Both Active and Standby AWS Cloudguard reply to HTTPS probes

[reybanger]

Hello CheckMates,


I am trying to understand, why Checkpoint CloudGuard standby gateway in AWS is replying to my 443 health probes? 

My management portal has been moved from the default port to 9443, 

I have tried to configure $FWDIR/boot/modules/fwkern.conf with a cloud_balancer_port=8117 as per https://support.checkpoint.com/results/sk/sk181836 but it seems like the behavior is different than in Azure. It will actually forward the probes to the endpoint server, and as a regular webserver - it does listen to 443, not 8117. 

[_Val_]

HTTPS port on a standby GW answering probes is a normal situation. HTTPS is open in one of many scenarios, when specific blades, such as RAS VPN, Mobile access, Identity Awareness, and more, are enabled.

Why does it cause an issue for you?

[reybanger]

Thank you for replying. This is basically to avoid session issues or asymmetric traffic. IT would be nice if Checkpoint would work in a similar way like in Azure - where the traffic from LB is forwarded only to active member. 

I am looking for some options here to point traffic to my backend servers listening on 443 using load balancer in front. 

[Nir_Shamir · Accepted solution]

What kind of deployment do you exactly have ?

from what you wrote it looks like a Cluster HA and with Clusters in AWS we use the “virtual IP”  as the destination because it forwards the traffic to the ACTIVE member. 
in AWS we use LB’s only with Autoscale deployments.