topic Re: Multiple Public IP for multiple server in azure behind CP FW in Cloud Firewall

Multiple Public IP for multiple server in azure behind CP FW

IgorR — Mon, 19 Oct 2020 06:21:19 GMT

Hello guys,

After successfully deploying a CloudGuard Gateway and Management I wish to publish different services with a different public IP.

TO achieve this I must get the public IP Routed to the external interfaces of the firewall (on the classic old school deployment)

In Azure, according to what I found, I should use the Load Balancer of azure.

I don't wish to use the load balancer. I wish to use the IP as an Alias or Loopback or whatever on my CP.

The question is how I am assigning the Public IP to the virtual machine of the firewall?

I've tried to create an interface and assign it to the FW.

I've changed the static NAT on the relevant object to the public IP. I am observing XLATE NAT with the PIP but actually, the server won't work. I am not getting why. Probably because the additional interfaces is different from the External one which is NATing actually the traffic.

The question also might be it is possible to assign IP to the same external interfaces which I already have? after that probably I must add an alias. but now, with such configuration when there is an additional interface, even if I am trying to configure the PIP as a Loopback it won't work 😞

Any suggestions?

p.s

NO LOAD BALANCER should be involved

Thanks

Re: Multiple Public IP for multiple server in azure behind CP FW

PhoneBoy — Tue, 20 Oct 2020 02:47:54 GMT

If you can configure Azure to route a public IP to the gateway somehow, then we can handle the NAT from there without assigning the IP to a gateway interface (loopback or otherwise).

Re: Multiple Public IP for multiple server in azure behind CP FW

Matthias_Haas — Wed, 21 Oct 2020 10:00:01 GMT

Hi Igor,

have you tried this?

https://community.checkpoint.com/t5/Cloud-Network-Security-IaaS/STATIC-NAT-in-Azure-Checkpoint/m-p/75802#M1635

Multiple secondary private/public IPs on the external Interface ?

You have to use the private IP for the Checkpoint NAT, the NAT into/from the Public IPs is done by Azure

Matthias