CloudGuard Firewalls Permission- Azure

[SriNarasimha005]

Hi There,

I believe firewalls require 'Contributor' role in Azure HA to move the VIP of the cluster between members during a failover. 

We're planning to provision dedicated 'Inbound' firewalls to protect the workload traffic from the Internet. We don't have the permission to create a system managed identity during the template deployment, and I'm aware that service principal can be associated.

Since it doesn't need to move the VIP as they're Inbound firewalls, does it still require 'contributor' role for the failover to happen..?

[Nir_Shamir · Accepted solution]

If you're not planning to use the VIP then it shouldn't affect the deployment.

you will only need to use the Load Balancers to route traffic to the ACTIVE member.

[SriNarasimha005]

Hi @Nir_Shamir 

Many thanks for the reply. As this is Inbound traffic, public IP will be created for the each traffic.

1. Since API calls happen over eth0 for failover, does it work automatically without the 'contributor' role?

2. And, do we need to leverage the Azure LB service by creating a front-end config and calling eth0 of both the firewalls as the 'back-end' pool members and add a load balancing rule for the failover to happen?

[Nir_Shamir]

you will need a contributor role for for the VIP to move between members.

we don't need the LB for failovers. the LB is used to publish application / web sites to the internet.

[SriNarasimha005]

Hi @Nir_Shamir Mate,

Thanks for the reply. So summarize, as per my understanding, this is required only for moving the VIP between the firewalls.

The above isn't applicable in my case as I'd be using a separate public IP for each application and thus 'contributor' role isn't required and failover happen automatically without any extra privileges via eth0.

Is my understanding correct..?

[Nir_Shamir]

How are you going to use a separate Public IP per Application ?

if it's inbound , then you can use the Frontend LB and put the public IP addresses on it so you don't need the VIP.

but if it's outbound, you need to NAT the traffic outbound and this is done using the VIP.

[SriNarasimha005]

Hi @Nir_Shamir  Mate,

As this is for Inbound, we'll create a separate public IP for each application and associate it to front-end LB. Once done, it'd be tied to 'Load balancing rules' to send it to the Active firewall which would do 'DNAT' and policy evaluation. So, we'd not be using the VIP address to protect any workload/application traffic from the Internet.

[Nir_Shamir]

Ok, that will work and you won't need the VIP.

[SriNarasimha005]

Hi @Nir_Shamir Mate,

Just a final one with regards to the outbound traffic 😊

If we've routers on the upstream which is doing NAT (and not firewall), does the CP firewall still require 'contributor' role as VIP transfer isn't required in this case by the firewall?

[Nir_Shamir]

If you have a UDR on the frontend subnet which routes the traffic to these routers and you don't do Outbound NAT on that traffic on the Firewall then you still don't use the VIP and don't need it.

with that said , I would always prefer to have a system configured as in meant to (with the role etc.) just to make it healthy is it should be by design.