Network

Use this network diagram to configure your system. Make sure to replace the IP addresses in the sample environment with the IP addresses in your environment.

Network Diagram

Network routing diagram.

In the diagram:

The cluster in this diagram protects two web applications.

Each web application has:

  • Public IP address

  • Web server

  • Application server

  • Backend hosts

  • Subnets

  • Routing tables for Web and App servers

Note - Use this network diagram to configure your system. Make sure to replace the IP addresses in the sample environment with the IP addresses in your environment.

(See the Routing Tables).

Diagram Components

  • Virtual Network in Azure Stack that is divided into four subnets

  • Frontend

  • Backend

  • Web

  • App

Check Point High Availability consists of two Cluster Members, Member 1 and Member 2. Each Cluster Member has two interfaces.

When the Cluster Members are in the same Availability Set, it guarantees that the two Cluster Members are in separate fault domains. For more information, see Manage the availability of Windows Virtual Machines in Azure Stack.

Name

Attached to

Use

Member 1 public address

The external interface of Member 1
  • External management of Member 1
  • Azure Stack API access

Do not disable or delete this resource. It will be tested and verified according to QA tests.

Member 2 public address

The external interface of Member 2
  • External management of Member 2
  • Azure Stack API access

Do not disable or delete this resource. It will be tested and verified according to QA tests.

Web

Azure Load Balancer

Public service Web

App

Azure Load Balancer

Public service App

Use the Azure Stack Load Balancer rules to forward traffic that comes from the Internet:

Important - You cannot use ports 80, 443, 444, 8082, or 8117.

Frontend IP address

Frontend TCP ports

Destination IP address

Destination port

Web

HTTPS

Active Cluster Member

8081

App

HTTP

Active Cluster Member

8083

1

Example 1

Frontend

Web:443

Backend port

8081

2

Example 2

Frontend

App:80

Backend port

8083

4

 

Destination

Nexthop

0.0.0.0/0

Active Member Internal Private Address

Routing Table for Web and App - User Defined Routes (UDR)

Web and App routing tables have the same Virtual Network address, but different subnet addresses.

5

 

 

 

Frontend

Nexthop

10.0.5.0/24

IP of the Active Member Internal Private Address

0.0.0.0/0

IP of the Active Member Internal Private Address

10.0.2.0/24

IP of the Active Member Internal Private Address

10.0.4.0/24 (Web) - Subnet address

Virtual Network

6

 

 

 

Frontend

Nexthop

10.0.4.0/24

IP of the Active Member Internal Private Address

0.0.0.0/0

IP of the Active Member Internal Private Address

10.0.2.0/24

IP of the Active Member Internal Private Address

10.0.5.0/24 (App) - Subnet address

 Virtual Network

Failover

This is what happens during cluster failover:

The Cluster Member that is promoted to Active member, uses the Azure Stack API to update the route tables routes to its Internal Private IP address. This affects outbound, inbound and East-West traffic inspection.

Use Case

Expected Failover Time

Comments

Inbound inspection through the External Load Balancer

Less than 15 seconds

Depends on the Load Balancer health probe

Outbound inspection through the Active Cluster Member

Less than 8 seconds per route table

Depends on the Azure Stack API

East-West inspection through the Active Cluster Member

Less than 8 seconds per route table

Depends on the Azure Stack API

Traffic Flows

If the Management Server is in the Virtual Network, make sure to have specific routes to allow traffic between the Management Server Virtual Machine and the Cluster Members.

Important - You cannot deploy other Virtual Machines in the Check Point solution subnets.

  1. Traffic travels into the External Load Balancer.

  2. The External Load Balancer forwards the traffic to the Active Cluster Member.

  3. The Active Cluster Member inspects the traffic, and forwards it to the destination.

  1. The traffic travels from the Web Server to the Active Cluster Member.

  2. The Active Cluster Member inspects the traffic, and forwards it to the destination.

  1. Traffic travels to Active Cluster Member based on the UDR.

  2. The Active Cluster Member inspects the traffic and forwards it to the destination.

  1. Traffic travels from one of the internal servers to the Active Cluster Member based on the UDR.

  2. The Active Cluster Member inspects the traffic and forwards the traffic to the destination.

Intra-Subnet Traffic

Traffic travels freely in the subnet without inspection.