It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Campus Barracuda Campus
Barracuda CloudGen Firewall
Overview Documentation Training Certification Materials

Active-Active High-Performance Setup with Symmetric Load Balancing

  • Last updated on

The following example explains Azure active-active deployment with symmetric load balancing and User Defined Routing (UDR). With this setup, all traffic coming from the virtual networks hits the load balancer and will be distributed to the firewall units according to the rules configured in the template. Traffic from the firewalls, in turn, back to the networks does not require any translation and is processed by the firewall rules and therefore sent back to the correct recipient.

az_vmss_symmetric-01.png

Azure active-active performance deployment with symmetric load balancing provides the following advantages:

  • Integrates well with network infrastructures using UDR and Azure Express Route

  • Does not require NAT

  • Extremely straightforward (add VMs to the backend pool, no other modifications required)

The CloudGen Firewall configuration in Microsoft Azure supports repositories, conf templates, and the distributed firewall. For more information, see Repositories, Distributed Firewall and How to Work with Configuration Templates on Different Levels in the Configuration Tree.

Before You Begin

Before proceeding with deploying the Barracuda CloudGen Firewall HA template, make sure that your network infrastructure meets the service requirements listed in CloudGen Firewall Active-Active Performance in Microsoft Azure.

The following steps and screenshots serve as an example related to the network setup diagram at the top. It is important that you understand the core aspects of the example below. Because certain user interface elements are from time to time relocated in Azure to other places in the user interface structure, some key navigation items like tabs could become positioned at other places as displayed in the following screenshots.

In this case, inspect the changes of the Azure user interface and find the “missing” items. A different location does not always mean that the functional logic has also changed.

The following preparatory steps will therefore serve as a guideline for understanding how to configure a setup regardless of the location of the related navigation items in the UI:

  • Creating resource groups

  • Creating a storage account

  • Creating a virtual network (VNET) and subnet(s)

  • Deploying a virtual CGF from an image

For more information, see How to Create a Resource Network in Azure.

Note that the load balancer does the routing. Therefore, it is NOT necessary to perform Src-NAT on the internal networks!

Preparatory Steps

The following steps are illustrated only by their resulting screenshots from Azure management panel.

Create Resource Groups

Configure the following fields:

  • Name

  • Location

  • Location ID

  • Resource ID

  • Subscription

azure_create_resource_group.png
Create a Virtual Network

Configure the fields for the properties of your virtual network:

  • Name

  • Location

  • Resource Group

azure_configure_virtnet_props.png

Configure the Address space of your virtual network:

  • Address space

azure_configure_address_space.png

Configure the Subnets:

  • Subnets

azure_configure_subnets.png

After configuring the basic resources, it is now time for creating a Virtual Machine Scale Set. The configured basic resources from above will be used in the following configuration steps.

1. Create a Virtual Machine Scale Set

Step 1. Click Basic to Configure a Barracuda Virtual Machine Scale Set
azure_configure_virt_machine_scale_set.png

Step 2. Scroll Down and Configure Scaling
azure_configure_virt_machine_scaling.png

Step 3. (optional) Click Next:Spot> to Deploy the Virtual Machine as a Sport Instance

The Spot VM option allows customers to buy the VM from a pool of unused spare capacity at a lower price than a pay-as-you-go option. However, this lower price comes with the drawback that such spot instances can be taken away without any major warning if the capacity is needed elsewhere. Therefore, it is recommended to not use this option.

If you want to use this spot even though, configure it according to the screenshot below.

azure_deploy_vm_as_spot_instance.png
Step 4. Click and Set up Disks according to Your Requirements

azure_configure_disks.png

Step 5. Click and Configure Networking

  • Enter the name for your Virtual Network

azure_create_virtual_network.png

  • Click '+' to configure the Network Interface

    • Enter the network address for your subnet.

    • Select Basic for your NIC network security group.

    • Enter the name for your subnet, e.g., CGF-Subnet (10.10.1.0/24)

    • Select None for Public Inbound Ports.

    • Select Enabled for Publish IP Address.

    • Select Enabled for Accelerated Networking.

azure_configure_nic.png

  • Repeat the previous sub steps for any additionally required network interface.

Step 6. Click the Management tab to Configure Settings for Managing the Setup

  • Configure the following options according to the screenshot below:

azure_configure_management_settings.png
Step 7. Click and Configure Advanced settings
azure_configure_advanced_settings_1_2.pngazure_configure_advanced_settings_2_2.png
Step 8. Click Review + Create to Review the Configuration
azure_review_configuration.png

After completing the configuration of all required settings, click Create.

