Oracle Web Cache/Proxy fails when behind Palo Alto Firewall

[EdwardWaithaka]

I have a situation where by when an Oracle Web Cache server is placed behind a PA firewall, the application takes time to load or fails in some cases. The design is as followins;

Windows 7 Client --> Routers  --> PaloAlto Firewall --> Radware Loadbalancer port 80 (VIP)  --> Oracle WebCache Server port 7777  --> Backend Oracle Apps.

I have allowed all traffic and stripped down the firewall to minimum configs.

What could be the problem?

[EdwardWaithaka]

From the traffic logs I see the traffic is allowed to cross through

[reaper]

can you provide some more details ? is the loadbalancer masking the server IP with a floating one, could return traffic originate from a different loadbalancer?

if you set a filter (debug dataplane packet-diag set filter...) and look at the global counters corresponding to your sessions (show counter global filter packet-filter yes), are you seeing any packets getting dropped ?

you could try running a packetcapture or flow basic to gain more visibility on what is happening on the dataplane: Getting Started: Flow Basic

[pulukas]

I've seen this type of issue when the load balancer is setup in a way that allows asymmetrical routing.  Here is the RADware document that describes the issue and how to avoid this in their load balancer.

http://kb.radware.com/Questions/AppDirector/Public/What-is-Segmentation