How to Configure a High Availability Cluster in Azure via Web Portal and ASM

Transcription

1 How to Configure a High Availability Cluster in Azure via Web Portal and ASM To safeguard against hardware and software failures in the Azure cloud, use a high availability (HA) setup. The Barracuda NextGen Firewall F-Series units are deployed in an Azure availability set in a cloud service in order to guarantee that both virtual machines are running in different fault domains in the Azure datacenter. Both systems are connected to the same Azure virtual network and use static internal IP addresses (DIPs). An Azure load-balanced endpoint (level 4 load balancer) can be used to offer TCP- and UDP-based services on the VIP. For the backend servers to use the F-Series Firewall as the default gateway, Azure User Defined Routing must be configured. When a failover occurs the F-Series Firewall changes the default route of the backend subnets to use the F-Series Firewall the virtual server is running on. This removes the requirement for the Azure Connectivity Agent. Azure (Load-balanced) Endpoints can only be used for TCP/UDP-based services. All other IP protocols (ICMP, ESP,...) are blocked. Connecting to services and managing the HA cluster in the Azure cloud: Accessing Services in Azure/ on the F-Series Firewall Create a Load-balanced Endpoint for each service accessed on or behind the F-Series Firewall in Azure. Management Access If you are not using a Barracuda NextGen Control Center to manage your F- Series Firewall use the following solution to be able to access both VMs with NG Admin: Create an Endpoint on port TCP/807 to manage the primary F-Series Firewall. Configure a Client-to-Site VPN. You can now reach the static internal IP address of the secondary F- Series Firewall through the Client-to-Site VPN. Before You Begin Install Windows PowerShell for Azure version or later. ( Step Create an Azure wide Virtual Network Public Instance Level IPs (PIPs) require a wide Virtual Network (widevnet). WideVNETs use the Location tag instead of the AffinityGroup and cannot be created using the web interface. 1 / 14

2 Log into your Microsoft Azure Management Portal ( In the left menu, click on NETWORKS. Click EXPORT in the bottom pane to download the current network configuration as an XML file. You are prompted to save the NetworkConfig.xml file. Edit the network configuration XML file and add a definition for the wide Virtual Network. Alternatively, you can also modify an existing Virtual Network. [...] <VirtualNetworkSite name="widevnet" Location="West Europe"> <Subnets> <Subnet name="frontend"> <AddressPrefix> /24</AddressPrefix> </Subnet> <Subnet name="backend"> <AddressPrefix> /24</AddressPrefix> </Subnet> </Subnets> <AddressSpace> <AddressPrefix> /16</AddressPrefix> </AddressSpace> </VirtualNetworkSite> [...] In the lower left-hand corner, click + NEW > NETWORK SERVICES > VIRTUAL NETWORK > IMPORT CONFIGURATION. The IMPORT NETWORK CONFIGURATION FILE window opens. 6. Select the modified network configuration XML file and click Next. 2 / 14

3 7. Verify the changes to your Virtual Networks and click OK. 8. Click OK. Your VNET is now listed in the NETWORKS section. Step Create an Azure Cloud Service Create a cloud service. The Barracuda NextGen Firewalls will be deployed in the same cloud service so you can later assign both virtual machines the same Availability Set. Log into your Microsoft Azure Management Portal ( In the left pane, click on CLOUD SERVICES. In the lower left-hand corner click + NEW > COMPUTE > CLOUD SERVICE > CUSTOM CREATE. 3 / 14

4 Enter the URL for the cloud service. E.g., BarracudaNGCloudService Select a REGION OR AFFINITY GROUP for the cloud service. E.g., West Europe 6. Click OK. You now have a cloud service located in the Azure datacenter of your choice. Step Deploy two Barracuda NextGen Firewalls Deploy two Firewall Virtual Machines in the Microsoft Azure cloud, using: The cloud service created in Step The VNET and Frontend Subnet created in Step Optional: Depending on the deployment method, you may also assign static internal IP addresses to the NextGen Firewalls. For more information, see Microsoft Azure Deployments using Azure Service Manager (ASM). Step Assign Static Internal IP Addresses to the Firewall VMs The Azure virtual machine will automatically reboot after assigning the static IP address. You must use a static internal IP address to be able to create a high availability cluster. Choose free IP addresses in the Frontend subnet of the Virtual Network for both F-Series Firewalls. Open a Windows Azure PowerShell. Check if the chosen IP address is available by entering: Test-AzureStaticVNetIP -VNetName <your Azure virtual network name> -IPAddress 4 / 14

