Hello,
We recently moved to UTM virtual appliances from Cisco ASA's, and overall we couldn't be happier. However, we are running into a pretty nasty situation trying to make sure our UTM isn't a single point of failure in AWS. Unfortunately, during the sales process we were pointed to the AWS HA support article and there's nothing on the page to indicate that it's a beta that isn't currently working.
So, we're in a position of trying to figure out how become fault tolerant with our UTM. Assuming (and hoping) we're not the first people to try to do this, how have other's achieved the same goal?
The only options I see now are:
(1) Setup a second UTM, in a different availability zone and use an Amazon ELB to split traffic between them. The UTM in each AZ would route traffic the subnets in their respective AZ.
This solution works without AWS-specific script writing, but I'm not sure how (or if) we can sync the common configuration (everything but the interfaces). Also, it comes with a lot of badness:
- The loss of one UTM would effectively close out an entire AZ until it was resolved or was traffic re-routed.
- Using an ELB means all traffic has a source address of the ELB, so lots of UTM features become unusable (unless the UTM supports the Proxy Protocol, which I can't find any docs about).
- If you want to do anything at all with the client ip's in an HTTPS application (restrict, log, etc), now the ELB has to perform ssl termination for you so it can add the X-Forwarded-For header.
- It costs more.
(2) Roll our own cloudstack solution to spin up a snapshot of the UTM in case of a failure.
This would have us modeling the currently-not-working HA solution brought in by sophos. This is both pretty challenging from a testing standpoint, and pretty frustrating from a development standpoint, because we would have to learn the sophos provisioning software (without even direct access to source).
Sooo… how has this been achieved? What are others doing?
This thread was automatically locked due to age.
