It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Campus Barracuda Campus
Barracuda CloudGen Firewall
Overview Documentation Training Certification Materials

How to Configure Route 53 for CloudGen Firewalls in AWS

  • Last updated on

If you are running multiple stacks in different AWS regions, or multiple deployments in a single region, you must configure AWS Route 53 to access your services behind the CloudGen Firewalls. Also use Route 53 if you are using UDP-based services since the Elastic Load Balancer supports only TCP connections. To always route traffic to the active firewall in the HA cluster, define two record sets with a failover policy. The record set for the first firewall is combined with a health check. As long as the health check is valid, the DNS name for the firewall is resolved to the primary firewall. When the primary firewall fails over to the secondary firewall, the health check for the primary firewall fails, and after the TTL of the DNS record has expired, the DNS name for the firewall cluster resolves to the IP address in the secondary record set. When the primary firewall is active again, the health check will again show a healthy state and the DNS record will point to the IP address of the primary firewall.

rt_53.png

Alternative

If you are not using Elastic IP addresses for your firewalls, you can also use the DNS name of the firewall for the health check and create a CNAME DNS record.

Before You Begin

Step 1. Create a Route 53 Health Check for the Primary Firewall

Configure the health check for a service running on the primary firewall, such as the VPN service. Do not create a check for box-level services because these services will not fail over to the secondary firewall.

  1. Log into the AWS console.
  2. Click Services and select Route 53.
    select_rt53.png
  3. In the left menu, click Health checks. 
  4. Click Create health check.
    route53_01.png
  5. Enter a Name.
  6. From the What to monitor list select Endpoint.
    rt53_cgf.png
  7. Configure the service to be monitored:
    • Specify and endpoint by – Select IP address.
    • Protocol – Select TCP. 
    • IP address – Enter the public IP address for the primary firewall. 
    • Port – Enter 691 to monitor the VPN service. The VPN service must be running on your firewall. Alternatively, you can also select another port on your firewall.
    route53_03.png
  8. (optional) Expand the Advanced configuration section and adjust the following settings to improve failover times:
    • Request interval – Select Fast (10 seconds). 
    • Failure threshold – Select 2.
    route53_04.png
  9. Click Next.
  10. (optional) Set Create alarm to yes and select an Existing SNS topic or create a New SNS topic to receive a notification.
    route53_05.png
  11. Click Create health check.

The health check is now active. Depending on the request interval and failover threshold, the Status of the health check changes from Unknown to Healthy. 

rt53_alm.png

Step 2. Create a Failover Record Set for the Primary Firewall

Create the DNS record for the primary firewall. Use a failover routing policy and add the health check you just created as a condition.

  1. Log into the AWS console.
  2. Click Services and select Route 53.
  3. In the left menu, click Hosted zones.
  4. Select your Domain Name and click View details.
    hz_details.png
  5. Click Create record.
    create_rec.png
  6. Create the record set:
    • Record name – Enter the DNS name.
    • Record type – Select A (IPv4 address). 
    • Alias – Set to disabled.
      hc_alias.png
    • Value – Enter the EIP or public IP address for the primary firewall.
    • TTL (seconds ) – Set the number of seconds the DNS records can be cached by non-authoritative DNS servers. 
    • Routing policy – Select Failover. 
    • Failover record type – Select Primary. 
    • Record ID – Enter a unique ID to differentiate from other failover record sets using the same name and type.
    • Health check ID – Select the health check created in Step 1.
    rec_value.png
  7. Click Create records.

The record set for the primary firewall is now listed with the other DNS records of this hosted zone.

Step 3. Create a Failover Record Set for the Secondary Firewall

Create the DNS record for the secondary firewall. Use a failover routing policy.

  1. Log into the AWS console.
  2. Click Services and select Route 53.
  3. In the left menu, click Hosted zones.
  4. Select your Domain Name and click View details.
    hz_details.png
  5. Click Create record.
    create_rec.png
  6. Create the record set:
    • Record name – Enter the DNS name you used for the primary firewall.
    • Record type – Select A (IPv4 address). 
    • Alias – Set to disabled.
      hc_alias _sec.png
    • Value – Enter the EIP or public IP address for the secondary firewall.
    • TTL (seconds ) – Set the number of seconds the DNS records can be cached by non-authoritative DNS servers. 
    • Routing policy – Select Failover. 
    • Failover record type – Select Secondary. 
    • Record ID – Enter a unique ID to differentiate from other failover record sets using the same name and type.
    • Health Check ID – Leave empty.
    rec_failover.png
  7. Click Create records.

Both record sets for the primary and secondary firewalls are now listed in the hosted zone.

route53_2.png