CloudGuard Network for Azure VMSS Gateway Load Balancer (Public Preview) VXLAN issue

[leonfranken]

Hi all,

Microsoft just announced Azure Gateway Load Balancer to be in Public Preview.
Check Point published the following article about this:

https://blog-checkpoint-com.cdn.ampproject.org/c/s/blog.checkpoint.com/2021/11/02/check-point-cloudg...

Configuration steps can be found at: 

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_Azure_VMSS_GWLB/Content/Topics-Azure-...

This weekend I've tried to set this up. Basically the setup is almost identical to a normal CoudGuard Scale Set. The only difference is the fact that you need to forward traffic from a Azure Standard Load Balancer (ASLB) using a VXLAN tunnel to the Azure Gateway Load Balancer (AGLB). The AGLB forwards the traffic to one of your CloudGuard instances using VXLAN as well. The problem I am facing is the fact that no VXLAN interfaces are deployed in my CloudGuard instance. Documentation doesn't mention configuring these interfaces yourself.

Troubleshooting steps I took:

• tcpdump on eth0 shows UDP port 2001 coming from the AGLB. This is the VXLAN tunnel port.
• Created the external VXLAN tunnel interface using: add vxlan id 801 dev eth0 remote <AGLB_IP> dstport 2001
  after this a tcpdump on interface vxlan801 immediately show my actual test traffic arriving
• Created the internal VXLAN tunnel interface using: add vxlan id 800 dev eth0 remote <AGLB_IP> dstport 2000
• The Known Limitations describe that the solution uses bridge mode. I did create a bridge group containing both the vxlan800 and vxlan801 interfaces but without any difference.

I am not sure if I am missing some steps in the deployment or if there is an issue with the Azure template.

Hopefully other CheckMates members can share their experience!

Leon