How to deploy SonicWall GEN6 NSv in Active Standby High Availability mode on Azure?

08/26/2021 4 People found this article helpful 474,205 Views

Description

Azure lets you add cloud capabilities to your existing network through its platform as a service (PaaS) model or entrust Microsoft with all your computing and network needs with Infrastructure as a Service (IaaS).

NOTE: HA requires minimum of three interfaces for High Availability Exchange Messages . Hence the Image should be selected as Standard D3_V2 for GEN 6 and GEN 7.

For Azure sizing and pricing information, see:

Product Matrix

Topology

IP Addresses used in this article
IP Addresses used in this article
HA-01
VNET	192.168.0.0/16
RESOURCE GROUP	HighAvailabilityStandby
VNET NAME	HHactivestandby
WAN IP	X1 :192.168.1.4/24
LAN IP	X0: 192.168.2.4/24
HA IP	X2 :192.168.3.4/24

IP Addresses used in this article
IP Addresses used in this article
HA-02
VNET	192.168.0.0/16
RESOURCE GROUP	HighAvailabilitySatndby
VNET NAME	Hactivestandby
WAN IP	X1 :192.168.1.5/24
LAN IP	X0: 192.168.2.5/24
HA IP	X2: 192.168.3.5/24

Resolution

To install from Sonicwall Github Template:

In your browser, navigate to https://github.com/sonicwall-nsv/azure-template/tree/feature/HA and log into your Microsoft Azure account. Click on Deploy on Azure.
The Template will create Two Virtual Machine with LAN , WAN and HA Interfaces.

NOTE:Please Select 987 Image version to install Gen 6.

Navigate to Virtual Machine | Under Networking |Ha01-Interface-x1 |Network Interface ha01-Interface-x1.The Template will automatically Create an additional Secondary Interface.

Navigate to Virtual Machine | Under Networking |Ha01-Interface-x0 |Network Interface ha01-Interface-x0.The Template will automatically Create an additional Secondary Interface.

Enable Identity of Primary Virtual Machine

Navigate to Home | Virtual Machines page, search for the primary and secondary virtual machine that you have created during deployment and on the left panel, select Identity and change the status to On.
Add permissions to the Resource Group. To add contributor roles and permissions, navigate to Home page and search for the resource group that you have created during deployment and on the left panel, select Access Control (IAM) and click Add to provide permissions of virtual machines.

Log in to Primary NSv firewall

On the Manage | Interface Settings page, change X0 first, and then X1 as shown below. You will lose access after you change X1.

Log in to Secondary NSv firewall.

Navigate to Manage | Interface Settings page, Create the HA interface with below ip address details.
Navigate to Manage | HA Interfaces page, select Enable L3 Mode option on secondary firewall.

On the primary Firewal , login using Secondary public ip.

Configure HA to Active/Passive with L3 HA link. To configure, browse to Manage |High Availability, select Enable Stateful Synchronization option.
Click HA Devices tab and enter the serial number from the secondary. You can find the serial number in the Monitor | System Status page.

Click HA interfaces tab and switch the HA Control link to L3 mode. There is no need for gateway address, if two HA Interfaces are in the same subnet. If two HA interfaces are in different subnet, there is a need for proper gateway address and default is X.X.X.1 on Azure.
Add monitoring ip to Primary NSv as Physical ip X0 and X1 of Azure Interface to manage the secondary firewall.
Navigate to Monitor | High Availability Status page to check whether the cluster is coming together. The secondary will reboot, and it may take a while to see the cluster up.