Azure Integration - Check Point CheckMates

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

13 Replies

Martin_Valenta

Advisor

‎2019-01-0807:24 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Why don't you search on support center or even here?

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Contributor

‎2019-01-0807:37 AM

In response to Martin_Valenta

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Thanks for the Response Martin.

I tried to find, but I couldn't get something satisfactory.

But i will try one more time

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Martin_Valenta

Advisor

‎2019-01-0807:38 AM

In response to Aman_Choubey

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

https://community.checkpoint.com/docs/DOC-3173-r8010-cloudguard-iaas-high-availability-for-microsoft...

2\ \ \ Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Contributor

‎2019-01-0809:03 AM

In response to Martin_Valenta

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Thanks for the Document, it is helpful to me.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Tommy_Forrest

Advisor

‎2019-01-0808:01 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

The guide Martin posted is good. But you'll want to pay attention to the bit about failover.

When a fail-over happens, the gateways have to notify Azure via API that this has happened and Azure has to modify your routing tables to push traffic over to the newly activated gateway. This can take 2 minutes or more. Your connections will be down while Azure is updating its route tables. The firewalls themselves will fault in about the same amount of time that you'd expect for an on-prem cluster fault to happen.

The guide makes mention of internal and external load balancers for the firewalls. Maybe it is a wording thing. But we never had internal load balancers in front (behind?) of our firewalls. There's a LB on the dirty side of the firewall and Azure's API takes care of route tables on the clean side.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Martin_Valenta

Advisor

‎2019-01-0808:04 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Yes, clustering in Azure doesn't make sense now, when there are VM scale sets, which are now also supporting all outbound ports, not just http/s.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Tommy_Forrest

Advisor

‎2019-01-0808:09 AM

In response to Martin_Valenta

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

I don't think it ever made sense, honestly. Having to deal with the API and load balancers is garbage.

1\ \ \ Kudo

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Contributor

‎2019-01-0809:00 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

thanks, Martin/Tommy for the valuable suggestion.

I was planning to use the LB on the front of both devices. Suppose the primary unit will be down, the second unit will not receive the probs from the Primary, in the case, Azure will update UDR and the traffic will terminate to the Secondary firewall.

is it correct? can I try this?

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Tommy_Forrest

Advisor

‎2019-01-0809:05 AM

In response to Aman_Choubey

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

That pretty much sums it up. It should work if you get everything setup correctly.

1\ \ \ Kudo

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Contributor

‎2019-01-0809:07 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Thanks, Tommy,

I will try this one.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

PhoneBoy

Admin

‎2019-01-0909:59 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Public Cloud networking does not support multicast or the concept that two or more systems having the same IP, both of which are required for traditional ClusterXL.

To get similar functionality, you have to use the relevant APIs to move IPs and routes around or load balancers.

Kudos

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Shane_James

Explorer

‎2019-01-1610:07 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Off the top of your head, what are the things most customers ask your support?

If you are not sure, go through your support tickets from the past month (or week, if your volume is huge). If that doesn’t give you enough information, find out what your customers are searching for by looking at your search terms in Google Analytics.

1\ \ \ Kudo

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

Robert_Peter

Explorer

‎2019-02-1209:40 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

When a fail-over happens, the gateways have to notify Azure via API that this has happened and Azure has to modify your routing tables to push traffic over to the newly activated gateway. This can take 2 minutes or more. **Your connections will be down while Azure is updating its route tables.**The firewalls themselves will fault in about the same amount of time that you'd expect for an on-prem cluster fault to happen.

Kudos