Any to Specific VPN Breakout

[dromanelli]

Hi,

I'm having an issue. I have a catchall VPN tunnel on my Palo Alto that sends all of my traffic to a company called Zscaler. They are a cloud security company that acts as a proxy to intercept our traffic and check it before it goes out to the internet and vice-versa.  However, sometimes certain exchanges don't play nice with Zscaler, such as our cloud hosted VOIP traffic, and as such, I need to configure a NAT breakout to route traffic destinated to our cloud VOIP provider's PBX away from that VPN tunnel.

What I am finding is that NAT breakouts on the Palo work IF they are "Specific-to-Any," but "Any-to-Specific" VPN breakouts have no effect, and the traffic still gets sucked into Zscaler. Example below.  ANy help is appreciated. 

[reaper]

@dromanelliNAT is subordinate to routing, so if you need to route things away from the VPN tunnel, you should probably look into policy based forwarding or a static route with a lower metric than what you are pushing into the ZScaler tunnel

only after routing is determined will NAT be applied

[dromanelli]

Hi,

Thanks for your reply.  So I actually tried the PBF first before coming here and unfortunately that broke other traffic, so I reverted it.  I am willing to look into the static routes.  Below is my route table:

So right now I just have a single outbound route to my ISP gateway out Ethernet1/1. The Zscaler tunnels are not explicitly called in my route table. It just takes the default route and gets dumped into the VPN. The interfaces for those are tunnel.1 (primary) and tunnel.2 (backup). Is there a way I can reconfigure these routes to add a Zscaler default route and a general internet default route? 

[reaper]

@dromanelli  then you probably have a policy based forwarding rule for zscaler; traffic needs direction to go into a tunnel, either by a static route or a pbf policy. it can't just be dropped in a tunnel without one of both methods

to bypass the zscaler pbf, you need to add an exception rule above it, something along the lines of the picture below

[dromanelli]

I do, yes.  See below:

What I tried to do before posting was place the following, but it ended up breaking traffic, so I disabled it. After looking at your screenshot, I think I see why. I have the action set to Forward instead of no-pbf:

So in theory, if I change that to no-pbf, this should accomplish what I need right? 

[reaper · Accepted solution]

correct

you can set that additional rule to no-pbf (make sure it is ABOVE the zscaler rule) which will bypass the zcaler policy

OR

you see those strikethrough subnets in the zscaler rule source, those are essentially also overrides

it sets the rule to 'forward everything THAT ARE NOT these subnets'

could be helpful too

[dromanelli]

Thanks very much.  When does your book come out by the way? I'd like to get a hard cover copy.  Is that a good book for Palo beginners? I'm Cisco-seasoned but Palo Green. 

[reaper]

It aims at all levels of expertise: get you started quickly, walk you through all sorts of config and add tips, tricks and 'tribal knowledge' I acquired over the years ,

it launches with my publisher on august 7 and amazon on september 9 😉

[dromanelli]

Great. I'll be buying one. 

[reaper]

I can only applaud that 😉