Cloudguard cluster interface configuration

[Gongya_Yu]

In the following cluster interface configuration, does eth1 pass the data traffic ?

if I have two route tables, one for eth0 and the other one for eth1. one route table for eth0 with a default route pointing to eni-eth0 and subnet association with 172.16.11.0/24, the other route table for eth1 with a default route pointing to eni-eth1 and subnet association with 172.16.10.0/24. Any issue with this ?

thanks so much !!

[Amir_Senn]

Hi,

I could answer better if you may share more details. "Leads To" writes to Azure but ENI is AWS term while in Azure we usually route to load balancer. Some of the configuration also depends on version.

In general, the default route to ENI directs all traffic to be inspected. All traffic directed at your VPC/VNET through the front end subnet will be directed to the solution. For backend, putting ENI as default for internal subnets will ensure EW inspection as well as NS.

[Gongya_Yu]

I have the following which is very close to our prod.

Right now the firewall works as one-armed.

Question 1: if the interface is defined to be sync only, does that interface still pass data traffic ?
Question 2: when is eth1-RT used ?  I am wondering eth1-RT is not used here at all.

thanks a lot !!

[Nir_Shamir · Accepted solution]

Hi,

yes , sync interfaces also pass data traffic. if they are configured as sync the the connections sync is also passing on those interfaces.

you routing configuration is not correct. you should only have one default route (towards eth0 GW). You need to delete the other default route because it will cause routing issues (traffic is spread to both interfaces).

[Gongya_Yu]

thanks a million.

This is what I like to confirm. 
Even though we did not get any issue, I still like to confirm the correct way to do.  

thanks again !!

[Gongya_Yu]

One more question to bother, for the cluster, still only one default route is needed ? If default route points to Member A interface for next-hop, what happens if member A fails ?

thanks a lot !!

[Nir_Shamir · Accepted solution]

in AWS Cluster the default is pointing to the ACTIVE member of the cluster. when there's a failover happens we push out an API to AWS and change the default route to the new ACTIVE member.

[Gongya_Yu]

thanks so much !!!