topic CloudGuard AWS - Multiple Public IPs in Cloud Firewall

CloudGuard AWS - Multiple Public IPs

Gusa2727 — Fri, 09 Jun 2023 11:28:31 GMT

In a Active/Passive HA environment, how do you manage adding multiple public IPs to the cluster? Do I have to create one Network Load Balancer per EIP (due to the one EIP per NLB limitation), or is there a way of assigning the EIPs to the active EC2 instance directly, and these EIPs move to the Secondary node when a failver is detected (FortiGate HA works in this way)?. Thank you.

Re: CloudGuard AWS - Multiple Public IPs

PhoneBoy — Fri, 09 Jun 2023 22:28:37 GMT

Our clustering only supports a single IP per virtual interface.
I believe this limitation applies in public cloud as well.
Which means you'll probably need to do this with NLBs.

Re: CloudGuard AWS - Multiple Public IPs

Nir_Shamir — Sun, 11 Jun 2023 05:39:46 GMT

Our VIP is used as a secondary IP on the ACTIVE member eth0 interface so you can add another "secondary IP" the the ACTIVE member eth0 and attach a new Public IP to it.

It will move between the members , depending who is the ACTIVE one.

Re: CloudGuard AWS - Multiple Public IPs

Gusa2727 — Sun, 11 Jun 2023 08:10:28 GMT

So, I can add multiple secondary IP on front/outside interface (as much as supported by the instance size), and all these secondary Interface will move to the secondary node in the event of failover, right? if yes, does this apply also to other Cloud Providers like Azure and GCP?

I know that we have the External Load Balancer in Azure, which supports multiple FrontEnd IPs, but we need to open multiple ports on the External Load Balancer (LB rules), which increase a lot the cost.

Thanks!

Re: CloudGuard AWS - Multiple Public IPs

Nir_Shamir — Sun, 11 Jun 2023 09:05:31 GMT

You can in Azure (depending on your Image version and you need to modify a configuration file in the GW according to the admin guide - https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_IaaS_HighAvailability_for_Azure/Content/Topics-Azure-HA/Workflow-for-Setting-Up-a-High-Availability-Cluster-in-Azure.htm?tocpath=Workflow%20for%20Setting%20Up%20a%20High%20Availability%20Cluster%20in%20Azure%7C_____0#Step_11__Configure_multiple_VIP_(optional))

in GCP it's not supported.