How To deploy SonicWall GEN7 NSv in Active Standby High Availability Mode On Azure?

06/01/2021 7 3813

DESCRIPTION:

Azure lets you add cloud capabilities to your existing network through its platform as a service (PaaS) model or entrust Microsoft with all your computing and network needs with Infrastructure as a Service (IaaS).

Product Matrix 

NOTE: HA requires a minimum of three interfaces for High Availability Exchange Messages. Hence the Image should be selected as Standard D3_V2  for GEN  6 and GEN 7.

For Azure sizing and pricing information, see:

• https://azure.microsoft.com/en-us/pricing/details/virtual-machines/linux/
• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes-general

Topology

RESOLUTION:

To install from Sonicwall Github Template: 

1. In your browser, navigate to 

   https://github.com/sonicwall-NSv/azure-template/tree/feature/HA 

    and log into your Microsoft Azure account. Click on Deploy on Azure.

The Template will create Two Virtual Machine with LAN , WAN and HA Interfaces.

NOTE:Please Select 1036 Image version to install Gen 7 .

• Navigate to Virtual Machine | Under Networking | Gen7NSvHA01-Interface-x1 | Network Interface Gen7NSvHa01-Interface-x1, the Template will automatically Create an additional Secondary Interface.

Navigate to Virtual Machine | Under Networking | Gen7NSvHA01-Interface-x0 | Network Interface Gen7NSvHa01-Interface-x0,the Template will automatically Create an additional Secondary Interface.

Enable Identity of Primary Virtual Machine

• To enable, navigate to Home | Virtual Machines page, search for the primary virtual machine that you have created during deployment, and on the left panel, select Identity and change the status to On ( If it is already  configured through Template, please leave it as default)
  
  
  
  
• Add permissions to the Resource Group. To add contributor roles and permissions, navigate to Home page and search for the resource group that you have created during deployment and on the left panel, select Access Control (IAM) and click Add to provide permissions of virtual machine( If it is already  configured through Template, please leave it as default)

Log in to GEN7 Primary NSv firewall .

• On the Network | System | Interfaces, change X0 first, and then X1 as shown below. You will lose access after you change X1.

 Log in to the Secondary NSv firewall

• Navigate to  Network | System | Interfaces, create the HA interface  with custom zone as  "HA" using below IP address details.
  
  
  

• Navigate to Device | Settings | HA Interfaces, select Enable L3 Mode option on secondary firewall.

On the primary firewall,Login using Secondary public ip address.

• Configure HA to Active/Passive with L3 HA link. To configure, browse to Manage | High Availability, select Enable Stateful Synchronization option.
• Click HA interfaces tab and switch the HA Control link to L3 mode. There is no need for gateway address, if two HA Interfaces are in the same subnet. If two HA interfaces are in different subnet, there is a need for proper gateway address and default is X.X.X.1 on Azure.

• Add monitoring IP to Primary NSv as Physical IP X0 and X1 Azure Interface to manage the secondary firewall.
  
  
• Navigate to Device | High Availability | Status page to check whether the cluster is coming together. The secondary will reboot, and it may take a while to see the cluster up.

 NOTE:Currently we only support one secondary interface API Call.