CloudGuard Firewalls Permission- Azure

[vas]

Hi There,

I believe firewalls require 'Contributor' role in Azure HA to move the VIP of the cluster between members during a failover. 

We're planning to provision dedicated 'Inbound' firewalls to protect the workload traffic from the Internet. We don't have the permission to create a system managed identity during the template deployment, and I'm aware that service principal can be associated.

Since it doesn't need to move the VIP as they're Inbound firewalls, does it still require 'contributor' role for the failover to happen..?

[Nir_Shamir]

If you're not planning to use the VIP then it shouldn't affect the deployment.

you will only need to use the Load Balancers to route traffic to the ACTIVE member.