NAT issue for accessing ICMC service from google

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

NAT issue for accessing ICMC service from google

L1 Bithead

We have 4 production servers are accessing ICMC service which is hosted in following URL “pubsub.googleapis.com”,

 

If all 4 servers in common NAT rule then there is a time-out error observed which caused ICMC service failure.

 

We have tried change the rule from FQDN and category based rule but still time-out noticed ,

 

Application team escalated to Google support ,though they are not able to find the root cause ,However ,Suggested to change TCP time wait session to 120 sec but it didn’t restore the failure.

 

As a workaround ,We assigned dedicated IP’s for each servers which resolve the issue.

 

Is there any way we could implement the NAT rule for these 4 servers, PAT is not working as well for this.

 

Thanks!

 

PAN Seeker
4 REPLIES 4

Cyber Elite
Cyber Elite

@gasin1,

When you gave each server it's own IP address did you re-use the one that they were all trying to share at all? The thought process being that if you didn't, Google may simply be restricting the number of connections they are allowing from a single IP address for that service. 

The IPs are one to one static public IP addresses configured and that is not we want.

 

  

PAN Seeker

The IPs are one to one static public IP addresses configured and that is not we want.

@BPry 

PAN Seeker

L6 Presenter

Did you try to increase the tcp timeout on the firewall as this could be the reason for the issue by creatinga custom service (also global session timeout or application override can be used by the service timeout is a better option)?

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRiCAK

 

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRiCAK

 

 

 

Just to know which timeout you are hiting use global counters with a filter:

 

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS

 

 

 

From my point of view destination NAT with FQDN is still the best option for you:

 

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/networking/nat/configure-nat/configure-des...

  • 2024 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!