topic Re: NAT issue for accessing ICMC service from google in General Topics

NAT issue for accessing ICMC service from google

gasin1 — Thu, 25 Mar 2021 10:09:28 GMT

We have 4 production servers are accessing ICMC service which is hosted in following URL “pubsub.googleapis.com”,

If all 4 servers in common NAT rule then there is a time-out error observed which caused ICMC service failure.

We have tried change the rule from FQDN and category based rule but still time-out noticed ,

Application team escalated to Google support ,though they are not able to find the root cause ,However ,Suggested to change TCP time wait session to 120 sec but it didn’t restore the failure.

As a workaround ,We assigned dedicated IP’s for each servers which resolve the issue.

Is there any way we could implement the NAT rule for these 4 servers, PAT is not working as well for this.

Thanks!

Re: NAT issue for accessing ICMC service from google

BPry — Thu, 25 Mar 2021 14:19:06 GMT

@gasin1,

When you gave each server it's own IP address did you re-use the one that they were all trying to share at all? The thought process being that if you didn't, Google may simply be restricting the number of connections they are allowing from a single IP address for that service.

Re: NAT issue for accessing ICMC service from google

gasin1 — Thu, 25 Mar 2021 14:59:39 GMT

The IPs are one to one static public IP addresses configured and that is not we want.

Re: NAT issue for accessing ICMC service from google

gasin1 — Fri, 26 Mar 2021 13:18:03 GMT

The IPs are one to one static public IP addresses configured and that is not we want.

@BPry

Re: NAT issue for accessing ICMC service from google

nikoolayy1 — Fri, 26 Mar 2021 20:55:08 GMT

Did you try to increase the tcp timeout on the firewall as this could be the reason for the issue by creatinga custom service (also global session timeout or application override can be used by the service timeout is a better option)?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRiCAK

Just to know which timeout you are hiting use global counters with a filter:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS

From my point of view destination NAT with FQDN is still the best option for you:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/nat/configure-nat/configure-destination-nat-using-dynamic-ip-addresses.html