topic Management HA in Azure in Cloud Firewall

Management HA in Azure

Zia_2020 — Thu, 08 Oct 2020 01:23:16 GMT

Team - Our on-prem management server is a smart-1 appliance. It currently manages on prem firewalls as well as CloudGuard gateways. For management HA we would like to deploy it on Azure. Is this supported and if so do I use vSEC for MS Azure Stack, CloudGuard Management VM or something else. Please advise. TY

Re: Management HA in Azure

Harshpal_Bhati — Thu, 08 Oct 2020 04:34:20 GMT

If i understand correctly you are planning to migrate from on prem smart-1 to cloud management .You have to options here :

1. you can go for BYOL and you will need NGMS license . you can deploy two VM and build HA , Same as we do for open server

2. You should consider Smart-1 cloud , Which has far more benefit .

Re: Management HA in Azure

Zia_2020 — Fri, 09 Oct 2020 03:34:13 GMT

Harshpal - Thanks for your quick response. We are not looking to migrate. We already have a smart-1 mgmt. server on prem, but no backup management server. Rather then building the backup mgmt server on prem, we would like to do it on the cloud instead. So primary mgmt server will be on-prem while backup on cloud.

smart-1 cloud makes sense but cost is a factor. So we are looking for a quick solution for management HA

Re: Management HA in Azure

PhoneBoy — Fri, 09 Oct 2020 05:06:37 GMT

Nothing to suggest it's not supported: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk39345

Re: Management HA in Azure

flachance — Wed, 09 Dec 2020 14:19:16 GMT

We did this. We deployed from the Marketplace and selected CloudGuard Network Security - Firewall & Threat prevention. We then selected CheckPoint Security Management.

By default the deployment will be for a Primary Management server. So you need to change the installation type from 'Management' to 'Configure Manually'. This allows to run the first time configuration and select Secondary for the management server.

Re: Management HA in Azure

razotevsSVR — Wed, 30 Nov 2022 14:18:19 GMT

Hi, flachance,

Kind of in similar situation (Coudguard HA management). After a manual deployment and configuring from the wizard seems to be establishing trust. Following sk54160 however is not completely successful. Still Management High Availability shows "No Communication" and last time stamp with communication is the moment of the initial SIC trust establishment.

Same Vnet, Same subnet, No NSG, No Firewalls in-between, Ping from 1>>>2 and 2>>>1 successful, Latest jumbo hotfix take 79 on R81.10

Any idea what can be wrong?

Re: Management HA in Azure

flachance — Wed, 07 Dec 2022 14:30:33 GMT

NATing maybe? Take a look at sk39740 "How to configure management HA when the Primary and Secondary management servers are on separate networks"