AWS VM Series Gateway Load Balancers not working

[craig.beamish]

Hi All

Has anyone else had a play with the GWLB on AWS?
I know it must be PAN-OS 10.0.2 or higher to work,
I have tested with multiple instances, 
As a bump in the wire it works fine. until you apply NAT, then it doesn't work at all for any traffic that is NAT'd. 
I have an open TAC for this, they are replicating the fault to work it out but surely this was all tested before it went public.

I also found overlay routing breaks traffic flow. its not documented anywhere that I could find but what I found was it processes the GENEVE traffic in the virtual router where without it, is just an in-return non routed flow. 

If you've tinkered with it and actually got inbound/outbound NAT and/or overlay routing to function, please let me know what you did. 

sadly the documentation just doesnt provide any decent clarity for this feature.

Also extremely disappointed they havent integrated this into version 9.1.
I am hopeful they will add it with 9.1.7 in a functional state as I am not planning to move my clients to 10.0 until the list of known issues is about 1/4 its current size.

[rapatil]

Hi Craig,

Thanks for your feedback. 

How are you deploying the GWLB with VM-Series? Are you using any of the templates provided on our Github repo? 

https://github.com/PaloAltoNetworks/AWS-GWLB-VMSeries

If you are using a CFT with an autoscale template, then it will create a NAT GW along with other components. The template also takes care of the automatic route population for any new APP VPCs. 

Thanks,

Raj

[jmeurer]

As of this time, break out routing is not supported.  The traffic must stay in the Geneve tunnel.  In reading this, it appears you are addressing the outbound use case.  In that traffic flow, the NatGW must be used as the next hop beyond the GWLBe as depicted in this flow.  

[craig.beamish]

We are using a nat gateway. outbound works just fine until you apply NAT of any sort. just trying to apply any sort of NAT to change the direction of the traffic breaks it. 

so if i put a nat rule that traffic to 1.1.1.1 gets d-nat to  8.8.8.8, the traffic never exits the firewall.
key use for this was for inbound traffic, redirecting inbound traffic to the correct ALB  that lives in another vpc, the traffic seems to get dropped at the firewall, even though pcaps show it *thinks* it is being forwarded on, its not.

[jmeurer]

Inbound requires ingress routing to use the GWLB without SNAT.  You can do that within the application vpc using a public-facing LB in front of the application.

Or if you want to have a dedicated inbound VPC, you use the same design as above but move your pool members across the TGW.

If you prefer the traditional Load Balancer sandwich design where the firewalls are pool members of the front door LB and you are going to SNAT/DNAT to the application, you would either use a dedicated set of firewalls or add new Untrust and Trust interfaces to the firewall as ETH3/4 and use those for ingress outside of the GWLB.  This is necessary as the GWLB traffic must hairpin inside of the Geneve tunnel, you cannot insert flows into the tunnel from another interface.