Options to NAT Porxy Server

[jlombardo]

Background:  10000 or so clients connect to the Internet through a cluster of proxy servers.  The proxy servers sit on the inside of the network and share a single outside NAT address.  So all external web related requests come from the same outside NAT address.

Problem:  Cloud services using Akamai and Amazon will periodically block our proxy servers outside NAT addresses.  IT appears that the proxy server outside address is getting blocked because it exceeded some rate limit implemented by the cloud service provider.

One solution we are investigating is to create a dynamic ip and port nat policy for the proxy servers with multiple outside public addresses.  But how does that work?  In my experience a dynamic ip and port policy will uses the first IP in the pool until all the ports are exhausted.  So we would have to have 65000 or so concurrent web requests before the pool would roll over to the next ip.  This wouldnt fix our problem.

It there a way set a NAT policy so the Palo will round robin each address in the pool?

What have other engineers done to fix this problem?  We cant be the only ones that have run into this issue?

Thanks

Joe

[SutareMayur]

Hi @jlombardo 
Check if this article helps you.