topic Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA fire in General Topics

Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

ericgearhart — Fri, 08 Feb 2013 12:52:43 GMT

I see that there's a 'riverbed-rios' app listed in Applipedia, which gives me some hope.

Specifically what I am concerned about is discussed here (with configuration examples for PIX/ASAs):

http://www.dslreports.com/faq/16494

The Riverbed appliances we have take advantage of TCP option 76 for autodiscovering other Steelhead appliances that are in-path. Has anyone configured a Palo Alto to allow this traffic? I'm not finding anything in the CLI guide that implies this advanced, granular configuration of TCP is available, but I'm hoping I'm wrong and this traffic can be permitted (or is magically already permitted by using the 'riverbed-rios' AppID - that would be awesome).

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

ericgearhart — Tue, 19 Feb 2013 00:32:32 GMT

Just to clarify on this one here's Palo Alto support's reply to this question:

Hello Eric 

I did some research on this one for you. 

PA firewalls does not alter the TCP options, whenever we send traffic through the Firewall, TCP options are no altered. 

Please let me know if you have any questions. 



Thank you again for choosing Palo Alto Networks. 



Sincerely, 
Harsha Natarajan | Network Security Engineer

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

cowboy71 — Thu, 18 Jul 2013 01:31:47 GMT

Hey Eric,

Just wondering how you went with this?

I need to implement something similar. My incredibly limited understanding of the situation is that in the scenario above for cisco the traffic passes like:

LAN1-Riverbed1-Gateway1-INTERNET-Gateway2-Riverbed2-LAN2

BUT in Palo world, the traffic needs to go to the PA Firewall, THEN to the Riverbed, THEN back to the PA Firewall, THEN off to its final destination.

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

ericgearhart — Thu, 18 Jul 2013 02:21:51 GMT

We actually haven't implemented firewalls on both sides of Riverbed appliances yet, so unfortunately I don't have any experiences to share. We have plans in the works to implement PA, but the actual implementation is about a month out. The most I had received from support was as it is above, basically "PA won't muck with option 76 traffic." So in theory the Riverbeds should see each other and work as normal (at least in theory).

Sorry!

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

cowboy71 — Thu, 18 Jul 2013 02:26:06 GMT

No problems mate - thanks for the prompt reply 🙂

I'll probably be implementing in the next month or so as well.

I will be sure to share my experiences here when its done!

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

SimmSimm — Thu, 18 Jul 2013 13:53:29 GMT

We have a remote branch office VPNed back to our Datacenter via an IPSEC tunnel between two Palos ; in the DC I setup a separate interface for the branch office traffic on the Palo, the routed the traffic out of the DC steelhead to that interface, down the IPSEC tunnel & out the other end where the second steelhead picks it up.

Works fine - Palo identifies the traffic as application riverbed-rios so there may be a gotcha in there if you want to filter by application type (since you cant tell what the original app was once its been processed by the steelhead).

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

cowboy71 — Thu, 18 Jul 2013 22:13:45 GMT

Some excellent feedback there SimmSimm - thank you so much for that!!

Cheers!

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

VinceM — Fri, 19 Jul 2013 09:57:34 GMT

Hi,

If you want to be more granular, you can plug your riverbed on palo and use PBF for routing traffic to remote site equiped with remote Riverbed Mean:

server - palo - riverbed - palo - Ipsec tunnel - Remote site

server - palo - IpSec tunnel - Remote site.

and if install a ne remote Riverbed, just add subnet ini pbf rule.

Meke sense ?

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA fire

orbcomm — Wed, 28 Feb 2024 19:42:38 GMT

Hi,

This thread is over 10yrs old, but currently have issues with RB Steelheads behind palos

lan-rb-palo-ipsec-srx-rb-lan works fine

migrated out the srx with palo recently

lan-rb-palo-ipsec-palo-rb-lan not working for optimization

Tried any:any on both side

Tried app override for ports 7800-7850 riverbed peering

Just see resets in the packet captures.

PanOS running 10.2.7-h3

Riverbed RIOS 9.14.2

Appreciate any thoughts on what to try next

Thanks

Re: Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA fire

kamalGD — Wed, 12 Jun 2024 17:40:31 GMT

Hello solution on this please upate.