CloudGuard Network for Azure VMSS Gateway Load Balancer (Public Preview) VXLAN issue
Microsoft just announced Azure Gateway Load Balancer to be in Public Preview.
Check Point published the following article about this:
Configuration steps can be found at:
This weekend I've tried to set this up. Basically the setup is almost identical to a normal CoudGuard Scale Set. The only difference is the fact that you need to forward traffic from a Azure Standard Load Balancer (ASLB) using a VXLAN tunnel to the Azure Gateway Load Balancer (AGLB). The AGLB forwards the traffic to one of your CloudGuard instances using VXLAN as well. The problem I am facing is the fact that no VXLAN interfaces are deployed in my CloudGuard instance. Documentation doesn't mention configuring these interfaces yourself.
Troubleshooting steps I took:
- tcpdump on eth0 shows UDP port 2001 coming from the AGLB. This is the VXLAN tunnel port.
- Created the external VXLAN tunnel interface using: add vxlan id 801 dev eth0 remote <AGLB_IP> dstport 2001
after this a tcpdump on interface vxlan801 immediately show my actual test traffic arriving
- Created the internal VXLAN tunnel interface using: add vxlan id 800 dev eth0 remote <AGLB_IP> dstport 2000
- The Known Limitations describe that the solution uses bridge mode. I did create a bridge group containing both the vxlan800 and vxlan801 interfaces but without any difference.
I am not sure if I am missing some steps in the deployment or if there is an issue with the Azure template.
Hopefully other CheckMates members can share their experience!
Thu 05 Oct 2023 @ 09:30 AM (IDT)Simplifying & securing your hybrid WAN with Azure Virtual WAN & Check Point