topic Re: Cloudguard Network FW - egress NAT in Cloud Firewall

Cloudguard Network FW - egress NAT

abihsot__ — Fri, 08 Jul 2022 15:22:33 GMT

Hello,

Before I reach out to TAC for an official answer, maybe someone already knows the answer

Is this supported? Cloudguard Network Firewall used via Gateway Load Balancer in transit GW setup

Two-arm mode: As shown in figure 5b below, the firewall is deployed in two-arm mode and performs both inspection as well as NAT. Some AWS partners provide firewall with NAT functionality. GWLB integrates seamlessly in such deployment mode. You don’t need to do any additional configuration changes in the GWLB. However, the firewall networking differs – one network interface is on the private subnet and the other is on public subnet. This mode requires software support from the firewall partner. Some of the GWLB partners (Palo Alto Networks, Valtix) support this feature, however consult with an AWS partner of your choice before using this mode.

source:

https://aws.amazon.com/blogs/networking-and-content-delivery/best-practices-for-deploying-gateway-load-balancer/

Re: Cloudguard Network FW - egress NAT

Vladimir — Fri, 08 Jul 2022 21:48:02 GMT

I did not have a chance to try this myself, (use of public IPs on firewall interfaces in AWS), but it should work just fine, as this is basic functionality of CheckPoint gateways.

Last time I was working with CloudGuard in AWS, I was using NAT between private and public segments, but I had to associate AWS public EIP to the external interface, so there was one more NAT step being performed by AWS Internet Gateway.

Re: Cloudguard Network FW - egress NAT

Nir_Shamir — Sun, 10 Jul 2022 05:15:39 GMT

Hi,

From what I know this should work , although the GWLB in TGW template we usually use have NAT Gateways for outbound NAT do deal with all the routing .

Re: Cloudguard Network FW - egress NAT

Roman_Kats — Sun, 10 Jul 2022 09:21:55 GMT

Hi abihsot__
In addition to Nir's reply
Architectures references can be found in the GWLB admin guide and sk:

CloudGuard Network for AWS Gateway Load Balancer Security VPC for Transit Gateway R80.40 Deployment Guide

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk174447

Re: Cloudguard Network FW - egress NAT

abihsot__ — Mon, 11 Jul 2022 06:52:41 GMT

Yes, I know, template deploys AWS NAT gateways automatically, however I was thinking if I already have checkpoint gateways, why not use them to NAT outgoing traffic. This might be interesting to try. Thank you for replies!

Re: Cloudguard Network FW - egress NAT

Roman_Kats — Mon, 11 Jul 2022 07:39:37 GMT

Hi @abihsot__
Unfortunately NAT is not supported on Check Point Gateways behind Gateway Load balancer
You have to use NAT Gateway

Re: Cloudguard Network FW - egress NAT

abihsot__ — Tue, 12 Jul 2022 11:21:24 GMT

Thank you for confirmation. Any idea if this limitation could be changed in the future?