topic Re: Forwarding streaming traffic to a second Palo in General Topics

Forwarding streaming traffic to a second Palo

Jordan_Roebuck — Fri, 16 Dec 2016 10:42:13 GMT

Hi all. We have two Palo 3020s, each connected to a different ISP. At the moment the 1st firewall handles all our LAN internet based traffic, whereas the second firewall is mainly used for our VPN connections. We're looking at forwarding streaming traffic from the 1st firewall to the second firewall, to reduce the bandwidth usage on our primary ISP connection. I've been looking into configuring Policy Based Forwarding to achieve this, but most examples I see of this only use one firewall connected to multiple ISP connections. We're unable to connect our first firewall to the secondary ISP connection. Looking for advice on how I can forward this traffic through a seconadry Palo.

Re: Forwarding streaming traffic to a second Palo

TranceforLife — Fri, 16 Dec 2016 13:44:44 GMT

Hi,

Are these firewall on the same LAN but got two different ISPs connections? What is the default gateway for your LAN clients?

Thx,

Myky

Re: Forwarding streaming traffic to a second Palo

Jordan_Roebuck — Fri, 16 Dec 2016 11:37:55 GMT

Both firewalls are on the same LAN, the default gateway of the LAN clients is the first firewall. Thanks.

Re: Forwarding streaming traffic to a second Palo

TranceforLife — Fri, 16 Dec 2016 13:45:12 GMT

Hi,

Thanks for the confirmation. Havent done much of PBF but l think you can specify in the policy for the specific traffic to be fowarded to the 2nd firewall, then that firewall will use its ISP connection to get out.

Second option would be to have a router/Layer 3 device as DG and do PBF there so it will deside which traffic to send where (1st or 2nd FW)

Thx,

Myky

Re: Forwarding streaming traffic to a second Palo

reaper — Fri, 16 Dec 2016 12:36:51 GMT

PBF will work just fine if you consider for each firewall the 'other firewall' is an ISP instead of 'your firewall'

eg. on firewall 1 you'd need to set up pbf routing as if firewall 2 is the second ISP

could you include your topology, this may help get the creative juices flowing also 😉

Re: Forwarding streaming traffic to a second Palo

Jordan_Roebuck — Fri, 16 Dec 2016 14:12:24 GMT

See below for a crude diagram of the topolgy

As a test I configured policy based forwarding on P1 with source as the inside traffic (1/2) with 1/6 as the egress interface and 192.168.255.254 as the next hop, I also enforced symetric return. This doesn't work as the traffic still leaves 1/1 (ISP1) on the first Palo.

Re: Forwarding streaming traffic to a second Palo

TranceforLife — Fri, 16 Dec 2016 14:29:39 GMT

Hi,

Thx for the diagramm. Did you try to allow any traffic? Just test with any as a destination. Can you post screen shots of the PBF?

Myky