topic Re: CloudGuard Firewalls Permission- Azure in Cloud Firewall

CloudGuard Firewalls Permission- Azure

SriNarasimha005 — Tue, 17 Sep 2024 09:59:30 GMT

Hi There,

I believe firewalls require 'Contributor' role in Azure HA to move the VIP of the cluster between members during a failover.

We're planning to provision dedicated 'Inbound' firewalls to protect the workload traffic from the Internet. We don't have the permission to create a system managed identity during the template deployment, and I'm aware that service principal can be associated.

Since it doesn't need to move the VIP as they're Inbound firewalls, does it still require 'contributor' role for the failover to happen..?

Re: CloudGuard Firewalls Permission- Azure

Nir_Shamir — Tue, 17 Sep 2024 12:23:52 GMT

If you're not planning to use the VIP then it shouldn't affect the deployment.

you will only need to use the Load Balancers to route traffic to the ACTIVE member.

Re: CloudGuard Firewalls Permission- Azure

SriNarasimha005 — Tue, 17 Sep 2024 16:11:34 GMT

Hi @Nir_Shamir

Many thanks for the reply. As this is Inbound traffic, public IP will be created for the each traffic.

1. Since API calls happen over eth0 for failover, does it work automatically without the 'contributor' role?

2. And, do we need to leverage the Azure LB service by creating a front-end config and calling eth0 of both the firewalls as the 'back-end' pool members and add a load balancing rule for the failover to happen?

Re: CloudGuard Firewalls Permission- Azure

Nir_Shamir — Tue, 17 Sep 2024 18:21:27 GMT

you will need a contributor role for for the VIP to move between members.

we don't need the LB for failovers. the LB is used to publish application / web sites to the internet.

Re: CloudGuard Firewalls Permission- Azure

SriNarasimha005 — Wed, 18 Sep 2024 04:44:33 GMT

Hi @Nir_Shamir Mate,

Thanks for the reply. So summarize, as per my understanding, this is required only for moving the VIP between the firewalls.

The above isn't applicable in my case as I'd be using a separate public IP for each application and thus 'contributor' role isn't required and failover happen automatically without any extra privileges via eth0.

Is my understanding correct..?

Re: CloudGuard Firewalls Permission- Azure

Nir_Shamir — Wed, 18 Sep 2024 09:15:29 GMT

How are you going to use a separate Public IP per Application ?

if it's inbound , then you can use the Frontend LB and put the public IP addresses on it so you don't need the VIP.

but if it's outbound, you need to NAT the traffic outbound and this is done using the VIP.

Re: CloudGuard Firewalls Permission- Azure

SriNarasimha005 — Wed, 18 Sep 2024 15:36:30 GMT

Hi @Nir_Shamir Mate,

As this is for Inbound, we'll create a separate public IP for each application and associate it to front-end LB. Once done, it'd be tied to 'Load balancing rules' to send it to the Active firewall which would do 'DNAT' and policy evaluation. So, we'd not be using the VIP address to protect any workload/application traffic from the Internet.

Re: CloudGuard Firewalls Permission- Azure

Nir_Shamir — Thu, 19 Sep 2024 06:21:29 GMT

Ok, that will work and you won't need the VIP.

Re: CloudGuard Firewalls Permission- Azure

SriNarasimha005 — Thu, 19 Sep 2024 09:54:58 GMT

Hi @Nir_Shamir Mate,

Just a final one with regards to the outbound traffic 😊

If we've routers on the upstream which is doing NAT (and not firewall), does the CP firewall still require 'contributor' role as VIP transfer isn't required in this case by the firewall?

Re: CloudGuard Firewalls Permission- Azure

Nir_Shamir — Thu, 19 Sep 2024 09:58:28 GMT

If you have a UDR on the frontend subnet which routes the traffic to these routers and you don't do Outbound NAT on that traffic on the Firewall then you still don't use the VIP and don't need it.

with that said , I would always prefer to have a system configured as in meant to (with the role etc.) just to make it healthy is it should be by design.