Gateway LB with iLB as a passthrough forcing all packets in/out through NVA

ChrisSander3327 1

Is the following possible ?

Azure/On-Prem via ExpressRoute with Azure side Palo NVA's, iLB & GWLB with iLB only being used as a pass-through to chain to Gateway LB front-ending NVA's.

All traffic north/south & east/west in/out of Azure must pass through the Azure side NVA Palo firewalls

Question:
Can I place an internal LB to be the next hop when originating/returning from on-prem to Azure via ExpressRoute, as well as when originating/returning from Azure Vnets to on-prem and have the internal LB chained to a Gateway load balancer to force all traffic in/out of Azure pass through the NVA Palo firewalls behind the Gateway LB?

Not sure is this is a viable design option or how routing for that might work since the internal LB is not actually front-ending any applications, just being potentially used for a pass-through to chain to the Gateway LB to force all traffic in/out of Azure through the firewalls.

Want to utilize the newer Gateway LB option for front-ending NVA's in this design requirement as opposed to legacy design of front and backend LB's sandwiching the NVA's.

1 answer

GitaraniSharma-MSFT 49,646 Reputation points Microsoft Employee

2022-12-02T12:15:30.203+00:00

Hello @ChrisSander3327 ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to if it is possible to chain an internal Load Balancer to a Gateway Load Balancer front-ending NVA's.

As mentioned in our official documentation,

A Gateway Load Balancer can be referenced by a Standard Public Load Balancer frontend or a Standard Public IP configuration on a virtual machine.

As of today, it is not possible to chain an Internal Load Balancer to a Gateway Load Balancer.

I've checked with the Azure Load Balancer Product Group team and they have confirmed that the ability to chain an internal LB to a Gateway LB in order to achieve east/west traffic support is on our roadmap (No confirmed ETA as of yet).

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
ChrisSander3327 1 Reputation point

2022-12-02T15:56:01.537+00:00

gitaranisharmamsft-4262,

I read the documentation and understand chaining can occur from an LB to a GWLB
However, I think of the LB as being tied to a specific application with application server(s) behind it and not instead just acting as a front-end to the entire Azure environment and all Vnets

Let me re-phrase the main question:

How do I utilize a GWLB to force "all" traffic in/out of Azure to go through the NVA firewalls behind the GWLB?
--Can I point next hop from on-prem and Vnets to the GWLB, is that valid?
--Or can I point next hops from on-prem and Vnets to an LB that has no application servers behind it but instead is just acting as a passthrough whose only purpose is for chaining to the GWLB to divert through NVA's?
--Other, and if other what does that consist of?

ChrisSander3327 1 Reputation point

2022-12-02T21:33:56.943+00:00

"I've checked with the Azure Load Balancer Product Group team and they have confirmed that the ability to chain an internal LB to a Gateway LB in order to achieve east/west traffic support is on our roadmap (No confirmed ETA as of yet)."

Are there any white papers regarding this roadmap solution that can be reviewed?

Seems inefficient to have firewalls behind a GWLB that can only be used by something using a Private IP LB.
I assume then I cannot just point next hop to the GWLB IP (I assume it has an IP)

Are there use cases presently where customers are filtering everything through an Azure side NVA firewall aside from possibly the managed solutions from CheckPoint & Fortigate that reside in same Vnet as the Expressroute Gateway or the model where NVA's are sandwiched between LB's?

GWLB looked promising to transparently insert inspection as well as avoid the cons of the sandwich model but now it appears it is limited in what it can support which I guess is why east/west private LB is on roadmap but again will that allow for all traffic east/west or just for applications that sit behind various iLB's?

Can iLB's act as just a pass through without any actual servers in a pool behind it?

GitaraniSharma-MSFT 49,646 Reputation points Microsoft Employee

2022-12-05T10:13:33.263+00:00

Hello @ChrisSander3327 ,

I am reaching out to the Product Group team internally regarding your queries and will provide an update as soon as I get a response.

Regards,
Gita

GitaraniSharma-MSFT 49,646 Reputation points Microsoft Employee

2022-12-08T13:01:51.507+00:00

Hello @ChrisSander3327 ,

Below is the update from our Load Balancer Product Group team:

As you already know, Gateway Load Balancer does not support east/west today, and it is not a supported configuration to use the Gateway LB as a next hop. In order for the GWLB to receive traffic, the traffic must be intended for the public Load Balancer or VM with ILPIP that is chained to the GWLB.
At the given moment, we would recommend using the current sandwich model in east/west scenarios, and leveraging GWLB for north/south scenarios.

However, if you could share the customer details and provide any architectural diagrams of what you have today/what you want via a support request, the product group team could look into it further.

And to answer your query "Are there any white papers regarding this roadmap solution that can be reviewed?", you can refer the below link:
https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha#ha-architectures-overview

This above article explains the most common options to deploy a set of Network Virtual Appliances (NVAs) for high availability in Azure.

Regards,
Gita
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Gateway LB with iLB as a passthrough forcing all packets in/out through NVA

1 answer

Your answer