How to Configure a High Availability Cluster in Azure using PowerShell and ARM

Configure a high availability cluster to ensure that the services running on the Barracuda CloudGen Firewall VMs are always available even if one unit is unavailable due to maintenance or a hardware issue. To be able to configure an HA cluster, both firewalls VMs must be deployed to the same subnet and be placed in an Availability Set. This ensures that the VMs are placed in different fault and update domains inside the Azure datacenter. Incoming connections are forwarded to the active firewall by the Azure Load balancer. The load balancer actively monitors the services on the firewall and, when an HA failover takes place, redirects the traffic to the other, now-active firewall. You must create load balancer rules and health probes for each service for the load balancer to know which ports to forward and how to monitor them. The load balancer does not failover immediately after the firewall service has failed over, since it requires at least two probes to fail before reacting. Combined with the minimum poll time of 5 seconds, this means that failover will take at least 10 seconds during which no traffic can be forwarded.

The existing session will time out after a failover since Azure does not support floating IP addresses; the connection to the backend server VMs will thus use a different source IP address. The backend VMs are configured to use the firewall as the default gateway and, if needed, access control between the backend subnets using Azure User Defined Routing. Because only one IP address can be configured as the destination, the CloudGen Firewall connects to the Azure fabric and rewrites the route table to use the now-active firewall instead of the failed firewall VM. Now, the backend VMs can connect via the active firewall to the Internet.

Open

• Install Azure PowerShell 3.5.0 or higher.

To configure an HA cluster, deploy two CloudGen VMs. The Public IPs attached to the NICs are removed after configuring client-to-site VPN access via the load balancer. To be able to use them in an HA cluster, the deployment must meet the following requirements:

• Single Network Interfaces must be used.

• Both VMs must be in the same subnet of the virtual network.

• Both VMs must be in the same subnet.

• Static private (internal) IP addresses must be used.

• The same instance size for both VMs must be used.

• Both firewalls require the same Barracuda CloudGen Firewall for Azure model.

• Both VMs must be deployed in one Availability Set.

For more information, see How to Deploy a CloudGen Firewall from the Microsoft Azure Marketplace or How to Deploy a CloudGen Firewall in Microsoft Azure Using PowerShell and ARM.

On both firewall VMs, change the network configuration to use a static network interface. Use the static private IP address you assigned to the NIC during deployment.

Change the network interface type from dynamic to static.

1. Go to CONFIGURATION > Configuration Tree > Box > Network.

2. In the left menu, click on xDSL/DHCP.

3. Click Lock.

4. Delete the DHCP01 entry in the DHCP  Links list.

5. Expand the DHCP  Enabled drop-down list and select No.

6. Click Send Changes.

7. In the left menu, click IP Configuration.

8. Go to the Management Network and IPs section and clear the Other check box in the Interface line. 

9. Select eth0 from the Interface list.

10. Enter the static internal IP address from Step 1 as the Management IP (MIP). E.g., 10.0.20.6

Open

Add the default route. The default gateway in Azure subnets is always the first IP in the subnet. E.g., 10.0.20.1 if the subnet is 10.0.20.0/24.

1. In the left menu, click Advanced Routing.

2. Click + in the IPv4 Routing Table and configure the following settings:

   • Target Network Address – Enter 0.0.0.0/0

   • Gateway – Enter the first IP address of the subnet the firewalls reside in. E.g., 10.0.20.1 if the IP addresses of the firewalls are 10.0.20.6 and 10.0.20.7.

   • Route Type – Select gateway. 
     

   • Trust Level – Select Unclassified.
     

3. Click OK.

4. Click Send Changes and Activate.

ICMP probing must be disabled for the interface.

1. Go to CONFIGURATION > Configuration Tree > Infrastructure Services > Control.

2. Click Lock.

3. In the ICMP Gateway Monitoring Parameter section click + to add an entry to the No Probing for Interface table.
   

4. In the Other field, enter  eth0 . 
   

5. Click Send Changes and Activate.

Activate the changes to the network configuration.

1. Go to CONTROL > Box.

2. In the Network section of the left menu, click Activate new network configuration.

3. Click Activate Now.

Open the CONTROL > Network page. Your interface and IP address are now static.

1. Log into the secondary firewall.

2. Go to CONFIGURATION > Configuration Tree > Box > Licenses.

3. Click Lock.

4. Select the license file, click the export icon, and select Export to File.

5. Click Unlock. 

1. Log into the primary firewall.

2. Go to CONFIGURATION > Configuration Tree > Box > Licenses.

3. Click Lock.

4. Click + and select Import from File.

5. Select the license file exported from the secondary firewall.

The primary firewall now has both PAYG licenses listed in the Licenses list.