How to deploy SonicWall GEN6 NSv in Active Standby High Availability mode on Azure?

04/16/2021 0 1105

DESCRIPTION:

Azure lets you add cloud capabilities to your existing network through its platform as a service (PaaS) model or entrust Microsoft with all your computing and network needs with Infrastructure as a Service (IaaS).

NOTE: HA requires minimum of three interfaces for High Availability Exchange Messages . Hence the Image should be selected as Standard D3_V2  for GEN  6 and GEN 7. 

For Azure sizing and pricing information, see:

• https://azure.microsoft.com/en-us/pricing/details/virtual-machines/linux/
• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes-general

Product Matrix

Topology

RESOLUTION:

To install from Sonicwall Github Template: 

• In your browser, navigate to https://github.com/sonicwall-nsv/azure-template/tree/feature/HA  and log into your Microsoft Azure account. Click on Deploy on Azure.
  
  
  
• The Template will create Two Virtual Machine with LAN , WAN and HA Interfaces.
  
  
  
   NOTE:Please Select 987 Image version to install Gen 6.

• Navigate to Virtual Machine | Under Networking |Ha01-Interface-x1 |Network Interface ha01-Interface-x1.The Template will automatically Create an additional Secondary Interface.
  
  
  

• Navigate to Virtual Machine | Under Networking |Ha01-Interface-x0 |Network Interface ha01-Interface-x0.The Template will automatically Create an additional Secondary Interface.

Enable Identity of Primary Virtual Machine

• Navigate to Home | Virtual Machines page, search for the primary and secondary virtual machine that you have created during deployment and on the left panel, select Identity and change the status to On.
  
  
  
  
• Add permissions to the Resource Group. To add contributor roles and permissions, navigate to Home page and search for the resource group that you have created during deployment and on the left panel, select Access Control (IAM) and click Add to provide permissions of virtual machines.

Log in to Primary NSv firewall

• On the Manage | Interface Settings page, change X0 first, and then X1 as shown below. You will lose access after you change X1.

Log in to Secondary NSv firewall.

• Navigate to Manage | Interface Settings page, Create the HA interface with below ip address details.
  
  
• Navigate to Manage | HA Interfaces page, select Enable L3 Mode option on secondary firewall.
  
  
  

On the primary Firewal , login using Secondary public ip.

• Configure HA to Active/Passive with L3 HA link. To configure, browse to Manage |High Availability, select Enable Stateful Synchronization option.
  
  
  
• Click HA Devices tab and enter the serial number from the secondary. You can find the serial number in the Monitor | System Status page.

• Click HA interfaces tab and switch the HA Control link to L3 mode. There is no need for gateway address, if two HA Interfaces are in the same subnet. If two HA interfaces are in different subnet, there is a need for proper gateway address and default is X.X.X.1 on Azure.
  
• Add monitoring ip to Primary NSv as Physical ip X0 and X1 of Azure Interface to manage the secondary firewall.
  
  
• Navigate to Monitor | High Availability Status page to check whether the cluster is coming together. The secondary will reboot, and it may take a while to see the cluster up.