Error message "priority is -2 with region does not match" is seen in PanGPS.log.

7548

Created On 06/05/21 00:55 AM - Last Modified 06/07/24 21:38 PM

GlobalProtect Agent

GlobalProtect App

GlobalProtect Gateway

GlobalProtect Portal

VPNs

5.1

5.0

5.2

GlobalProtect

Symptom

GlobalProtect (GP) Gateway get disconnected.
Error message "One external gateway and it's priority is -2, region does not match" is seen in the PanGPS.log.

Environment

Palo Alto Firewalls
Supported PAN-OS
GlobalProtect (GP) Gateway

Cause

GlobalProtect considers the source region of the connecting device when selecting the best gateway.
This configuration is under the GUI: Network > GlobalProtect > Portals > (name) > Agent > (agent name) > External > External Gateways
When the IP address of the client does not match the region of the external gateways during network discovery , GP App gets disconnected.

Resolution

For resolving this issue you can follow one of this options:

Create one external gateway without the region setting.
Create the region object for users IP address.
Disable Region feature using the CLI command:

> configure
# set deviceconfig setting global-protect enable-external-gateway-priority no
# commit
# exit

Additional Information

Priority value within the weight equation depends on the client location (source IP) .
Client location is determined based on the IP address seen by the Portal
Both Portal and Gateway return the region to the client during prelogin stage based on the client’s IP address.
PanGPS.log: