topic Re: AWS ALB/ALB Sandwich - Active/Active vm-series (9.0.5) in VM-Series in the Public Cloud

AWS ALB/ALB Sandwich - Active/Active vm-series (9.0.5)

SatishNair — Wed, 27 Nov 2019 00:51:20 GMT

External ALB -> VM-series 300 -> Internal ALB -> server (listening on tcp/15000)

Having issues routing from external ALB to the server over port 15000 ?

Added listener port http:15000 on the ALB and forwarded it to the target group containing the firewall

Created destination NAT (untrusted to untrusted) on the firewall with source address translation (comes out of the trusted)

Created a policy to pass any traffic to the internal load balancer

Added a listener port http:15000 on the internal ALB to forward to the server.

no blocks on the security groups

Still having issues connecting

Re: AWS ALB/ALB Sandwich - Active/Active vm-series (9.0.5)

jmeurer — Wed, 27 Nov 2019 04:19:49 GMT

Satish,

In reviewing this and your other post which seems to be somewhat related, I would encourage you to engage your Palo Alto Networks SE. We have resources that can assist with straightening this out. Your external ALB should have a listener on the proper app port such as 443 and the target group mapping is port 15000 which the firewall is listening on. The NAT rule on the firewall will then have original source port of 15000 and a destination NAT of the internal ALB listener.

Re: AWS ALB/ALB Sandwich - Active/Active vm-series (9.0.5)

SatishNair — Wed, 27 Nov 2019 13:57:33 GMT

Ok thanks. I have opened a case with palo alto.