topic Re: Cloudguard cluster interface configuration in Cloud Firewall

Cloudguard cluster interface configuration

Gongya_Yu — Mon, 03 Jun 2024 04:18:55 GMT

In the following cluster interface configuration, does eth1 pass the data traffic ?

if I have two route tables, one for eth0 and the other one for eth1. one route table for eth0 with a default route pointing to eni-eth0 and subnet association with 172.16.11.0/24, the other route table for eth1 with a default route pointing to eni-eth1 and subnet association with 172.16.10.0/24. Any issue with this ?

thanks so much !!

Re: Cloudguard cluster interface configuration

Amir_Senn — Mon, 03 Jun 2024 10:50:46 GMT

Hi,

I could answer better if you may share more details. "Leads To" writes to Azure but ENI is AWS term while in Azure we usually route to load balancer. Some of the configuration also depends on version.

In general, the default route to ENI directs all traffic to be inspected. All traffic directed at your VPC/VNET through the front end subnet will be directed to the solution. For backend, putting ENI as default for internal subnets will ensure EW inspection as well as NS.

Re: Cloudguard cluster interface configuration

Gongya_Yu — Mon, 03 Jun 2024 16:12:54 GMT

I have the following which is very close to our prod.

Right now the firewall works as one-armed.

Question 1: if the interface is defined to be sync only, does that interface still pass data traffic ?
Question 2: when is eth1-RT used ? I am wondering eth1-RT is not used here at all.

thanks a lot !!

Re: Cloudguard cluster interface configuration

Nir_Shamir — Tue, 04 Jun 2024 09:09:34 GMT

Hi,

yes , sync interfaces also pass data traffic. if they are configured as sync the the connections sync is also passing on those interfaces.

you routing configuration is not correct. you should only have one default route (towards eth0 GW). You need to delete the other default route because it will cause routing issues (traffic is spread to both interfaces).

Re: Cloudguard cluster interface configuration

Gongya_Yu — Tue, 04 Jun 2024 12:05:40 GMT

thanks a million.

This is what I like to confirm.
Even though we did not get any issue, I still like to confirm the correct way to do.

thanks again !!

Re: Cloudguard cluster interface configuration

Gongya_Yu — Tue, 04 Jun 2024 18:21:33 GMT

One more question to bother, for the cluster, still only one default route is needed ? If default route points to Member A interface for next-hop, what happens if member A fails ?

thanks a lot !!

Re: Cloudguard cluster interface configuration

Nir_Shamir — Wed, 05 Jun 2024 05:11:28 GMT

in AWS Cluster the default is pointing to the ACTIVE member of the cluster. when there's a failover happens we push out an API to AWS and change the default route to the new ACTIVE member.

Re: Cloudguard cluster interface configuration

Gongya_Yu — Wed, 05 Jun 2024 13:27:15 GMT

thanks so much !!!