2. Virtual Machine Scale Set - Post Deployment Steps

  • Open the Virtual Machine Scale Set:

azure_open_virtual_machine_scale_set.png

  • Select the Network Security Group and add Inbound Rules:

azure_add_inbound_rules.png

  • Go back to the Resource Group and check the Network Interface(s):

azure_check_network_interfaces.png

  • Enable IP Forwarding:

azure_enable_ip_forwarding.png

3. Create an Internal Load Balancer

  • Enter the required data to configure the internal load balancer:

    • Subscription – Select your subscription from the list.

    • Resource Group – Select your resource group from the list.

    • Name – Enter a name for your load balancer.

    • Region – Select the region from the list.

    • SKU – Select Standard.

    • Type – Select Internal

    • Tier – Regional

azure_create_load_balancer.png

  • Click Next: Frontend IP configuration.

  • Enter the required data to configure the frontend IP address:

    • Subnet – Select the specific subnet from the list.

    • Assignment – Select Static.

    • IP address – e.g., 10.10.1.6

    • Availability zone – Select Zone-redundant from the list.

azure_configure_frontend_ip.png

  • Click NEXT: Backend Pools

azure_overview_backend_pool.png

  • Click Save

azure_overview_load_balancer_with_backend_pools.png

  • Click NEXT: Inbound rules

  • Enter the required data to configure the inbound rules:

    • IP Version – Select IPv4.

    • Frontend IP address – Select the required frontend IP address from the list.

    • Backend pool – Select the required backend pool from the list.

    • Select High availability ports.

    • Health probe – Select TCP 65000 from the list.

    • Idle timeout (miunutes) – select 4 from the list.

azure_configure_inbound_rules.png

  • Click NEXT: Outbound rules

  • Click NEXT: Tags

  • Click NEXT: Review + create

azure_configure_review_create_overview.png

  • Check that all settings correspond with your requirements.

    • If you want to change a specific setting, navigate back to the related configuration template by clicking < Previous.

  • Click NEXT: Create

4. Create a User Defined Route Table

  • Locate and click the label Create Route Table.

When you create a user defined route table, it is not necessary to modify the routing information on the CGF.

azure_configure_overview_create_route_table.png

  • Click Review + create

azure_configure_create_route_table_summary_basics.png

  • Click Create

  • Add a default route and routes to all internal subnets:

azure_configure_default_route.png

  • Add all internal subnets to be routed over the CGF:

azure_configure_add_all_internal_subnets_being_routed.png

  • This screenshot shows an example related to the diagram at the top of this article:

azure_review_routes_and_subnets.png

Step 5. Add the Firewall Instances to the Control Center

Add the CloudGen Firewall instances created with the Firewall VM scale set to the Control Center. For more information on managed firewalls, please refer to How to Import an Existing CloudGen Firewall into a Control Center.

Create a cluster- / range-level repository for the linked configuration management. For more information, see Repositories.

Licenses that are already installed on PAYG firewall instances are pushed to the Control Center before retrieving the PAR file. Firewalls using the BYOL images use the licenses configured on the Control Center.

Step 6. Set Up Rules and Repositories, and Link Them to Your Firewall Scale Set

Verify that the predefined cloud access rules are enabled and using a dynamic objects or a loopback address.

  1. On the Control Center, go to Configuration Tree > your Range > your Cluster > your Box > Assigned Services > Firewall.

  2. Right-click Forwarding Rules and select Copy to Cluster repository.

  3. Provide a Name and copy the node.

  4. Open the created repository.

  5. Click Lock.

  6. Add an App Redirect Rule rule for load balancing heath check.

    • Source – Select Any.

    • Services – Add 65000 TCP

    • Destination – Select DHCP1 Local IP.

    • Redirection – Enter 127.0.0.1:450

lb_redir.png

  1. Add a Dst NAT rule to access the back-end server:

    • Source – Select Any.

    • Services – Add the ports for required services.

    • Destination – Select DHCP1 Local IP.

    • Redirection – Enter the IP address of your back-end server.

    • Connection Method – select Original Source IP.

bs_dnat.png

  1. Click OK.

  2. Click Send Changes.

  3. Close the repository window.

  4. Right-click on the firewall repository and select Multiple Object Action.

  5. Select all firewall instances for the corresponding scale set.

link_objects.png

  1. Select Link To repository > Go.

  2. Click OK.

  3. Click Activate.

Step 7. Verify the Setup

Your Barracuda CloudGen Firewall instances are now fully integrated in the Azure cloud and communicate with the load balancer that processes traffic from and to your subnets. To verify that your CloudGen Firewalls are up and running, go to Firewall > Live. The traffic details for your CloudGen Firewalls should be listed with the configured rules.

  • All instances from subnets associated with the route table should be able to reach the ILB Front IP.

  • All instances from subnets associated with the route table should be able to reach the back-end services.

Next Steps

You can now configure your routing rules on the CloudGen Firewalls according to individual requirements.