Palo Alto Networks NAT Session Distribution as a Way to Implement Server Load Balancing

[nikoolayy1]

Palo Alto Networks NAT Session Distribution as a Way to Implement Server Load Balancing

The Palo Alto Network Destination NAT Session Distribution can be used to implement similar to Load Balancer functionality by using one of the "distribution" methods.

You need to allow the traffic with a with a security policy rule from the correct source zone to the correct destination zone.

Useful additions are SNAT and SSL Inbound:

• Combining this feature with Source NAT will make certain that the servers will return the traffic to the firewall and not to cause asymmetric routing but then the servers will not see real client IP address.
• SSL Inbound Inspection will allow inbound HTTPS/SSL traffic to be inspected before being load balanced to the destination servers. This will allow IPs and antivirus inspections.

You can create address group that contains the different server's IP addresses.

The selected translated IP address can be seen in the "Traffic" logs that in this case is "192.168.1.1". You can also use DNS FQDN address. 

Summary:

This feature allows the implementation of basic load balancer but if the application is stateful then the correct distribution method needs to be selected like "Source IP HASH" as to always select the same server.

References:

• Session Distribution Policy Descriptions
• SSL Inbound Inspection
• Configure SSL Inbound Inspection

[kiwi]

Hi @nikoolayy1 ,

Thanks for putting this together !

Very useful !

[mkalyani]

Very nicely written and informative!!

Thank You!

[emgarcia]

Great post! 👍 This feature is super handy for load balancing. Thanks for highlighting that!

[crasmussen]

This is explained incredibly well-appreciate the additional references! @nikoolayy1