Any to Specific VPN Breakout

Reply
Highlighted
L1 Bithead

Any to Specific VPN Breakout

Hi,

 

I'm having an issue. I have a catchall VPN tunnel on my Palo Alto that sends all of my traffic to a company called Zscaler. They are a cloud security company that acts as a proxy to intercept our traffic and check it before it goes out to the internet and vice-versa.  However, sometimes certain exchanges don't play nice with Zscaler, such as our cloud hosted VOIP traffic, and as such, I need to configure a NAT breakout to route traffic destinated to our cloud VOIP provider's PBX away from that VPN tunnel.

 

What I am finding is that NAT breakouts on the Palo work IF they are "Specific-to-Any," but "Any-to-Specific" VPN breakouts have no effect, and the traffic still gets sucked into Zscaler. Example below.  ANy help is appreciated. 

 

dromanelli_0-1595621800306.png

 

 

 


Accepted Solutions
Highlighted
L7 Applicator

correct

 

you can set that additional rule to no-pbf (make sure it is ABOVE the zscaler rule) which will bypass the zcaler policy

OR

you see those strikethrough subnets in the zscaler rule source, those are essentially also overrides

it sets the rule to 'forward everything THAT ARE NOT these subnets'

 

could be helpful too

 

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374

View solution in original post


All Replies
Highlighted
L7 Applicator

@dromanelliNAT is subordinate to routing, so if you need to route things away from the VPN tunnel, you should probably look into policy based forwarding or a static route with a lower metric than what you are pushing into the ZScaler tunnel

 

only after routing is determined will NAT be applied

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374
Highlighted
L1 Bithead

Hi,

 

Thanks for your reply.  So I actually tried the PBF first before coming here and unfortunately that broke other traffic, so I reverted it.  I am willing to look into the static routes.  Below is my route table:

 

dromanelli_0-1595856235247.png

So right now I just have a single outbound route to my ISP gateway out Ethernet1/1. The Zscaler tunnels are not explicitly called in my route table. It just takes the default route and gets dumped into the VPN. The interfaces for those are tunnel.1 (primary) and tunnel.2 (backup). Is there a way I can reconfigure these routes to add a Zscaler default route and a general internet default route? 

Highlighted
L7 Applicator

@dromanelli  then you probably have a policy based forwarding rule for zscaler; traffic needs direction to go into a tunnel, either by a static route or a pbf policy. it can't just be dropped in a tunnel without one of both methods

 

to bypass the zscaler pbf, you need to add an exception rule above it, something along the lines of the picture below

2020-07-27_15-45-39.png

 

 

 

 

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374
Highlighted
L1 Bithead

I do, yes.  See below:

dromanelli_0-1595858301303.png

What I tried to do before posting was place the following, but it ended up breaking traffic, so I disabled it. After looking at your screenshot, I think I see why. I have the action set to Forward instead of no-pbf:

dromanelli_1-1595858444082.png

So in theory, if I change that to no-pbf, this should accomplish what I need right? 

 

Highlighted
L7 Applicator

correct

 

you can set that additional rule to no-pbf (make sure it is ABOVE the zscaler rule) which will bypass the zcaler policy

OR

you see those strikethrough subnets in the zscaler rule source, those are essentially also overrides

it sets the rule to 'forward everything THAT ARE NOT these subnets'

 

could be helpful too

 

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374

View solution in original post

Highlighted
L1 Bithead

Thanks very much.  When does your book come out by the way? I'd like to get a hard cover copy.  Is that a good book for Palo beginners? I'm Cisco-seasoned but Palo Green. 

Highlighted
L7 Applicator

It aims at all levels of expertise: get you started quickly, walk you through all sorts of config and add tips, tricks and 'tribal knowledge' I acquired over the years ,

it launches with my publisher on august 7 and amazon on september 9

 

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374
Highlighted
L1 Bithead

Great. I'll be buying one. 

Highlighted
L7 Applicator

I can only applaud that

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!