topic Re: Routing issue in General Topics

Routing issue

ajripa — Mon, 21 Feb 2011 12:46:09 GMT

Hi guys,

I have an issue I faced before with OpenBSD's PF Firewall but I am not able to solve with PAN.

My topology is:

INET ----- PAN ---- DMZ ---- Balancer ---- Balanced Servers

LAN

The domain controllers for the DMZ domain are located in DMZ and their default gateway is PAN. The route to reach the balanced servers network is configured in PAN and I can reach the balanced servers network either from LAN and from DMZ. However, although I can ping from the domain controllers in the DMZ to the balanced servers and viceversa, I am facing some validations issues. These issues dissapear when I configure a static route on the domain controllers to reach the balanced servers directly through the balancer. I know it's weird to go through PAN to reach balanced servers from DMZ, but I don't like adding static routes to servers.

I could solve the problem with PF modifiying the stateful behaviour.

Any idea?

Re: Routing issue

kbrazil — Mon, 21 Feb 2011 22:10:22 GMT

It looks like the Palo Alto firewall is only seeing half of the flows from the DMZ servers to the Balanced Servers. The initial packet from the DMZ server goes to the firewall, which then sends it through the Balancer. When the Balanced Servers send the response back to the Balancer, they see the destination as a connected network, so instead of sending the traffic back to the firewall, it gets sent directly to the DMZ server.

This is a type of asymmetric route. You can either put static routes on your servers, as you have done, or you can put more specific routes to those servers on the Balancer with a next hop of the firewall. Another option would be to put another pair of firewall ports (L3 or Vwire) in front of the Balancer so you can fully inspect the traffic between the DMZ servers and the Balanced Servers.

Cheers,

Kelly

Re: Routing issue

ajripa — Tue, 22 Feb 2011 08:02:21 GMT

This link contains helpful information to address the issue. https://live.paloaltonetworks.com/docs/DOC-1260

Disabling tcp-reject-non-syn solves the assymetric routing problem. However, I am not sure about the security implications it could have.

Thanks!

Re: Routing issue

ajripa — Tue, 01 Mar 2011 09:50:06 GMT

Answered.