Hi all,
Microsoft just announced Azure Gateway Load Balancer to be in Public Preview.
Check Point published the following article about this:
https://blog-checkpoint-com.cdn.ampproject.org/c/s/blog.checkpoint.com/2021/11/02/check-point-cloudg...
Configuration steps can be found at:
https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_Azure_VMSS_GWLB/Content/Topics-Azure-...
This weekend I've tried to set this up. Basically the setup is almost identical to a normal CoudGuard Scale Set. The only difference is the fact that you need to forward traffic from a Azure Standard Load Balancer (ASLB) using a VXLAN tunnel to the Azure Gateway Load Balancer (AGLB). The AGLB forwards the traffic to one of your CloudGuard instances using VXLAN as well. The problem I am facing is the fact that no VXLAN interfaces are deployed in my CloudGuard instance. Documentation doesn't mention configuring these interfaces yourself.
Troubleshooting steps I took:
- tcpdump on eth0 shows UDP port 2001 coming from the AGLB. This is the VXLAN tunnel port.
- Created the external VXLAN tunnel interface using: add vxlan id 801 dev eth0 remote <AGLB_IP> dstport 2001
after this a tcpdump on interface vxlan801 immediately show my actual test traffic arriving
- Created the internal VXLAN tunnel interface using: add vxlan id 800 dev eth0 remote <AGLB_IP> dstport 2000
- The Known Limitations describe that the solution uses bridge mode. I did create a bridge group containing both the vxlan800 and vxlan801 interfaces but without any difference.
I am not sure if I am missing some steps in the deployment or if there is an issue with the Azure template.
Hopefully other CheckMates members can share their experience!
Leon
