Network

Use this network diagram to configure your system. Make sure to replace the IP addresses in the sample environment with the IP addresses in your environment.

Network Diagram

Network routing diagram.

In the diagram:

The clusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. in this diagram protects two web applications.

Each web application has:

  • Public IP address

  • Web server

  • Application server

  • Backend hosts

  • Subnets

  • Routing tables for Web and App servers

Note - Use this network diagram to configure your system. Make sure to replace the IP addresses in the sample environment with the IP addresses in your environment.

(See the Routing Tables).

Diagram Components

Check Point High Availability consists of two Cluster Members, Member 1 and Member 2. Each Cluster MemberClosed Security Gateway that is part of a cluster. has two interfaces.

When the Cluster Members are in the same Availability Set, it guarantees that the two Cluster Members are in separate fault domains. For more information, see Manage the availability of Windows Virtual Machines in Azure Stack.

Name

Attached to

Use

Member 1 public address

The external interface of Member 1
  • External management of Member 1
  • Azure Stack Hub API access

Do not disable or delete this resource. It will be tested and verified according to QA tests.

Member 2 public address

The external interface of Member 2
  • External management of Member 2
  • Azure Stack Hub API access

Do not disable or delete this resource. It will be tested and verified according to QA tests.

Web

Azure Load Balancer

Public service Web

App

Azure Load Balancer

Public service App

Use the Azure Stack Hub Load Balancer rules to forward traffic that comes from the Internet:

Important - You cannot use ports 80, 443, 444, 8082, or 8117.

Frontend IP address

Frontend TCP ports

Destination IP address

Destination port

Web

HTTPS

Active Cluster Member

8081

App

HTTP

Active Cluster Member

8083

1

Example 1

Frontend

Web:443

Backend port

8081

2

Example 2

Frontend

App:80

Backend port

8083

4

 

Destination

Nexthop

0.0.0.0/0

Active Member Internal Private Address

Routing Table for Web and App - User Defined Routes (UDR)

Web and App routing tables have the same Virtual Network address, but different subnet addresses.

5

 

 

 

Frontend

Nexthop

10.0.5.0/24

IP of the Active Member Internal Private Address

0.0.0.0/0

IP of the Active Member Internal Private Address

10.0.2.0/24

IP of the Active Member Internal Private Address

10.0.4.0/24 (Web) - Subnet address

Virtual Network

6

 

 

 

Frontend

Nexthop

10.0.4.0/24

IP of the Active Member Internal Private Address

0.0.0.0/0

IP of the Active Member Internal Private Address

10.0.2.0/24

IP of the Active Member Internal Private Address

10.0.5.0/24 (App) - Subnet address

 Virtual Network

Failover

This is what happens during cluster failover:

The Cluster Member that is promoted to Active member, uses the Azure Stack Hub API to update the route tables routes to its Internal Private IP address. This affects outbound, inbound and East-West traffic inspection.

Use Case

Expected Failover Time

Comments

Inbound inspection through the External Load Balancer

Less than 15 seconds

Depends on the Load Balancer health probe

Outbound inspection through the Active Cluster Member

Less than 8 seconds per route table

Depends on the Azure Stack Hub API

East-West inspection through the Active Cluster Member

Less than 8 seconds per route table

Depends on the Azure Stack Hub API

Traffic Flows

If the Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. is in the Virtual Network, make sure to have specific routes to allow traffic between the Management Server Virtual Machine and the Cluster Members.

Important - You cannot deploy other Virtual Machines in the Check Point solution subnets.

  1. Traffic travels into the External Load Balancer.

  2. The External Load Balancer forwards the traffic to the Active Cluster Member.

  3. The Active Cluster Member inspects the traffic, and forwards it to the destination.

  1. The traffic travels from the Web Server to the Active Cluster Member.

  2. The Active Cluster Member inspects the traffic, and forwards it to the destination.

  1. Traffic travels to Active Cluster Member based on the UDR.

  2. The Active Cluster Member inspects the traffic and forwards it to the destination.

  1. Traffic travels from one of the internal servers to the Active Cluster Member based on the UDR.

  2. The Active Cluster Member inspects the traffic and forwards the traffic to the destination.

Intra-Subnet Traffic

Traffic travels freely in the subnet without inspection.