Prerequisites for Azure NLB cluster deployment

Before deploying an Azure Network Load Balancer cluster, ensure that you complete these prerequisite tasks.

  • To allow the cluster to auto-register with the Management Center, create a user with Network Admin & Maintenance User privileges on the Management Center. Users with these privileges can use REST API. Refer to the Cisco Secure Firewall Management Center Administration Guide.

  • Add an access policy in the Management Center that matches the name of the policy that you will specify during template deployment.

  • Ensure that the Management Center Virtual is licensed appropriately.

  • After the cluster is added to the Management Center Virtual, complete these configuration steps:

    1. Configure platform settings with the health check port number in the Management Center. For more information on configuring this, refer to Platform Settings.

    2. Create static routes for traffic from outside and inside interfaces. For more information on creating a static route, refer to Add a Static Route.

      Important

      Configure static routes for both interface gateway paths when Azure Load Balancer health probes are enabled on both inside and outside interfaces of FTDv cluster nodes. Do not rely on a single default route. Azure health probes may arrive on either interface, so FTDv must respond using the correct interface path. Missing routing configuration can cause probe drops and load balancer health check failures. If SSH on port 22 is used as the health probe and SSH is enabled on both interfaces through Platform Settings, verify return path routing for both interfaces. Similarly, if HTTP is used as the health probe and HTTP or HTTPS is enabled on both interfaces through Platform Settings, verify return path routing for both interfaces.

      Note

      Ensure that you do not configure your virtual network using the Microsoft-owned IP address range that includes 168.63.129.16. This configuration causes a conflict with the health probe's IP address. For more information, refer to Microsoft Azure design guidance.

      Sample static route configuration for the outside interface:
      
Network: any-ipv4
Interface: outside
Leaked from Virtual Router: Global
Gateway: ftdv-cluster-outside
Tunneled: false
Metric: 10
      Note

      ftdv-cluster-outside is the outside subnet's gateway IP address.

      Sample static route configuration for the inside interface:

      
Network: any-ipv4
Interface: inside
Leaked from Virtual Router: Global
Gateway: ftdv-cluster-inside-gw
Tunneled: false
Metric: 11
      Note

      ftdv-cluster-inside-gw is the inside subnet's gateway IP address.

    3. Configure NAT rule for data traffic. For more information on configuring NAT rules, refer to Network Address Translation.