topic Re: Any to Specific VPN Breakout in General Topics

Any to Specific VPN Breakout

dromanelli — Fri, 24 Jul 2020 20:16:58 GMT

Hi,

I'm having an issue. I have a catchall VPN tunnel on my Palo Alto that sends all of my traffic to a company called Zscaler. They are a cloud security company that acts as a proxy to intercept our traffic and check it before it goes out to the internet and vice-versa. However, sometimes certain exchanges don't play nice with Zscaler, such as our cloud hosted VOIP traffic, and as such, I need to configure a NAT breakout to route traffic destinated to our cloud VOIP provider's PBX away from that VPN tunnel.

What I am finding is that NAT breakouts on the Palo work IF they are "Specific-to-Any," but "Any-to-Specific" VPN breakouts have no effect, and the traffic still gets sucked into Zscaler. Example below. ANy help is appreciated.

Re: Any to Specific VPN Breakout

reaper — Sun, 26 Jul 2020 20:32:42 GMT

@dromanelliNAT is subordinate to routing, so if you need to route things away from the VPN tunnel, you should probably look into policy based forwarding or a static route with a lower metric than what you are pushing into the ZScaler tunnel

only after routing is determined will NAT be applied

Re: Any to Specific VPN Breakout

dromanelli — Mon, 27 Jul 2020 13:29:53 GMT

Hi,

Thanks for your reply. So I actually tried the PBF first before coming here and unfortunately that broke other traffic, so I reverted it. I am willing to look into the static routes. Below is my route table:

So right now I just have a single outbound route to my ISP gateway out Ethernet1/1. The Zscaler tunnels are not explicitly called in my route table. It just takes the default route and gets dumped into the VPN. The interfaces for those are tunnel.1 (primary) and tunnel.2 (backup). Is there a way I can reconfigure these routes to add a Zscaler default route and a general internet default route?

Re: Any to Specific VPN Breakout

reaper — Mon, 27 Jul 2020 13:47:50 GMT

@dromanelli then you probably have a policy based forwarding rule for zscaler; traffic needs direction to go into a tunnel, either by a static route or a pbf policy. it can't just be dropped in a tunnel without one of both methods

to bypass the zscaler pbf, you need to add an exception rule above it, something along the lines of the picture below

Re: Any to Specific VPN Breakout

dromanelli — Mon, 27 Jul 2020 14:01:05 GMT

I do, yes. See below:

What I tried to do before posting was place the following, but it ended up breaking traffic, so I disabled it. After looking at your screenshot, I think I see why. I have the action set to Forward instead of no-pbf:

So in theory, if I change that to no-pbf, this should accomplish what I need right?

Re: Any to Specific VPN Breakout

reaper — Mon, 27 Jul 2020 14:19:00 GMT

correct

you can set that additional rule to no-pbf (make sure it is ABOVE the zscaler rule) which will bypass the zcaler policy

you see those strikethrough subnets in the zscaler rule source, those are essentially also overrides

it sets the rule to 'forward everything THAT ARE NOT these subnets'

could be helpful too

Re: Any to Specific VPN Breakout

dromanelli — Mon, 27 Jul 2020 14:51:45 GMT

Thanks very much. When does your book come out by the way? I'd like to get a hard cover copy. Is that a good book for Palo beginners? I'm Cisco-seasoned but Palo Green.

Re: Any to Specific VPN Breakout

reaper — Mon, 27 Jul 2020 15:15:53 GMT

It aims at all levels of expertise: get you started quickly, walk you through all sorts of config and add tips, tricks and 'tribal knowledge' I acquired over the years ,

it launches with my publisher on august 7 and amazon on september 9 😉

Re: Any to Specific VPN Breakout

dromanelli — Mon, 27 Jul 2020 17:09:10 GMT

Great. I'll be buying one.

Re: Any to Specific VPN Breakout

reaper — Mon, 27 Jul 2020 17:13:08 GMT

I can only applaud that 😉