5 <your chosen static internal IP address> Save the virtual machine to a local variable. $staticvm = Get-AzureVM -ServiceName <Cloud Service name of your NG> -Name <virtual machine name> Change the internal IP address of the virtual machine from dynamic to static. Set-AzureStaticVNetIP -VM $staticvm -IPAddress <your chosen static internal IP address> Update-AzureVM The F-Series Firewall automatically reboots. Repeat the procedure for the secondary unit, using a different IP address from the same subnet. Both Firewall VMs are now assigned static internal IP addresses: 5 / 14

6 Step 6. Change the Network Configuration to Use the Static Internal IP Addresses Change the network configuration of the primary and secondary firewall to use a static network interface. Step 6.1 Reconfigure the Network Interface Change the network interface type from dynamic to static. 6. Log into the primary firewall via the assigned PIP. Go to CONFIGURATION > Configuration Tree > Box > Network. In the left menu, click on xdsl/dhcp/isdn. Click Lock. Delete the DHCP01 entry in the DHCP Links list. Select No from the DHCP Enabled dropdown list Click Send Changes. In the left menu, click on IP Configuration. In the Management IP and Network section in the Interface Name line, untick the Other checkbox. Select eth0 from the Interface Name list. Enter the static internal IP address from Step 1 as the Management IP (MIP). E.g., Step 6.3 Create the Default Route Add the default route. In the left menu, click on Routing. Click + in the Routes table and configure the following settings: Target Network Address Enter /0 Route Type Select gateway. Gateway Enter the first IP address of the subnet the F-Series Firewalls reside in. E.g., if the IP addresses of the units are and Trust Level Select Unclassified. 6 / 14

7 Click OK. Click Send Changes and Activate. Step 6.4 Disable ICMP Monitoring of the Gateway ICMP probing must be disabled for the interface. Go to *CONFIGURATION > Configuration Tree > Infrastructure Services > Control. Click Lock. In the ICMP Gateway Monitoring Parameter section click + to add an entry to the No Probing for Interface table. Enter eth0 In Other. Click Send Changes and Activate. Step 6.5 Activate the Network Changes Activate the changes to the network configuration. Go to CONTROL > Box. In the Network section of the left menu, click on Activate new network configuration. Click Activate Now or Force. 7 / 14

8 Do not use a Failsafe network activation when changing the management IP address. Step 6.6 Reconfigure the Secondary Unit Complete Steps for the secondary unit. Both F-Series Firewall systems are now using the static 'eth0' network interfaces (CONTROL > Network). Step 7. (PAYG only) Import PAYG Licenses from the Secondary Firewall Step 7.1 Export the PAYG License from the Secondary Firewall Log into the secondary firewall. Go to CONFIGURATION > Configuration Tree > Box > Licenses. Click Lock. Select the license file, click the export icon, and select Export to File. Click Unlock. Step 7.2 Import the PAYG License on the Primary Firewall Log into the primary firewall. Go to CONFIGURATION > Configuration Tree > Box > Licenses. Click Lock. Click + and select Import from File. Select the license file exported from the secondary firewall. The primary firewall now has both PAYG licenses listed in the Licenses list. Step 8. Create a DHA Cluster Configuration Create a DHA cluster configuration. For more information on DHA, see High Availability. Log into the primary F-Series Firewall. Go to CONFIGURATION > Configuration Tree. Right-click on Box and select Create DHA Box. Go to CONFIGURATION > Configuration Tree > HA Box > HA Network. Select eth0 from the Interface Name list. 6. Enter the static IP address of the secondary F-Series Firewall as the Management IP (MIP). E.g., In the left menu, select Routing. 8. Verify the default route is present. ( /0 gateway XX.XX.XX.1). 9. Click Send Changes and Activate. 8 / 14

