Azure East West

The Valtix Gateway is deployed in a VNet to protect the traffic between subnets or between VNets. The Gateway must be used as a Reverse Proxy within the VNet. For cross VNet traffic the Gateway can be used in forwarding mode.

To add a Gateway:

1. Navigate to Manage -> Gateways -> Gateways
2. Click Add Gateway
3. Select the account you previously created

4. Click Next

   Parameter	Description
   Instance Type	Choose the type from the drop down
   Gateway Type	Auto Scaling. (Look at the implementation guide for single instance Gateway and the use case for that)
   Minimum Instances	Select the minimum number of instances that you plan to deploy
   Maximum Instances	Select the maximum number instances that you plan to deploy. This is the maximum number that is used for auto-scaling in each availability zone
   HealthCheck Port	Default is 65534
   Packet Capture	(optional) Packet capture profile for threat and flow pcaps
   Diagnostics	(optional) Diagnostics profile for debugging
   Log Profile	(optional) Log Forwarding Profile used to forward events/logs to a SIEM

5. Click Next

6. Provide the following parameters

   Parameter	Description
   Security	East-West
   Gateway Image	Image to be deployed
   Policy Ruleset	Select the policy ruleset to associate with this Gateway
   Region	Select the region this Gateway will be deployed into
   Resource Groups	Select the resource group to associate the Gateway with
   SSH Public Key	Paste the SSH public key. This public key is used by the controller to access the CLI of the deployed Gateway instances for debug and monitoring
   VNet ID	Select the VNet to associate with the Gateway.
   User Assigned Identity ID	Enter the Azure identity to associate with this Gateway. This is the Resource ID found in the Azure Portal > Managed Identities > Settings > Properties
   Mgmt. Security Group	Select the security group to associate with the management interface
   Datapath Security Group	Select the security group to associate with the datapath interface

   Select the Availability Zone, the Mgmt Subnet and the Datapath Subnet. The available subnets will be based on the VNet selected above. For HA purposes the Gateway instances can be deployed in multiple AZs. Click the plus button to add a new AZ and select the parameters for the selected AZ. Some Azure regions do not support multiple AZs. In such regions the Gateway instances are deployed in only a single AZ.

Tech Notes

Using the Azure portal, view the VM instances page and check the Gateway instances created. The VMs have a Name tag that begins with valtix.

Check Load Balancers section and note that an internal Network Load Balancer has been created.

Route Changes

For the traffic from all the apps/subnets in the VNet to Egress through the Valtix Gateways:

• Add a route table in the Azure portal
• Associate the route table with all the subnets
• Add a VNet CIDR with next-hop as the IP address of the Valtix Gateway Network Load Balancer