Using the PALOs internal IP as an injected header

WayneEvans — Sat, 19 Mar 2022 23:58:07 GMT

Hello

I'm very new to Palo, but not new to firewalls and my background is more with applications. This is to do with HTTP(S) traffic with a GET verb and Health Checks in AWS. This is a pre-existing system deployed in AWS as EC2s and I'm wondering if I'm missing something obvious.

I'm trying to see if there is a way of injecting something unique about each firewall to identify which firewall some HTTP(S) traffic came through. This can be anything, I'm really not picky: Internal IP, AWS Instance ID, hostname, MAC address, anything that is unique. .

The incoming request for this port will always be a GET and there is nothing at AWSs load balancers that will let me differentiate, so I'm hoping the PALO can add something.

Injection can be either as a header, a query parameter, or change the GET to a POST and add some JSON body to it with some unique data, I'm open to anything.

The PALOs are Active/Active with the same firewall configuration on each, so I don't think I can hard code any values in the "Http Header Insertion" --> Custom Headers section.

I may have missed something very obvious (be gentle - its my first post here and I tried to do my research first). If I have, or you have any suggestions, I'm open to any ideas

If it makes any difference the devices are at PAN-OS 10.1

Thank you

Re: Using the PALOs internal IP as an injected header

WayneEvans — Mon, 21 Mar 2022 17:16:55 GMT

Turns out we can't do this as the check happens on the management plane not the data plane.

If anyone replies, I am still curious about header injection though

topic Re: Using the PALOs internal IP as an injected header in VM-Series in the Public Cloud

Using the PALOs internal IP as an injected header

Re: Using the PALOs internal IP as an injected header