AWS VM Series Gateway Load Balancers not working

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
Sandeep_Darak
L1 Bithead

Hi @tostern 

In my case my setup is with two interface Eth1/2 (Inside) & Eth1/3(Outside). So whenever I hit traffic from Outside server to Inside Server traffic logs should say Traffic from Out to In. which is not happening. 
 
pkhavkine
L0 Member

I had a 3 interface setup working: GENEVE In/Out through eth1/1, then into eth1/2 -> NAT -> out of eth 1/3 to the ouetside.

Traffic would end up passing through the firewall twice.

 

On the other hand GWLB seems to break GP, so cannot run GP portal/Gateway on the outside interface.

Sandeep_Darak
L1 Bithead

My design is as per below. Let me know if any issue.

 

Server-1 (Outside)==>TGW==>SecurityVPC==>GWLBe==>EndPoint Service==>GWLB==>PaloAlto Outside interface (Eth1/1)==>Pa Processing==>PaloAlto Inside interface(Eth1/2)==> Server-2 (Inside).

 

I am not using GP instead traffic is ping/ssh. Whenever i process the traffic from Outside to Inside traffic logs saying traffic outside to outside hence not matching correct policy and not processing.  

jmeurer
L4 Transporter

At this time, GWLB deployments do not support routing outside of the GENEVE interface.  The traffic must hairpin back to the GWLB.

 

Also, there is a known issue with GP not working on a GWLB enabled firewall that will be resolved in a future release.

 

pkhavkine
L0 Member

Thanks for letting me know that it's a known issue with GP, any indication on when to expect a fix?

 

 

Thanks

jmeurer
L4 Transporter

It had not been committed to a version yet.  You should reach out to your SE to track the progress internally.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!