11-04-2021 04:44 PM
Hi all,
I've setup 2 VM series in a sandwich topology and want to know the following in terms of the setup:
How to configure the 2 virtual routers being trust and untrust for the static routes that point to the ELB?
How to configure the NAT for outbound traffic?
What are the advantages of having a ILB, if there's no applications that require LB, then is there any advantage?
Is it still best practise to setup HA with the 2 VMs while having the ELB do the failover? I have read that the VM HA failover can take 3-10 mins because of the time it takes for the floating IP to move across.
For the 2 VM series I have them on 10.0.6 and I have also read that any versions higher HA has issues.
The main requirement is to have the secondary VM to take over when the primary is doing a firmware upgrade or any other maintenance tasks.
Thanks in advance.
11-05-2021 08:30 AM
For the deployments I've overseen for my customers, most actually went with a dedicated deployment model (1 NGFW for egress, 1 for ingress). This is because Azure is VM-based, so spinning up a passive instance and actively shaping traffic to it does take time as noted, and no public cloud provider puts an SLA on their API calls. I've seen up to 40 minutes, before. Please see our technical documentation on this here.
The load balancer sandwich allows for horizontal scaling, if you need additional bandwidth/compute resources to scale up. For example, you could active/active an ingress pair for your requirement of "a firewall ready to move traffic during upgrades."
See our detailed template for this deployment here.
Basically you just need to add interface profiles to each untrust/trust interface allowing ping access for the health polling in Azure. Then you would write rules of 0.0.0.0/0 next hop out the untrust interface and the same for trust. In security policy you would specify which applications, users, IP addresses, etc are allowed to send what traffic where. The NAT should be handled by your external application load balancer.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
