topic Re: Games consoles behind a PA-500 in General Topics

Games consoles behind a PA-500

RajinderSahota — Tue, 10 Aug 2010 14:59:52 GMT

Good afternoon all,

We are trialling a PA-500 at the moment and so far very impressed with the device. We have managed to configure everything we are likely to need to do through the firewall but this isn't a show stopping question/issue.

We have multiple Xbox 360's and Playstation 3's here and the number will be increasing. We would like to be able to do multiplayer gaming in general from these consoles. Once we get our full infrastructure in place we will be placing them in their own VLAN's to segment them from the network.

At the moment, we sit the consoles outside of the firewall with public IP's allowing us to do full multiplayer gaming sessions. I know uPNP is a big no no on corporate networks however I was wondering if there is a way to allow uPNP from a certain VLAN and/or for a certain application?

As a backup plan I think it is possible to do multiple inbound PAT however this could be a high overhead in terms of administering it with which Xbox is currently switched on and/or hosting a game.

I know the PA can recognise Xbox live traffic, so was just curious about the easiest way to go about it.

Many thanks in advance

Re: Games consoles behind a PA-500

pantac — Wed, 11 Aug 2010 22:07:11 GMT

currently the pa can detect the various online gaming for xbox, wii, etc. All you will need to do is create a rule allow those application inbound and outbound.

Re: Games consoles behind a PA-500

pjohnson1 — Tue, 01 Mar 2016 23:00:31 GMT

>currently the pa can detect the various online gaming for xbox, wii, etc. All you will need to do is create a rule allow those >application inbound and outbound.

Hello,

Could you please elaborate or provide an example?

We have the same requirement but was not sucessfull with the bi-direction or static NAT'ing policies or rules (wth the respective App-ID's)..

Re: Games consoles behind a PA-500

gwesson — Wed, 02 Mar 2016 00:22:48 GMT

uPNP is not something that can be allowed through the firewall. As it is inherently insecure, you would need to do 1-to-1 NAT to get the full capabilities of the Xbox/PS platforms. Without the 1-to-1 NAT, you'll still be able to get online to download updates or new games, browse the respective marketplaces, etc., but you won't be able to host a multiplayer game (unless something has changed in the last couple years that I'm not current on).

There's an article about it if you want to take a look:

https://live.paloaltonetworks.com/t5/Management-Articles/Palo-Alto-Networks-Firewalls-gaming-consoles-xbox-Playstation/ta-p/54848

Cheers,

Greg