GlobalProtect Satellite Not Receiving Newly Added Access Route from the Gateway

GlobalProtect Satellite Not Receiving Newly Added Access Route from the Gateway

Created On 09/25/18 18:47 PM - Last Modified 06/02/20 17:56 PM



In this scenario a GlobalProtect satellite is successfully connected to a GlobalProtect Gateway as shown below:



As shown above in the 'Route Sharing' column, the GlobalProtect Gateway is advertising the subnet to the satellite. A new access route of the subnet is added in the GlobalProtect Gateway config to be published to the satellite, as shown below:



However, this newly added access route is still not received by the satellite and the gateway information did not change to display, as shown below:


  • Pan-OS
  • GlobalProtect
  • GlobalProtect satellite



On the GlobalProtect Satellite, go to Network > IPSec Tunnels > GP-Satellite and click on "Gateway Info":



Check the gateway config and click "Refresh GW Config", as shown below to retrieve any changes made on the gateway such as receiving an access route:



The GlobalProtect satellite now has a route to reach the subnet behind the GlobalProtect gateway.

By default, the GlobalProtect satellite refreshes the config from gateway for the hours value specified in the GlobalProtect gateway satellite config, as shown below (default is 1 hour and max value is 48 hours):



Note: To refresh the gateway config through the CLI, and to verify the access routes added on the GlobalProtect satellite, use the following CLI commands:

> request global-protect-satellite get-gateway-config gateway-address 
satellite GP-Satellite
Use the command:  > show global-protect-satellite current-gateway gateway 
satellite GP-Satellite to display the gateway connection status
> show global-protect-satellite current-gateway gateway satellite GP-Satellite

GlobalProtect Satellite : GP-Satellite (1 gateways)
Gateway Info:
Get Config State:
Refresh Time (seconds)           : 7200
Failed Refresh Time (seconds)    : 300
Current Get Config               : success
Max Get Config Retries           : 34
Number Get Config Failed         : 0
Config Timer Activated           : yes
Next Get Config Time (seconds)   : 6081
Cached Get Config Time (seconds) : 0
Failed Reason

Portal Config:
GlobalProtect Gateway Name       : Gateway-FW-94
GlobalProtect Gateway Address    :
Priority                         : 1

Gateway Config:
Gateway Tunnel Name              : GP-Gateway-S
Gateway Tunnel Interface         : tunnel.6
Gateway Tunnel id                : 9
Gateway Tunnel IP                :
Gateway Additional Tunnel IPs    :
Status                           : Active
Status Time                      : Jan.14 03:12:57
Reason                           : Established

Config Refresh Time (hours)      : 2
IP Address                       :
Default Gateway                  :
Netmask                          :
Access Routes                    :
Denied Routes                    :
Duplicate Routes                 :
DNS Servers                      :
DNS Suffixes                     :

Tunnel Monitor Enabled           : No
Tunnel Monitor Interval          : 0 seconds
Tunnel Monitor Action            : wait-recover
Tunnel Monitor Threshold         : 0 attempts
Tunnel Monitor Source            :
Tunnel Monitor Destination       :
Tunnel Monitor Status            : No data available



Additional Information

See Also

How to Configure GlobalProtect Satellite

Large Scale VPN (LSVPN) Deployment Guide

owner: gchandrasekeran

  • Print
  • Copy Link

Choose Language