For details on cookie usage on our site, read our Privacy Policy
Issues with Overlay Routing and AWS Gateway Load Balancer
- LIVEcommunity
- Discussions
- Network Security
- VM-Series in the Public Cloud
- Re: Issues with Overlay Routing and AWS Gateway Load Balancer
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
Issues with Overlay Routing and AWS Gateway Load Balancer
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-06-2022 06:13 AM - edited 06-06-2022 06:15 AM
Hey Folks,
I am having difficulties to get Overlay routing working with AWS GWLB and I was wondering is it something that I am doing wrong or missing some configuration element...
Any of you using AWS GWLB with overlay routing enabled?
In my test setup when overlay routing is enabled the test VM is able to reach internet over the PAN FW - Outbound is working fine.
But East-West between VPCs and Inbound traffic is not working. I can see traffic hitting the firewall, but allow traffic log show only byte send and no return traffic. Packet capture on the destination (for both east-west and inbound) doesn't show traffic to be arriving, so it looks like once FW inspect the packet and send back to GWLBe it doesn't send it in the correct direction.
If overlay routing is disabled everything works - east-west, inbound and outbound.
I found some old discussions mentioning issues with overlay routing, but from what I understand those know issues were for version 10.0.x, while we have tested with 10.2.1 and 10.1.6
- Mark as New
- Subscribe to RSS Feed
- Permalink
08-08-2022 02:47 AM
The appliance modes are enabled, of course...they have to be! But more to the point: how otherwise would downgrading to 10.1.5-h5 work?! How would outbound flows work? but not East-West traffic flows?
In summary: it is a firmware version issue - not an appliance issue or configuration issue.
BW
- Mark as New
- Subscribe to RSS Feed
- Permalink
09-06-2022 07:42 AM
Just hit this issue while running 10.1.6. It's reportedly fixed in 10.1.6-h6 and I can confirm this having upgraded.
Didn't stop me wasting a whole morning debugging it though...
- Mark as New
- Subscribe to RSS Feed
- Permalink
09-14-2022 01:00 AM
Hey Folks,
I haven't tracked this topic for very long time, it feels good to know that you are not insane and other are having the same problems...
Thank you @npandey for the insight. I can see 10.1.7 are officially released today and it looks like it is fixing the problem with the overlay routing:
https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/issues-with-overlay-routing-and-a...
|
PAN-194776
|
Fixed an issue on Amazon Web Services (AWS) Gateway Load Balancer (GWLB) deployments with overlay routing enabled where intra-zone packets were re-encapsulated with the incorrect source/destination MAC address.
|
I probably will not be able to test it anytime soon, because we already agreed on the design with disabled overlay routing and wouldn't change it soon.
- NGFW with azure gateway load balancer in VM-Series in the Public Cloud
- VM-Series configuration sync in aws GWLB architecture in VM-Series in the Public Cloud
- Configure global Protect with AWS VM series firewall which is working with AWS Gateway Load balancer in VM-Series in the Public Cloud
- Overlay routing for specific VPC in VM-Series in the Public Cloud
- Issues with Overlay Routing and AWS Gateway Load Balancer in VM-Series in the Public Cloud
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
