topic Re: Unable to access Azure cluster standby gateway via VPN in Cloud Firewall

Unable to access Azure cluster standby gateway via VPN

heavysoul — Mon, 08 Mar 2021 12:48:43 GMT

Hi Guys

I appreciate I'm probably missing something simple, but I'm unable to access a standby gateway (R80.30) from my on-prem management server (R80.30), via IPSec S2S VPN

mgt svr > on-prem primary gateway (R80.20) > vpn > azure primary gateway > azure standby gateway

Can't SSH or browse to GAIA portal

I can see traffic tcpdump reaching azure primary gateway, but nothing coming back from azure standby gateway

Tried 'fw ctl zdebug drop' on azure primary gateway - no output

Could someone please assist me?

Many thanks in advance

Re: Unable to access Azure cluster standby gateway via VPN

the_rock — Mon, 08 Mar 2021 13:58:44 GMT

What does traceroute show, where exactly is it failing? If you did zdebug on primary and you dont see anything for that specific IP, then its possible that route is missing.

Andy

Re: Unable to access Azure cluster standby gateway via VPN

dd84 — Mon, 08 Mar 2021 19:39:19 GMT

I forget where it is, but there is an SK that outlines this. Its basically a ClusterXL limitation/feature :P.

Re: Unable to access Azure cluster standby gateway via VPN

Henrik_Noerr1 — Tue, 09 Mar 2021 19:51:14 GMT

I agree with dd84 - this is not supported. So no possibility for radius auth to on prem servers either.

We access the primary and secondary node over the public ip addresses given. VPN only used for application traffic.

Re: Unable to access Azure cluster standby gateway via VPN

vinceneil666 — Wed, 10 Mar 2021 11:51:03 GMT

Could we get some kind of workaround utilizing a loopback interface on each of the nodes ? Grabbing som ip's that is transported in the VPN and the doing a UDR for those in specific ? (I have never tested this myself)

Re: Unable to access Azure cluster standby gateway via VPN

Douglas_Rich — Tue, 30 Aug 2022 20:41:38 GMT

Is this, inability to access standby member over S2S VPN, still a limitation with R81.10 JHF Take_66?