Workflow for Setting Up a High Availability Cluster in Azure Stack

Name of the cluster object resource group.

Azure Stack subscription into which the cluster object is deployed

Location in which the cluster object is deployed

Size of each Virtual Machine instance in the cluster object

Change the Management Object private IP address with its public address:

In Gateways & Servers:

1. Select Management Server object.

2. Change the private IP address with its public IP address.

3. Click OK.

Select Wizard Mode.
The Check Point Installed Gateway Cluster wizard window opens.

In the Cluster IPv4 Address field, enter the public address of the External Load Balancer.

Note:

You can find the frontend-lb IP address in the Azure Stack portal by selecting the frontend-lb address IP address.

Click Add, and then do these steps:

1. In the Name field, enter the first Cluster Member's name.

   Example: member1

2. In the IPv4 address field:
   Enter the Cluster Member's public IP address.

3. In the Activation Key field, enter the SIC key set up in Azure.

4. In the Confirm Activation Key field, enter the SIC key again.

5. Click Initialize.
   If the Activation Key is confirmed, the Trust State field shows: Trust Established.

6. Click OK.

Click Next.
The Cluster Topology window opens.

Select Cluster Synchronization > Secondary > Next.

Configure the interfaces eth0 and eth1.

1. Select Network Management.

2. Double-click the interface eth0.
   The Network eth0 window opens.

3. From the General tab, in the Network type field, select Cluster.

4. In the Virtual IPv4 field, enter a dummy VIP address ‘0.0.0.0’ and a dummy subnet mask ‘24’ – we use dummy values because the traffic is routed with the load balancer and not with a VIP.

5. From the Network eth0 window, click Topology, and then disable the Anti-Spoofing.

6. Click OK.

7. Double-click the interface eth1.
   The Network eth1 window opens.

8. From the General tab:

   In the Network type field, select Sync.

9. From the Network eth1 window, click Topology and disable the Anti-Spoofing.

10. Click OK.

11. Select Advanced.

12. Disable Extended Cluster Anti-Spoofing.

13. Click OK.

From Expert Mode, run this command on each Cluster Member:

Notes:

• Replace <REGION> with your Azure Stack region.

• Replace <DOMAIN> with your Azure Stack domain.

In Expert mode, run this command on each Cluster Member:

In Expert mode, run this command on each Cluster Member to reload the configuration:

<Application_Name>

Example:

Web

To allow the cluster to update the necessary Azure resources on failover, the service principal must be assigned at least the following roles on these resources, or on their respective resource group:

Resource types:

• Load Balancer Public IP addresses

• External Load Balancer

• CloudGuard Virtual Machines

• Public cluster member's IP

• Virtual Network

• Any route table used by subnets in the VNET

• The network interfaces used by the Cluster Member

Click Access control (IAM) > Add.

Select your AD application.

Set the client_id and client_secret on each of the Cluster Members. In Expert mode, run this command on each Cluster Member:

Example:

Note:

To avoid shell expansion, use single quotes.

Specifies the prefix of the entire Virtual Network.

Example: 10.0.0.0/16

Double-click the Web-subnet object.

The Web-subnet object window opens.

In the Translation method field, select Hide > Hide Behind Gateway.

Click OK.

This creates the automatic NAT rules.

Go to the Azure Stack User portal https://portal

Notes:

• Replace the <REGION> with your Azure Stack region.

• Replace <DOMAIN> with your Azure Stack domain

Configure the health probe:

1. Click Health Probes, and then select Add.

2. Give the health probe a name (such as health-app-1-tcp-8081).

3. In Protocol, select TCP.

4. From Port, select 8081.

5. In the Interval, enter a health probe interval (for example, 5 seconds).

6. In the Unhealthy threshold, enter a desired value (for example, 2).

7. Click OK

Click Objects menu > More object types > Network Object > Dynamic Object > New Dynamic Object.

Click OK.

Enter this name exactly as it appears below (case-sensitive, no spaces):

LocalGatewayInternal

Go to the Azure Stack User portal https://portal.<REGION>.<DOMAIN>

Notes:

• Replace <REGION> with your Azure Stack region.

• Replace <DOMAIN> with your Azure Stack domain.

Configure the health probe:

1. Click Health Probes, and then select Add.

2. Give the health probe a name (such as health-app-2-tcp-8083).

3. In Protocol, select TCP.

4. From Port, select 8083.

5. In Interval, enter a health probe interval (for example, 5 seconds).

6. In Unhealthy threshold, enter a value (for example, 2).

7. Click OK.

Connect with SmartConsole to your Security Management Server.

Create a new TCP service to represent the External Load Balancer configuration.

You have to do this for each internal port, such as port 8081.

Do these steps:

1. Click the Objects menu > More object types > Service > New TCP.

2. Enter a descriptive name. For example: https-8081

3. In the Protocol field, select the applicable protocol (such as HTTP or HTTPS).

4. In the Port field, select Customize and enter the port number. For example: 8081.

5. Click OK.

Create a NAT rule with these values for each Azure External Load Balancer:

Rule

Rule No - 1

Original Source - All_Internet (do not use *Any)

Original Destination - LocalGatewayExternal

Original Services - The service object that represents the internal port

Translated Source - LocalGatewayInternal - right-click on this cell and select the NAT method called Hide.

Translated Destination - The Host object that represents the Internal Web Server.

Translated Services - The service object that represents the port, on which the Web server listens (for example, http).

Install On - *Policy Targets

Publish the session.