Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
cdav
Contributor

Deploy AWS Cross-AZ Cluster without Public Addresses/EIPs

Hi CheckMates,

 

Can I deploy a cross az cluster without the public addresses. The template from CheckPoint deploys with public connectivity and this isn't necessarily a requirement for my use case as it would only be serving east/west/south traffic. I am thinking the EIP used for cluster address could be configured as any ENI and that SmartConsole does not require it for any critical functionality? Appreciate i might be corrected there 😅

Ideally the template I create would include 2 public and 2 private subnets for ingress/egress and sync. The ENIs in public subnet wont have associated public addresses (or could use 4 private subnets). Outbound connectivity can be routed via a NAT gateway in the same VPC or via transit gateway to my outbound VPC and NATed

Any help/advice will be greatly appreciated.

C

 

 

0 Kudos
5 Replies
Shay_Levin
Admin
Admin

Hi,

1. Cross az cluster will not work without public VIP.

2. With singe az cluster you have the option to use public or private.

3. If a VPN is unnecessary, I recommend using VMSS GWLB.

 

0 Kudos
cdav
Contributor

Could there be future developments to negate this requirement? Would be nice to not have to provision public endpoints when they're not required.

I have deployed a GWLB cluster to manage egress traffic - these are currently deployed with public addresses as its deployed from template but again in the process of creating my own. Assuming these can be deployed without the public addresses? 

Thanks for confirming.

0 Kudos
Roman_Kats
Employee
Employee

Hi @cdav 

Cross AZ Cluster members located in different Availability Zones, hence in different subnets.

 

Cross AZ subnets.jpg

Using private IPs only means the Cluster IP (VIP) has to be part of the subnets range belongs to both cluster members. Since subnets ranges of cluster members are completely different , there is no way to define Cluster IP.
They way  it can be achieved is to associate Elastic IP with private IP of active cluster member and move it to another member in case of failover.  

The GWLB solution can be deployed without elastic IPs, this option is available in our CFT and Terraform templates.
The GWLB solution supports East-West and North-South traffic flows
For more details refer to:
CloudGuard Network for AWS Gateway Load Balancer Auto Scale Group Deployment Guide

GWLB Workshop  - https://unrivaled-melba-1a81a6.netlify.app/

cdav
Contributor

Hi @Roman_Kats thank you for the above!

 

Yes i understand the point regarding gateways being in different azs/subnets. Are you saying there is a way to achieve to private clustering? My understanding would be:

  1. deploy cluster members with interfaces in  "public" subnet but no associated public address.
  2. create addtional eni and map to active members public eni
  3. in the event of failover construct a method for moving the eni to new active members eni
  4. still leave the "private/internal" interfaces for SYNC.

 

Regards,

C

0 Kudos
cdav
Contributor

completely misunderstood your response. Can see this isnt achievable.

Many thanks

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.