9 Step 9. Deploy the HA PAR file to the Secondary Unit Step 9.1 Create the PAR file for the HA Unit Log into the primary F-Series Firewall unit. Go to CONFIGURATION > Configuration Tree. Right-click on Box and select CREATE PAR FILE for HA box. You are prompted to save the boxha.par file. Step 9.2 Deploy the PAR file on the Secondary Unit Log into the secondary F-Series Firewall unit. Go to CONFIGURATION > Configuration Tree. Right-click on Box and select Restore from PAR file. Choose the boxha.par file created in Step Click Activate. Go to CONTROL > Box. In the left menu in the Network section, click on Activate new network configuration. Click Failsafe. In the left menu in the Operating System section, click Firmware Restart. The F-Series Firewall systems are now in a high availability cluster. Step 9.3 Set the Active and Backup Unit for the Virtual Server Standalone F-Series Firewalls Log into the primary unit. Go to your cluster in the NextGen Control Center > Virtual Servers > your virtual server > Server Properties. Click Lock. In the Virtual Server Definition section, define the primary unit and secondary unit. Active Box Select This-Box. Backup Box Select Other-Box. Click Send Changes and Activate. Managed F-Series Firewalls Log in to your Control Center. Go to your cluster in the NextGen Control Center > Virtual Servers > your virtual server > Server Properties. Click Lock. In the Virtual Server Definition section, define the primary unit and secondary unit. 9 / 14

10 Primary Box The active system. Secondary Box The HA partner. Click Send Changes and Activate. Step 10. (BYOL only) Activate and License the Two Firewall VMs Activate the license on the secondary firewall then on the primary firewall. If the primary unit is activated prior to the secondary unit the licenses for the secondary can not be downloaded. In this case reboot the primary firewall and perform a complete manual HA sync and update to download and install the licenses correctly. For more information, see How to Activate and License a Standalone High Availability Cluster. Step 1 Add Both Firewall Virtual Machines to the Same Availability Set The Azure virtual machine will automatically reboot after assigning a new availability set. To avoid hardware failures, and to take advantage of the Microsoft Azure SLA for the compute cloud, both virtual machines must be in the same availability set.if you already placed the two F-Series Firewalls in a Availability Set during deployment continue with Step 10. Log into your Microsoft Azure Management Portal ( In the left pane, click on Virtual Machines. Click on the primary firewall VM. The DASHBOARD opens. In the top menu, click on CONFIGURE. Select Create an availability set. 6. Enter the name for the AVAILABILITY SET. E.g., HA_SET 7. In the bottom pane, click SAVE. Wait for the changes to be applied. The virtual machine will reboot. 8. Click on the secondary F-Series Firewall. The DASHBOARD opens. 9. In the top menu, click on CONFIGURE. 10. From the AVAILABILITY SET list, select the availability set created for the primary F-Series Firewall. E.g., HA_SET. 1 In the bottom pane, click SAVE. Wait for the changes to be applied. The virtual machine will reboot. Both firewall VMs are now in the same availability set. Go to virtual machines > your primary or secondary virtual machine > CONFIGURE. Both virtual machines are now listed below the AVAILABILITY SET list. Step 1 Configure a Load Balanced Endpoint Create a load-balanced endpoint for each Internet facing service you want to offer. E.g., a load-balanced endpoint for port UDP/691 if you are connecting via TINA to the VPN service on the HA cluster. 10 / 14

