CG WAF - Multiple Nano Agents HAProxy in HA – SSL Termination with Wordpress as Next-Hop vCenter8

para92 — Thu, 07 Nov 2024 17:36:16 GMT

Main Objective:

The main objective of this document is provide a brief summary of Check Point CG WAF integration with HAProxy in high availability (HA) mode and why this is needed.

Why:
To prevent a single point of failure, most products incorporate some kind of built-in feature for high availability between a primary/active device and the secondary/standby device in the event that if the primary device were to go down, the secondary/active would assume the role of the primary/active device and therefore the traffic is uninterrupted.
With respect to CG WAF, a native HA feature is not available. This might change in the future. However, depending on how you deploy CG WAF, we can achieve HA and load sharing by using virtual machine scale set (VMSS) in Azure and AWS or by using a load balancer such as HAProxy or Netscalar or any other load balancers.

In our use case that follows with HAProxy, we have demonstrated how we can achieve HA and load sharing with CG WAF.

Use Case 1 – CG WAF in HA using HAProxy as Frontend Load Balancer

Flow
Inbound/Ingress traffic is intercepted by CG WAF (multiple agents) in HA where the next hop is
a web application.

Use Case 2 - CG WAF in HA using HAProxy as Frontend Load balancer and a Backend load
balancer as the next hop.

Flow
Inbound/Ingress traffic is intercepted by CG WAF (multiple agents) in HA where the next hop is
a backend load balancer in HA and the web application.

topic CG WAF - Multiple Nano Agents HAProxy in HA – SSL Termination with Wordpress as Next-Hop vCenter8 in WAF

CG WAF - Multiple Nano Agents HAProxy in HA – SSL Termination with Wordpress as Next-Hop vCenter8