topic Re: Insert data in http stream? in Automation/API Discussions

Insert data in http stream?

berkheimert — Wed, 17 Jul 2013 13:56:10 GMT

My goal is the following:

have the palo alto insert something into the http stream that would allow me to detect which firewall it went through. I am working on a FW load balancing scenario in which multiple active firewalls can handle each request. I have a script set up on a client to initiate multiple connections to a server and simply download the web page (it's just a curl command). I just want the PA to insert SOMETHING, SOMEWHERE, that i can parse out either on the server or client. This is a lab setup, so I have full control of all devices. I don't care if it's a custom response page, inserting an HTTP GET variable into the URL, or whatever. as long as i can parse it out using a script (i can't require a 'mouse click'), i'm fine. Since i'm fairly new to Palo Alto stuff, I'm not sure if this is even possible.

Does anyone have any ideas?

Thanks.

Re: Insert data in http stream?

ericgearhart — Wed, 17 Jul 2013 14:24:33 GMT

Basically what you're looking for is something like the way you can inject an X-Forwarded-For header into an HTTP data stream from the PA (really you'd want "X-Forwarded-By"). I only know of ways to do this with proxies... I'm not aware of a way to do it with PA with their current feature set. PA can PARSE X-Forwarded-For, but I don't see a way where the firewall itself can inject it.

Re: Insert data in http stream?

berkheimert — Wed, 17 Jul 2013 15:55:00 GMT

yeah, something along those lines, or any creative way to do this....

could I set up a simple block page that embeds the original page within it? i don't think that would work, but wasn't sure.

just trying to think of anything creative. would a continue page work that automatically 'continues'? I assume that would work fine if it was an actual user as the client.

Re: Insert data in http stream?

berkheimert — Thu, 25 Jul 2013 19:15:36 GMT

I’m attempting to do the following:

Create a ‘continue’ or ‘override’ page that just redirects the user to the existing url with “?fw=X” appended to it. I think that part works, but I can’t get the block/allow match to keep me out of an infinite loop.

I set my “block list” to:

*/cgi-bin/script.pl

And my “allow list” to:

*/cgi-bin/script.pl?fw=

However, it appears that the block list is processed before the allow list because of the infinite loop.

Anyone have any ideas how to specify the block list to be "exactly this and nothing else at the end". I tried a '$' for regex 'end of line' but that didn't work.

edit:

my 'continue/override' page is nothing more than the following:

where 'X' is a number that indicates the firewall i'm traversing.