Traffic flows

North South Egress (V2I/B2I)

Traffic Flows:

  1. VNET forwards traffic to ILBClosed Internal Load Balancer, used to load balance traffic in a virtual network

  2. ILB load balances to an instance of the active-active NVAClosed Network Virtual Appliance - A resource deployed in Azure's Virtual Hub that includes Security Gateways and other networking infrastructure.

  3. NVA instance does SNATClosed Source Network Address Translation (Source NAT): from VNET private IP address to NVA NIC private IP address

    (To configure this in SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. see Step 7: Set Routing Intent and Routing Policies)

  4. Azure platform does SNAT: from NVA NIC private IP address to NVA NIC public IP address

  5. Forward the packet to the Internet

  6. Returned traffic arrives to Public NIC IP address

  7. Azure platform does SNAT: from NVA NIC public IP address to NVA NIC private IP address

  8. NVA reverses the SNAT done on step 3 and forwards the packet to VNET

North South Ingress (I2V/I2B)

Traffic Flows:

  1. Traffic arrives from Internet to SLBClosed Software Load Balancer, used to distribute tenant and tenant customer network traffic to virtual network resources. SLB enables multiple servers to host the same workload, providing high availability and scalability

  2. SLB load balances to one of the instances of the active-active NVA private NIC IP address

  3. NVA instance does SNAT: from NVA NIC private IP address to Vnet NIC private IP address

    Note: To configure the NAT in SmartConsole see Integrating CloudGuard Network Security NVA with Azure Virtual WAN > Configure NAT rules.

  4. Forward the packet to the Vnet

  5. Returned traffic arrives at the NVA private NIC IP address

  6. NVA reverses the SNAT done on step 4 and forwards the packet back to the Internet

North South (B2V)

Traffic Flows:

  1. On-premises sends traffic to Azure Gateway or SD-WANClosed Software Defined – Wide Area Network (WAN), more information on this solution: https://www.checkpoint.com/cyber-hub/network-security/what-is-sd-wan/ NVA

  2. Gateway forwards to ILB

  3. ILB sends to NVA instance 

  4. NVA sends to VNET

  5. VNET sends to ILB

  6. ILB sends to NVA instance

  7. NVA undoes SNAT and forwards to Gateway

  8. Gateway forwards back to on-premises

North South (V2B)

Traffic Flows:

  1. VNET to ILB

  2. ILB sends traffic to a Firewall instance

  3. NVA forwards to Gateway

  4. Gateway forwards to on-premises

  5. On-premises forwards to Gateway

  6. Gateway forwards to ILB

  7. ILB forwards to Firewall instance

  8. Firewall sends to VNET

East-West (V2V)

Traffic Flows:

  1. VNET1 sends traffic to ILB

  2. ILB chooses one of active-active instances

  3. NVA sends directly to destination (VNET2)

  4. VNET2 sends traffic to ILB

  5. ILB forwards traffic to appropriate NVA instance statefully

  6. NVA sends traffic back to VNET1

East-West (V2V inter-hub, both hubs with Firewall NVA)

Traffic Flows:

  1. VNET1 sends traffic to ILB

  2. ILB chooses an active NVA instance

  3. NVA sends to remote NVA ILB

  4. ILB chooses an active NVA instance

  5. NVA forwards directly to VNET 2

  6. VNET 2 sends traffic to ILB

  7. ILB sends to correct NVA instance

  8. NVA sends to remote NVA ILB

  9. ILB sends to correct NVA instance

  10. NVA forwards directly to VNET

East-West (V2V one hub with Firewall)

Traffic Flows:

  1. VNET sends traffic to ILB

  2. ILB Sends traffic to one NVA instance

  3. NVA forwards traffic to remote Router

  4. Router forwards traffic to VNET

  5. VNET forwards traffic Router

  6. Router forwards to remote ILB

  7. ILB forwards to correct NVA instance

  8. NVA sends directly to VNET

East-West (B2B)

Traffic Flows:

  1. On-premises sends traffic to Azure Gateway

  2. Gateway forwards to ILB

  3. ILB forwards to NVA instance

  4. NVA forwards to Gateway

  5. Gateway forwards to on-premises

  6. On-premises sends replies to Gateway

  7. Gateway forwards traffic to ILB

  8. ILB sends to NVA instance

  9. NVA Instance forwards to Gateway

  10. Gateway forwards to on-premises