topic Re: AWS LB sandwich does not come up healthy in some cases in Cloud Firewall

AWS LB sandwich does not come up healthy in some cases

rohan_savant — Thu, 24 Oct 2019 17:59:05 GMT

we have an AWS ingress gateway auto scale group deployed. We have all routing setup between accounts using tgw.

However, and this is random, some of our External load balancers with targets as gateways do not come up healthy. this is completely random but once comes up as unhealthy it never turns healthy for that particular lb.

i am able to curl from the gateway to the internal LB and the internal LB is healthy and can be hit directly and shows the webpage.

Setup:

External lb:

Listen port 443

Target port: 9500 (doesnt come up healthy but autoprov and provisioned the rules)

Internal LB:

Listen port 443

Target port 443

TAG-: x-chkp-forwarding- https-9500-443

any idea what could be happening here? we are not doing https inspection, just passing from https traffic.

thanks

Rohan

Re: AWS LB sandwich does not come up healthy in some cases

PhoneBoy — Fri, 25 Oct 2019 04:08:29 GMT

Can you see traffic coming from the external load balanced at all?
Maybe they need to be killed and restarted?

Re: AWS LB sandwich does not come up healthy in some cases

Prabulingam_N1 — Mon, 22 Jun 2020 13:43:53 GMT

Hi Rohan,

Try the below setting on the Target groups of Firewall- Health Checks:

Protocol: HTTPS

Path: /

Port: traffic port

Healthy Threshold:2

UnHealthy Threshold:2

Timeout: 4

Internal:10

Success Codes: 200-499

This should give Firewall health check fine.

Regards, Prabu

Re: AWS LB sandwich does not come up healthy in some cases

rohan_savant — Mon, 22 Jun 2020 13:45:59 GMT

So this was a bug we faced in r80.20. the only way to solve was turn off fwaccel on r80.20 IAAS.

Re: AWS LB sandwich does not come up healthy in some cases

Prabulingam_N1 — Mon, 22 Jun 2020 13:49:09 GMT

Not tested in R80.20.

But for my customer in R80.30 have "fwaccel on" and that setting on Health Check did work.

Regards, Prabu