Deploying virtual Network Security appliances in Azure in inline mode with gateway load balancing

This topic describes how to deploy a virtual Network Security appliance in inline mode with a gateway load balancer (GWLB). The GWLB intercepts network traffic flow between the Instance Level Public IP (ILPIP) (associated with Azure VM) or the frontends of public load balancer, and the Network Virtual Appliance (NVA) deployed in another virtual network.

A standard public load balancer or a virtual machine configured with a public IP can be connected to a GWLB. Once connected, no other configuration is needed to ensure the flow of traffic between the GWLB and the application endpoint.

In this setup, the virtual Network Security appliance is deployed in a security virtual network while the web server is deployed in a service virtual network.

Note

The virtual Network Security appliance is supported only in inline mode. Tap mode is not supported.

This section assumes that Azure components such as subnets, routes, Network Security groups, are already configured.

The main components of the setup are:

Web Server: A web server on a private subnet in the virtual network.
Network Security VM: A Network Security VM is deployed in an appropriate subnet. The management and monitoring interfaces are connected to different subnets.
GWLB: A gateway load balancer enables you to deploy, scale, and manage virtual appliances, such as firewalls, intrusion prevention systems. It combines a transparent network gateway (that is, a single entry and exit point for all traffic) and distributes traffic to the virtual appliances.
Standard load balancer: A native load balancer load balances traffic to different virtual machines.

The flow of traffic takes place as follows:

The virtual Network Security appliance is deployed in inline mode, positioned between an external Web Client and an internal Web Server. The arrangement ensures that all the traffic between the Web Client and the Web Server should pass through the virtual Network Security appliance, providing comprehensive protection for the Web Server.
The incoming traffic is routed through a standard load balancer, GWLB, and the virtual Network Security appliance.
The GWLB directs incoming traffic to the virtual Network Security appliance for initial processing before it proceeds to the Web Server.
Similarly, outgoing traffic from the Web Server is channeled through the virtual Network Security appliance in the reverse direction, ultimately reaching the Web Client.
Throughout this process, the virtual Network Security appliance inspects traffic in both directions, determining whether to forward or block it. It also generates alerts as necessary.
The diagram illustrates the traffic flow with incremental numbers indicating the sequence of the path.

Complete the following steps to deploy the virtual Network Security appliance:

Enable the health monitoring at the interface.

hostname (config) # policymgr interface A health-check http port 80

Configure the default route.

hostname (config) # ip route vrf vrfA 0.0.0.0 /0 <subnet GW IP>

Configure the VXLAN parameters. You can configure the VXLAN parameters for the internal and external ports and identifiers for gateway load balancer using the Web UI or CLI.
These parameters must match the ones configured in the Azure GWLB Web UI.

Requirements for VXLAN parameters:

All the four parameters should be configured.
The internal port should have a value between 1 - 65535.
The internal identifier should have a value between 800-1000.
The external port should have a value between 1 - 65535.
The external identifier should have a value between 800-1000.
The internal and external ports cannot have the same value.
The internal and external identifiers cannot have the same value.
Default VXLAN port 4789 cannot be used as the internal or external port.

To configure the VXLAN parameters for gateway load balancer using the Web UI:

In the Web UI, choose Settings > Inline Operational Modes.
In Azure Configuration section, select Add to add a new set of parameters. You can add up to 10 sets of configurations.
The new set of parameters will be added to the table.
Click on a radio button to select a set of VXLAN parameters.
Use the Delete button to delete any set of parameters.

To configure the VXLAN parameters for gateway load balancer using the CLI:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Configure the parameters.

hostname (config) # fe-fastpath vxlan in-port * in-vni * ex-port * ex-vni *

Save your changes.
```
hostname (config) # write memory
```

Display the configuration.

hostname (config) # show fe-fastpath vxlan config
Vxlan Configuration:
Internal port  Internal identifier    External port   External identifier
    10800               800               10801               801