Design question Master in HA behind Load Balancer

Hey together,
I’m not sure if it is possible: I want to build my master in HA in Azure and I want to use a private network and in front of my nodes icinga01 and icinga02 a load balancer with enabled WAF. My question is can I setup the connected satellites with both masters as endpoints with one DNS-A record, or should I present both hostnames to the satellites?

Thanks in advice

Hi, I guess that could/would work, but it poses some questions for me:

  1. the zone mechanism of icinga already takes care of the connection if one of the parent zone members is unavailable. E.g. master1 becomes unavailable so master2 will take over alle the connections to the satellites
  2. if both master endpoints have identical information in host = <ip/fqdn> inside the zones.conf there is a possibility that the satellites are only connected to one of the masters, because the other master isn’t “reachable” via the DNS record.
  3. I assume the WAF could block very much of the Icinga traffic.

Maybe you can elaborate on the topic from your point of view, why you want to do what are planning.
I’m no network/security/loadbalancing expert (far from it even) but I don’t see any benefit from having a LB with a WAF for the Icinga masters.

For making the webinterface available to the outside, sure. This we do as well, and the WAF is blocking many sites and actions from the webinterface and the Icinga Director :wink:

greetings :slight_smile:

for icingaweb2 and director it is necassary to improve the security. So this is ideal for WAF. My company want to be very secure, and so there was the idea to secure the icinga traffic as well, but I’m not sure how to do it, maybe I will create WAF for web and do IP apply rules for the special satellite IPs.

I’m still not sure I understand correctly what you are trying to achieve.
Icinga internal traffic is not the same as Icinga Web 2 or Icinga Director traffic, just to be sure that this is known :slight_smile:
Are both your master instances or satellite accessible from the internet via port 5665? Because this is the port that icinga uses internally (by default) to communicate between the nodes (master/satellite/Agent).