topic Re: ALB Health Checks -> Palo Alto -> ALB in General Topics

ALB Health Checks -> Palo Alto -> ALB

Cdchamberlin — Fri, 29 Mar 2019 00:18:14 GMT

Trying to get the Palo Altos to register as healthy. Can anyone provide some assistance on NAT policies, or configurations for getting TCP 80 checks from ALB to Palo Altos to ALB which sits in front of two App servers?

ALB (Palo Altos)

Palo Altos

|
ALB (App Servers)

|
App Servers

Re: ALB Health Checks -> Palo Alto -> ALB

reaper — Fri, 29 Mar 2019 13:13:24 GMT

What are the health checks telling you about why they are failing ? (there should be a reason code that you can match to the documentation)

how ids your NAT configured currently?

Re: ALB Health Checks -> Palo Alto -> ALB

Cdchamberlin — Fri, 29 Mar 2019 14:31:37 GMT

The health check failure states 'Request Timed Out'.

For NAT policies on the FW, I use Address Objects and map the FQDN of the ALBs. I can succesfully resolve the FQDN of the ALB which points to the Palo Altos, but I cannot resolve the ALB for the App Servers from the Palo Alto. They are in different VPCs.

ALB
Palo1 Palo2 = Can resolve from FW

ALB
App1 App2 = Can't resolve from FW

I think it has something to do with the Palo not being able to resolve the FQDN of the ALB positioned 'lower' in the stack sitting above the App Servers.