topic Azure CloudGuard laaS Cluster and BGP question! in Cloud Firewall

Azure CloudGuard laaS Cluster and BGP question!

HeikoAnkenbrand — Sun, 16 Feb 2020 15:55:37 GMT

Hi Check Point guys,

I have an R80.30 Azure Cluster installation. So far everything works 🙂

Now the question appeared whether the firewall cluster can be connected via BGP (not via VPN) using VeloCloud. Because there is always a frontend or backend load balancer for a cluster instance, I am not sure how to implement this. In the manuals and in the knowledge base I didn't find anything about this topic.

Now my question:

- Is BGP supported (without VPN) on a CloudGuard laaS cluster?
- Where can I find more information for Azure cluster and BGP via VeloCloud integration?
- Do you have an example integration paper.

Re: Azure CloudGuard laaS Cluster and BGP question!

PhoneBoy — Sun, 16 Feb 2020 20:06:36 GMT

I guess I'm not clear what benefit BGP would bring in this case if there's no VPN involved.

Re: Azure CloudGuard laaS Cluster and BGP question!

HeikoAnkenbrand — Sun, 16 Feb 2020 20:15:56 GMT

VeloCloud is to be connected via two gateways in two zones to connect the azure with the customer network. If one check point gateway fails, the other one shall be used. Routing shall be ensured by BGP.

Re: Azure CloudGuard laaS Cluster and BGP question!

HeikoAnkenbrand — Mon, 17 Feb 2020 20:08:26 GMT

Hi @PhoneBoy,

do you have any idea who from Check Point can help in this case?

Regards

Heiko

Re: Azure CloudGuard laaS Cluster and BGP question!

PhoneBoy — Wed, 19 Feb 2020 01:00:22 GMT

I did a little bit of looking around internally and it seems someone has done exactly this.
I've found a doc for the Check Point side of this, at least, which I'll see if we can share.

Re: Azure CloudGuard laaS Cluster and BGP question!

Networks_Team_B — Mon, 01 Jun 2020 20:51:22 GMT

We are looking to do the same thing integrating VeloCloud in Azure with a Checkpoint.

Is it possible for us to also see the documentation for this?

Thanks for your help

Re: Azure CloudGuard laaS Cluster and BGP question!

nullform — Wed, 24 Jun 2020 14:10:52 GMT

Hi,

I'm doing something similar with other vendors as well. Its quite fun setup, maybe we can setup a knowledge exchange on this topic. It's still in PoC but its working quite stable.

Re: Azure CloudGuard laaS Cluster and BGP question!

mattoddy1 — Tue, 28 Sep 2021 11:44:30 GMT

Hi, @PhoneBoy - did you ever manage to dig the documentation out for this?

I've got a requirement to integrate two virtual VMware SD-WAN Edges with two ClusterXL CheckPoints. The SD-WAN Edges must be able to advertise their local routes to the active Check Point via BGP.

Is there any information on how we can use internal load-balancers to achieve this?

Thanks.

Re: Azure CloudGuard laaS Cluster and BGP question!

PhoneBoy — Tue, 28 Sep 2021 19:17:21 GMT

For the use case in this thread, I don't believe we formalized the documentation and am not sure of the status of this.
The official integrations we have with VeloCloud are:

Re: Azure CloudGuard laaS Cluster and BGP question!

Scottc98 — Fri, 17 Mar 2023 19:36:52 GMT

I'd love to bump this up to see if there are any updates on an official guide or one that is working today.

I understand using BGP to advertise the routes between the Azure Velo Edge and the Checkpoint Azure cluster.....what I can't seem to get around is how there wouldn't be an impact if the checkpoint cluster failed over. Its my understanding that without either graceful restart or C-bit here (REF: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175923), BGP is going to bounce upon a cluster failover. Last I checked on the VeloCloud side, they haven't supported graceful restart until 5.1.0 or later code (which is fairly resent).

Is that the case? If there a graceful restart requirement for an Azure cluster as it shows in the SK for a clusterXL setup overall, is graceful restart supported in Azure (i.e via Azure vWAN or Azure route service [ARS])?