topic Re: Oracle Web Cache/Proxy fails when behind Palo Alto Firewall in General Topics

Oracle Web Cache/Proxy fails when behind Palo Alto Firewall

EdwardWaithaka — Sat, 12 Nov 2016 12:31:28 GMT

I have a situation where by when an Oracle Web Cache server is placed behind a PA firewall, the application takes time to load or fails in some cases. The design is as followins;

Windows 7 Client --> Routers --> PaloAlto Firewall --> Radware Loadbalancer port 80 (VIP) --> Oracle WebCache Server port 7777 --> Backend Oracle Apps.

I have allowed all traffic and stripped down the firewall to minimum configs.

What could be the problem?

Re: Oracle Web Cache/Proxy fails when behind Palo Alto Firewall

EdwardWaithaka — Sat, 12 Nov 2016 12:32:19 GMT

From the traffic logs I see the traffic is allowed to cross through

Re: Oracle Web Cache/Proxy fails when behind Palo Alto Firewall

reaper — Mon, 14 Nov 2016 09:31:58 GMT

can you provide some more details ? is the loadbalancer masking the server IP with a floating one, could return traffic originate from a different loadbalancer?

if you set a filter (debug dataplane packet-diag set filter...) and look at the global counters corresponding to your sessions (show counter global filter packet-filter yes), are you seeing any packets getting dropped ?

you could try running a packetcapture or flow basic to gain more visibility on what is happening on the dataplane: Getting Started: Flow Basic

Re: Oracle Web Cache/Proxy fails when behind Palo Alto Firewall

pulukas — Wed, 16 Nov 2016 00:11:13 GMT

I've seen this type of issue when the load balancer is setup in a way that allows asymmetrical routing. Here is the RADware document that describes the issue and how to avoid this in their load balancer.

http://kb.radware.com/Questions/AppDirector/Public/What-is-Segmentation