2 VM series HA Setup in Azure with ELB

Dynam0 — Thu, 04 Nov 2021 23:44:33 GMT

Hi all,

I've setup 2 VM series in a sandwich topology and want to know the following in terms of the setup:

How to configure the 2 virtual routers being trust and untrust for the static routes that point to the ELB?

How to configure the NAT for outbound traffic?

What are the advantages of having a ILB, if there's no applications that require LB, then is there any advantage?

Is it still best practise to setup HA with the 2 VMs while having the ELB do the failover? I have read that the VM HA failover can take 3-10 mins because of the time it takes for the floating IP to move across.

For the 2 VM series I have them on 10.0.6 and I have also read that any versions higher HA has issues.

The main requirement is to have the secondary VM to take over when the primary is doing a firmware upgrade or any other maintenance tasks.

Thanks in advance.

Re: 2 VM series HA Setup in Azure with ELB

LAYER_8 — Fri, 05 Nov 2021 15:30:02 GMT

For the deployments I've overseen for my customers, most actually went with a dedicated deployment model (1 NGFW for egress, 1 for ingress). This is because Azure is VM-based, so spinning up a passive instance and actively shaping traffic to it does take time as noted, and no public cloud provider puts an SLA on their API calls. I've seen up to 40 minutes, before. Please see our technical documentation on this here.

The load balancer sandwich allows for horizontal scaling, if you need additional bandwidth/compute resources to scale up. For example, you could active/active an ingress pair for your requirement of "a firewall ready to move traffic during upgrades."

See our detailed template for this deployment here.

Basically you just need to add interface profiles to each untrust/trust interface allowing ping access for the health polling in Azure. Then you would write rules of 0.0.0.0/0 next hop out the untrust interface and the same for trust. In security policy you would specify which applications, users, IP addresses, etc are allowed to send what traffic where. The NAT should be handled by your external application load balancer.

topic Re: 2 VM series HA Setup in Azure with ELB in General Topics

2 VM series HA Setup in Azure with ELB

Re: 2 VM series HA Setup in Azure with ELB