This message was deleted.
# citrix-netscalers
Slackbot
03/16/2020, 7:27 PMThis message was deleted.
c
CTXMike
03/16/2020, 8:09 PMMultiple interfaces or just one?
b
Bill Nickerson
03/16/2020, 8:11 PMOn the Palo? Two external ISPs on separate interfaces I have the netscaler setup in the DMZ only.
Bill Nickerson
03/16/2020, 8:12 PM1 interface on the netscaler.
c
CTXMike
03/16/2020, 8:12 PMon the NS, just checking. One interface makes it pretty easy. You're NATting a public address on the Palo through to a DMZ address on the NS?
b
Bill Nickerson
03/16/2020, 8:12 PMyup
c
CTXMike
03/16/2020, 8:13 PMThat's about as simple as it gets. Run any packet traces yet?
b
Bill Nickerson
03/16/2020, 8:14 PMI'm pretty green to the netscaler, can I do that on the netscaler?
c
CTXMike
03/16/2020, 8:16 PMactually, before we do that, did you add a default route pointing to the Palo?
b
Bill Nickerson
03/16/2020, 8:17 PMyeah, 0.0.0.0 points to the DMZ gateway x.x.x.1
c
CTXMike
03/16/2020, 8:19 PMOK, does that gateway eventually go through the Palo?
b
Bill Nickerson
03/16/2020, 8:19 PMyes, it's an interface on the palo
c
CTXMike
03/16/2020, 8:19 PMOK cool.
CTXMike
03/16/2020, 8:20 PMGo to System -> Diagnostics -> Start New Trace. Change Packet Size to 0 and hit start, then try to hit the public IP a couple times then come back to that page to stop and download it. That should let you see if any SYNs are getting through.
CTXMike
03/16/2020, 8:21 PMIf you don't see any SYNs then the rules on the firewall are messed up somehow. If you see SYN/ACKs sent from NS in reply then check a trace on the client side to see if they're getting back to the client.
CTXMike
03/16/2020, 8:21 PMIf the SYN/ACKs aren't getting back to the client then the Palo may be dropping them, again usually a rule issue.
b
Bill Nickerson
03/16/2020, 8:28 PMThis probably isn't good.
c
CTXMike
03/16/2020, 8:32 PMOk so those are SYNs going outbound, probably monitor traffic. What you want to do is filter on your client’s WAN IP address.
CTXMike
03/16/2020, 8:32 PMAre you testing from your internal network?
CTXMike
03/16/2020, 8:34 PMWell I’m assuming that anyway since I can’t see the IPs. Is the source of the SYN traffic the client or a NetScaler owned IP?
b
Bill Nickerson
03/16/2020, 8:40 PMThe client, I'm running the client from our WIFI which has not connection to our internal network. Source is the external IP of our wifi, destination is the VIP of the gateway.
Bill Nickerson
03/16/2020, 8:47 PMI had this all working on our watchguard firewall. But we swapped over to the Palo over the weekend. I'm wondering if I should just start from scratch and wipe the config, start over.
c
CTXMike
03/16/2020, 10:57 PMSorry, it's been crazy busy. So just to be clear, the packet trace shows client PC WAN address sending SYNs to the DMZ "inside" address of the gateway, right? And the gateway virtual server with that address is showing green/up and has an SSL cert bound?
b
Bill Nickerson
03/17/2020, 3:47 AMNo problem! Thanks for the help. That's correct, as far as I can tell.
Bill Nickerson
03/17/2020, 1:28 PM@CTXMike I was able to get the gateway website to work internally. My network guys are working on figuring out why it's not coming up on the external side. I ended up clearing the config twice before I got it to work. Thanks again for your help!
4 Views