topic Re: Management HA over VPN in Firewall & Security Management

Management HA over VPN

flachance — Mon, 21 Sep 2020 19:59:58 GMT

Hi,

R80.30. Can you set up Management HA if the management servers are on different sites and communications goes over VPN.

It seems the traffic between the two management server hits the implied rules and doesn't get encrypted.

thanks

Francis

Re: Management HA over VPN

PhoneBoy — Wed, 23 Sep 2020 22:15:56 GMT

Management traffic itself is encrypted already.
Excluding management traffic from implied rules is NOT recommended.
See this thread and the linked discussion: https://community.checkpoint.com/t5/General-Management-Topics/Managing-a-gateway-over-VPN/m-p/13674#M2423

Re: Management HA over VPN

flachance — Fri, 16 Oct 2020 15:35:04 GMT

thanks. I guess the solution would be to follow this sk https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk39740

My only issue is that the management HA is in Azure behind a CloudGuard cluster and I just can't figure out how to properly do the NATing on that side. Anyone knows of Guides or Docs to do that?

Re: Management HA over VPN

PhoneBoy — Fri, 16 Oct 2020 20:09:50 GMT

Are you defining the object for the HA management in terms of the NAT address?

Re: Management HA over VPN

flachance — Wed, 21 Oct 2020 13:24:03 GMT

Not sure I understand your question.

For the management HA Properties- General tab I used the private address. In the NAT tab I assigned a static NAT with the external IP of the management HA (did not apply to Security Gateway control connections)

I created an object representing the NATed IP of the management HA.

I created Manual Static NAT rules for communication between NATed (external) IP addresses of Management servers.

For the NATing of the management HA, I’ve tried using the Public IP assigned to the management HA by Azure. I also tried using the public IP of the frontend load balancer and adding a load balancing rule. I also tried assigning a second public IP to the load balancer and Used this IP for NATing (along with a load balancing rule).

None of these worked. Although I can see the properly NATed connections leaving the gateways that protect the active management server I never see anything at all reaching the Cloudguard Gateway.

Looking at the Effective Security Rules for the Management HA interface, I don’t see any issues with the NSG. I think I’m missing something on the Azure side of things but haven’t been able to find it.