11 Log into your Microsoft Azure Management Portal ( In the left menu, click on VIRTUAL MACHINES. Click on the primary firewall VM. The DASHBOARD opens. In the top menu, click on ENDPOINTS. Select ADD A STAND-ALONE ENDPOINT. Click OK. In the ADD ENDPOINT window, enter: Name Enter a name for the endpoint. PROTOCOL Select TCP or UDP depending on your TINA configuration. PUBLIC PORT Enter the external port: E.g.,691 PRIVATE PORT Enter the internal port. E.g., 691 CREATE A LOAD-BALANCED SET Select the checkbox to enable load balancing for these ports. Click NEXT. Configure the load-balanced set: LOAD-BALANCED SET NAME Enter a name for the load balanced endpoint. PROBE PROTOCOL Select TCP. PROBE PORT Enter the port the service is listening on internally. E.g., 691 PROBE INTERVAL Enter how many seconds should be between probes. Default: 5sec NUMBER OF PROBES Enter how many probes should be sent before the service is switched to the other unit. Default: 2 Click OK. The load-balanced endpoint is created. Click on the secondary firewall VM. The DASHBOARD opens. In the top menu, click on ENDPOINTS. Select ADD AN ENDPOINT TO AN EXISTING LOAD BALANCED SET. Select the load balanced endpoint created for the primary unit. Click NEXT. Enter a NAME. Click OK. Step 1 Remove the SETUP-MGMT-ACCESS Rule This redirect access rule is no longer needed and can be deleted. Go to CONFIGURATION > Configuration Tree > Box > Virtual Servers > S1 > Firewall > Forwarding Rules. Click Lock. Right-click on SETUP-MGMT-ACCESS firewall rule and click Delete. Click Send Changes and Activate. Step 1 Configure Azure User Defined Routing Azure User Defined Routing allows you to use the F-Series Firewall HA cluster in the frontend subnet as the default gateway for all your VMs running in the backend networks. You must enable IP forwarding for the F- Series Firewall VMs and create and apply an Azure routing table to the backend networks. Using a management Certificate and the Azure subscriber ID the F-Series Firewall VMs can change the Azure Routing Table on the fly when the virtual server fails over from one VM to the other. Step 11 Configure User Defined Routes for your VNET Create a User Defined routing table and enable IP Forwarding for the two F-Series Firewall VMs. Assign this user defined routing table to all subnets that use the F-Series Firewall HA cluster as the default gateway. For more information, see How to Configure Azure Route Tables (UDR) in Azure using PowerShell and ASM. 11 / 14

12 Step 12 Create the Azure Management Certificate For the F-Series Firewall to be able to connect to the Azure backend, you must create and upload a Management certificate. Log in to the firewall via ssh. Create the certificate: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout mycert.pem -out mycert.pem openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout mycert.pem -out mycert.pem Answer the questions at the prompt. The Common Name is used to identify this certificate in the Azure web interface. Convert the certificate to CER, as required by Azure: openssl x509 -inform pem -in mycert.pem -outform der -out mycert.cer openssl x509 -inform pem -in mycert.pem -outform der -out mycert.cer If you are using an OpenSSL version that generates PKCS#8 keys you must extract the RSA key separately: openssl rsa -in mycert.pem -out mycert.key.pem In this case upload mycert.pem as the Azure Management Certificate and mycert.key.pem as the Management Key on the F-Series Firewall. You now have two certificates mycert.pem and mycert.cer. Step 13 Upload the Azure Management Certificate Log into the Microsoft Azure Management Portal ( On the bottom of the left menu, click on SETTINGS. In the top navigation, click on MANAGEMENT CERTIFICATES. On the bottom Click UPLOAD. Select the mycert.cer certificate created in Step 1 and click OK. The management certificate is now listed with the Common Name of the certificate used as the Name. Step 1 Configure Cloud Integration You must enter your Azure SubscriptionId, VNET name and the management certificate to allow the F-Series Firewall to change the Azure User Defined Routing Table. Login to the primary firewall. Go to CONFIGURATION > Configuration Tree > Box > Advanced Configuration > Cloud Integration. Click Lock. In the left menu, click Azure Networking. Enter your Azure Subscription ID. Use Get-AzureSubscription in Azure PowerShell to display your SubscriptionId. 6. Enter the Virtual Network Name. 7. Next to Management Certificate click Ex/Import and select Import from PEM File. The File browser window opens. 8. Select the mycert.pem certificate created in step 12 and click Open. 12 / 14

13 9. Next to Management Key click Ex/Import and select Import from File. The File browser window opens. Select the mycert.pem certificate created in step 12 and click Open. If you are using an OpenSSL version that generates PKCS#8 keys import the mycert.key.pem file as the Management Key on the F-Series Firewall. 10. Set Protect IP forwarding settings to yes. 1 Click Send Changes and Activate. The Azure Routing table is now updated every time the virtual server fails over. Step 1 (Optional) Assign Public Instance Level IP addresses to the Firewall Virtual Machines To access both firewall virtual machines directly and individually, a Public Instance Level IP Address (PIP) must be assigned to each VM. PIPs can only be assigned and managed via Azure PowerShell and are currently not visible in the Microsoft Azure web interface. Once assigned to a VM, PIPs are used as the default source IP address for outgoing connections initiated by the F-Series Firewall. For more information, see Reserved, Static and Public IP Addresses in the Azure Cloud using ASM. 13 / 14

14 Figures 14 / 14