topic Re: Cross-zone traffic with Cloudguard GWLB in Cloud Firewall

Cross-zone traffic with Cloudguard GWLB

abihsot__ — Thu, 02 Feb 2023 21:04:01 GMT

Hi there,

I deployed cloudguard R80.40 gateways in AWS using GWLB for TGW template. After reading some documentation I specifically made sure that cross-zone balancing is turned OFF and TGW attachment which contain gateways is in appliance mode.

To my surprise I noticed that traffic is hitting random gateways. Any ideas how to further troubleshoot this issue?

Re: Cross-zone traffic with Cloudguard GWLB

HeikoAnkenbrand — Fri, 03 Feb 2023 21:28:44 GMT

By Default, AWS attempts to keep a zonal affinity for traffic, meaning that traffic sourced in an AZ maintains that AZ at each hop.

To remedy this behavior and to provide maximum HA coverage for the CGNS Auto Scaling Group, Check Point recommends enabling Cross Zone Load Balancing on GWLB. This feature allows GWLB to distribute traffic across all targets in all enabled AZ’s to provide greatest HA coverage. This feature will result in incurring inter-AZ data transfer charges.

Check Point’s CloudFormation deployments for GWLB enable Cross AZ load balancing by default.

Re: Cross-zone traffic with Cloudguard GWLB

abihsot__ — Mon, 06 Feb 2023 07:27:35 GMT

Hi there,

This is very clear, however in cloudformation template you have parameter to enable/disable cross AZ balancing, where I selected "false" during initial deployment, but it still does cross AZ balancing.

CrossZoneLoadBalancing:

Description: Select 'true' to enable cross-az load balancing. NOTE! this may cause a spike in cross-az charges.

Type: String

Default: true

AllowedValues:

- true

- false