topic Re: PA-500 dual internet connections in General Topics

PA-500 dual internet connections

ParishSoftIT — Wed, 26 Dec 2012 13:25:45 GMT

Hello all,

First post here!!

I have a PA-500 that I'm trying to add a second internet connection to and I'm running into an issue. The goal here is to keep the primary line (a bonded T1 solution) for corperate traffic such as VPN tunnels, remote connectivity, SIP phones, mail delivery and then add the second line (a standard cable line) for general internet surfing.

I have the second line in place and I can use it. the issue I run into is two things. First what is likely the easy one - on the new connection I can ping and get replies to the internet, but I can't browse the internet. I would assume this is something set-up in NAT or in the application layer being allowed only to browse on the old conection IP address? I feel like I can figure this out, but I haven't messed with it much since I'm running into the next issue.

Then the second issue is a little more complex I think. I have a route already in place which is 0.0.0.0/0 --> corperate line. When I change my 0.0.0.0/0 route to use the new connection I can no longer connect from an outside address to a IP on the corperate line. So for example we have a published RDP server, it uses one of the static IP's on the corperate line. When I change the route I can't RDP to that server.

I'm pretty sure what's happening here is the connection comes in the corperate line, goes to the server then is trying to return using the new connection. I asummed that the established routes would follow their same path back, but they seem to be trying to follow the 0.0.0.0/0 route to the new connection instead. Which I guess sort of makes sense, after all when traffic gets to the PA-500 and wants to go to the users IP address it looks at the route and follows it, when I want it to ignore the route table and just go back the direction it came from.

Can this be done on a PA-500? Is there some global setting I need to set to make this work? Any help would be appreciated.

Thanks.

Doug

Re: PA-500 dual internet connections

sdurga — Wed, 26 Dec 2012 18:05:07 GMT

Hi Doug,

Lets see your second issue first !!. You are right the RDP to server is not working because your traffic is coming one way and going out other. We do have the feature which allows us to send the traffic back the same path we received and this feature is introduced in 5.0.

Tx,

Sandeep T

Re: PA-500 dual internet connections

ParishSoftIT — Wed, 26 Dec 2012 18:32:03 GMT

I did check and we are running version 3.1.10, so there's not going to be much I can do until I get the support renewed anyway.

Re: PA-500 dual internet connections

SergeAyotte — Thu, 27 Dec 2012 15:32:15 GMT

Hi Doug!

I have the same kind of set-up and can tell you that it does work... With 5.0.1 (my PA-500 is brand new) ...

I have some of my users going out via the secondary, and others via my primary, but it was tricky... You do need some NAT rules and Policy Based ones for the out-in of your secondary, even before trying to make people go out via secondary.

I cannot say if it can be done for specific applications (my next project to look into )

I had great help from the support tema here, that was how I got it to work so indeed, "keep" pushing your provider to get your support asap...

Serge

Re: PA-500 dual internet connections

ParishSoftIT — Mon, 31 Dec 2012 18:21:20 GMT

yea, we have support now!!

next problem - newest version in the list for me to download and install is 4.0.13. I suspect this is becuase I will need to go to a 4 level from 3 before I can go to a 5 level?

Re: PA-500 dual internet connections

sdurga — Mon, 31 Dec 2012 22:21:22 GMT

In order to upgrade to 5.0.0 you need to have at least 4.1.0 and above running on the box else you cannot upgrade to 5.0.0 and also your application and threats content version should be above 320 version. Please check the release notes for the same.

Thanks,

Sandeep T

Re: PA-500 dual internet connections

ParishSoftIT — Tue, 01 Jan 2013 14:32:51 GMT

Well this is working great!!

I tried to install the latest version I can to get this done (4.0.13) and now the device is dead. the amber status light is on and none of the other network lights are on. The managment one does come on so maybe I need to plug into that???

Re: PA-500 dual internet connections

ParishSoftIT — Tue, 01 Jan 2013 16:50:53 GMT

Mssion "4.0.13" complete, thanks to great support help!!

Now moving on to mission "4.1.9", hopefully this one will go a little smoother.

Re: PA-500 dual internet connections

ParishSoftIT — Tue, 01 Jan 2013 18:04:51 GMT

woo-hoo!! 4.1.10 is loaded with no problems!! Downloading the 5's now, one more update path and I should be good to go.

Re: PA-500 dual internet connections

ParishSoftIT — Tue, 01 Jan 2013 18:45:42 GMT

alright, 5.0.1 is loaded and its working!!!

now what was I doing again???

Re: PA-500 dual internet connections

ParishSoftIT — Fri, 04 Jan 2013 01:50:48 GMT

Hello again all,

I'm picking back up where I left off before upgrades amd looking to get a little help.

I've found the check box in the policy based forwarding but still not having any luck. Anyway, if anyones knows how I can get this firewall to return traffic from the interface it came from instead of following the 0.0.0.0 route.

Thanks,

Doug

Re: PA-500 dual internet connections

sdurga — Fri, 04 Jan 2013 02:22:27 GMT

I will check with my team and will try to make this a public one or create a new one for the same. I will update you no than tomorrow !!

Re: PA-500 dual internet connections

longwave — Mon, 07 Jan 2013 14:15:11 GMT

Hi,

When the document will be downloadable?

regards,

Iarno Pagliani

Re: PA-500 dual internet connections

sdurga — Mon, 07 Jan 2013 22:17:03 GMT

Hi Larno,

I am putting together a document. I will attach it here today so that you can download it.

Tx,

Sandeep T

Re: PA-500 dual internet connections

sdurga — Tue, 08 Jan 2013 05:29:11 GMT

Here we go with the doc.

Symmetric Return.docx -Box

Let me know if you u need more info.

Tx,

Sandeep T

Re: PA-500 dual internet connections

ParishSoftIT — Thu, 10 Jan 2013 05:57:55 GMT

Its working!! I have the PBF rules set-up, I was close but the doc got the last pieces in place.

I still have the internet browsing problem though. Its a bit confusing because I can ping and trace route all of the way through to internet addreses will full replies, but I can't broswe the internet. Could this be something in the application filtering?

Thanks,

Doug

Re: PA-500 dual internet connections

ParishSoftIT — Thu, 10 Jan 2013 15:01:05 GMT

I got it going this morning.

I had to change the translation IP for the Source Translation on default internet NAT from the corperate line to the browsing internet line. I tried to just add it as a second NAT so I'd have one for both, but I guess it only likes the one. I'll just have to make this change if I ever need to switch the browsing from one to the other.

Thanks to all for the help on getting this set-up.