3020 pan-os 9.1. ) without ECMP, without any other routing protocol operating, with only one default route ( 0.0.0.0/0 only one to the main link ) to the main link... Both Global protect VPN Portals respond, work and operate perfectly... It's not that I don't want it to respond and work, it's more than good, super good... But I need to know the... what and why... I've gone round and round the config and nothing. Arming the same LAB with the same similar scenario does not work except with ECMP or using two virtual routers.

Please, I would appreciate it if you could review and read the details of what was proposed and if you can help me and support me to clarify why the two portals are working, if logic and theory should indicate that they are not... but both portals work, with their respective Public IP and your portal-web-Gui access to download the vpn client and with the global protect client operating perfectly.Maybe there must be something I'm missing and/or not checking.

Thank you very much in advance for your great support, time and your kind collaboration.

I remain attentive, cordial greetings.