Create a Post
Showing results for 
Search instead for 
Did you mean: 

CloudGuard Network for Azure VMSS Gateway Load Balancer (Public Preview) VXLAN issue

Hi all,

Microsoft just announced Azure Gateway Load Balancer to be in Public Preview.
Check Point published the following article about this:

Configuration steps can be found at:

This weekend I've tried to set this up. Basically the setup is almost identical to a normal CoudGuard Scale Set. The only difference is the fact that you need to forward traffic from a Azure Standard Load Balancer (ASLB) using a VXLAN tunnel to the Azure Gateway Load Balancer (AGLB). The AGLB forwards the traffic to one of your CloudGuard instances using VXLAN as well. The problem I am facing is the fact that no VXLAN interfaces are deployed in my CloudGuard instance. Documentation doesn't mention configuring these interfaces yourself.

Troubleshooting steps I took:

  • tcpdump on eth0 shows UDP port 2001 coming from the AGLB. This is the VXLAN tunnel port.
  • Created the external VXLAN tunnel interface using: add vxlan id 801 dev eth0 remote <AGLB_IP> dstport 2001
    after this a tcpdump on interface vxlan801 immediately show my actual test traffic arriving
  • Created the internal VXLAN tunnel interface using: add vxlan id 800 dev eth0 remote <AGLB_IP> dstport 2000
  • The Known Limitations describe that the solution uses bridge mode. I did create a bridge group containing both the vxlan800 and vxlan801 interfaces but without any difference.

I am not sure if I am missing some steps in the deployment or if there is an issue with the Azure template.

Hopefully other CheckMates members can share their experience!



0 Kudos
10 Replies
This widget could not be displayed.


Epsum factorial non deposit quid pro quo hic escorol.