topic Re: AWS ALB/ALB Sandwich - issue with target group showing firewalls unhealthy (http - 80) in VM-Series in the Public Cloud

AWS ALB/ALB Sandwich - issue with target group showing firewalls unhealthy (http - 80)

SatishNair — Wed, 27 Nov 2019 00:38:08 GMT

Configuration in AWS
External ALB -> VM-series 300 (in 2 AZ) -> Internal ALB ->webserver
The target group of the external ALB shows unhealthy for port http/80

External NLB ->VM-series 300 (in 2 AZ)-> Internal NLB -> webserver
The target group of the external NLB shows healthy for port tcp/80 consistently

Why is the external ALB target group showing unhealthy ? randomly it goes healthy and then toggles

Security Groups are open to all on the untrusted interface.

Re: AWS ALB/ALB Sandwich - issue with target group showing firewalls unhealthy (http - 80)

jmeurer — Wed, 27 Nov 2019 01:09:55 GMT

Watch your routes on the firewall. The ALB fires its health probes cross zone. If you are using DHCP on your interfaces, ensure that only your Untrust interface is configured to import the Default route. You will then want to put a static route for any internal subnets that are not directly connected to your Trust interface subnet pointing to the first IP of your trust subnet.

Additionally, change your management interface a static DNS server set to the second IP address of the VPC CIDR. We had an issue in older versions of 8.1 where we were not importing the DHCP assigned DNS server.

Re: AWS ALB/ALB Sandwich - issue with target group showing firewalls unhealthy (http - 80)

SatishNair — Wed, 27 Nov 2019 04:00:10 GMT

The addresses are static and the default routes are correct. We use the transit gateway to connect to other accounts. In addition using an NLB in a sandwich mode works without issues.

Re: AWS ALB/ALB Sandwich - issue with target group showing firewalls unhealthy (http - 80)

jmeurer — Wed, 27 Nov 2019 04:15:15 GMT

Are you using FQDN DNAT objects for NLB and ALB? ALB IP addresses change more frequently which is why I mention the static configuration of the DNS servers. Feel free to post your Route Table from the firewall for review.