topic Re: Cloudguard LoadBalancer question in Cloud Firewall

Cloudguard LoadBalancer question

Gongya_Yu — Thu, 13 Jun 2024 04:16:38 GMT

Almost all the videos from Youtube discuss the cloudguard deployment with load balancers. Deep-dive Workshop: CloudGuard Network Security on Azure (Canada) explains why load balancers is used.

From Marketplace, I came across a few different versions recently

1. there is an option to enable LB (unfortunately I did not screenshot it)

2. option for LB floating IP only

3. no option at all LB.

All the templates will deploy a LB by default automatically ?

Option 3 (this is the latest version I saw) deploys a LB ?

Cluster failover via API or LB are selective ?

thanks !!

Re: Cloudguard LoadBalancer question

Shay_Levin — Thu, 13 Jun 2024 08:10:34 GMT

Hi,

The High Availability template deploy External and Internal NLB.

If you are not using Ingress , you can safely delete the external load balancer post deployment.

For the VMSS , you have the option to select in the template, if you want to deploy External or Internal or Both.

Re: Cloudguard LoadBalancer question

LeonardHavekost — Thu, 13 Jun 2024 09:56:18 GMT

Cluster Failover always depends on which features / traffic flows you are using. Some are relying on API calls (e.g. for movement of Public IP addresses) and some on LB Healthprobes or both. But those are not selective.

Re: Cloudguard LoadBalancer question

Gongya_Yu — Thu, 13 Jun 2024 11:01:53 GMT

I watched your multiple videos. thanks !!
The deployment forms above related to LB are different, any reasons ?
Ingress you referred to is Northbound ? ( we do not use it)
Southbound has to use LB ? if yes. Can we still fail over via API instead of LB ?

thanks !!!

Re: Cloudguard LoadBalancer question

Gongya_Yu — Thu, 13 Jun 2024 11:08:03 GMT

We only use southbound, the deployment template always deploys LB, right ? if yes, the UDR should point to LB, not the active node, or can we selectively point to either active node or LB ?

thanks !!

Re: Cloudguard LoadBalancer question

LeonardHavekost — Thu, 13 Jun 2024 11:14:47 GMT

The route should always point to the LB IP. Can be found as well in the Deployment guide:

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_Azure_HA_Cluster/Content/Topics-Azure-HA/Workflow.htm?tocpath=Workflow%20for%20Setting%20Up%20a%20High%20Availability%20Cluster%20in%20Azure%7C_____3#Step_3__Set_Up_Internal_Subnets_and_Route_Tables

And yes the LB is always deployed as @Shay_Levin already stated. If not needed, you can also delete the Ingress LB.

Re: Cloudguard LoadBalancer question

Gongya_Yu — Thu, 13 Jun 2024 12:10:26 GMT

thanks for clarification !!