Does anyone have any experiences or "gotchas" they'd like to share when they've implemented Riverbed Steelhead appliances behind PA firewalls?

[ericgearhart]

I see that there's a 'riverbed-rios' app listed in Applipedia, which gives me some hope.

Specifically what I am concerned about is discussed here (with configuration examples for PIX/ASAs):

http://www.dslreports.com/faq/16494

The Riverbed appliances we have take advantage of TCP option 76 for autodiscovering other Steelhead appliances that are in-path. Has anyone configured a Palo Alto to allow this traffic? I'm not finding anything in the CLI guide that implies this advanced, granular configuration of TCP is available, but I'm hoping I'm wrong and this traffic can be permitted (or is magically already permitted by using the 'riverbed-rios' AppID - that would be awesome).

[ericgearhart]

Just to clarify on this one here's Palo Alto support's reply to this question:

Hello Eric 

I did some research on this one for you. 

PA firewalls does not alter the TCP options, whenever we send traffic through the Firewall, TCP options are no altered. 

Please let me know if you have any questions. 


Thank you again for choosing Palo Alto Networks. 


Sincerely, 
Harsha Natarajan | Network Security Engineer

[cowboy71]

Hey Eric,

Just wondering how you went with this?

I need to implement something similar. My incredibly limited understanding of the situation is that in the scenario above for cisco the traffic passes like:

LAN1-Riverbed1-Gateway1-INTERNET-Gateway2-Riverbed2-LAN2

BUT in Palo world, the traffic needs to go to the PA Firewall, THEN to the Riverbed, THEN back to the PA Firewall, THEN off to its final destination.

[ericgearhart]

We actually haven't implemented firewalls on both sides of Riverbed appliances yet, so unfortunately I don't have any experiences to share. We have plans in the works to implement PA, but the actual implementation is about a month out. The most I had received from support was as it is above, basically "PA won't muck with option 76 traffic." So in theory the Riverbeds should see each other and work as normal (at least in theory).

Sorry!

[cowboy71]

No problems mate - thanks for the prompt reply 🙂

I'll probably be implementing in the next month or so as well.

I will be sure to share my experiences here when its done!

[SimmSimm]

We have a remote branch office VPNed back to our Datacenter via an IPSEC tunnel between two Palos ; in the DC I setup a separate interface for the branch office traffic on the Palo, the routed the traffic out of the DC steelhead to that interface, down the IPSEC tunnel & out the other end where the second steelhead picks it up.

Works fine - Palo identifies the traffic as application riverbed-rios so there may be a gotcha in there if you want to filter by application type (since you cant tell what the original app was once its been processed by the steelhead).

[cowboy71]

Some excellent feedback there SimmSimm - thank you so much for that!!

Cheers!

[VinceM]

Hi,

If you want to be more granular, you can plug your riverbed on palo and use PBF for routing traffic to remote site equiped with remote Riverbed Mean:

server - palo - riverbed - palo - Ipsec tunnel - Remote site

server - palo - IpSec tunnel - Remote site.

and if install a ne remote Riverbed, just add subnet ini pbf rule.

Meke sense ?

V?

[orbcomm]

Hi,

This thread is over 10yrs old, but currently have issues with RB Steelheads behind palos

lan-rb-palo-ipsec-srx-rb-lan works fine

migrated out the srx with palo recently

lan-rb-palo-ipsec-palo-rb-lan not working for optimization

Tried any:any on both side

Tried app override for ports 7800-7850 riverbed peering

Just see resets in the packet captures.   

PanOS running 10.2.7-h3

Riverbed RIOS 9.14.2

Appreciate any thoughts on what to try next

Thanks

[kamalGD]

Hello solution on this please upate.