How to enforce CME template configuration change on existing CloudGuard ScaleSet/VMSS/MIG

Shay_Levin — Thu, 14 Jul 2022 13:23:18 GMT

Many times, you need to make configuration changes to your gateways.

On ScletSet you will need to make change on the CME Template configuration.

By default, when you make a configuration change to the template. Only newly provision gateway will get the new configuration.

In order to the enforce the change on existing ScaleSet gateway ,you will need to use the -g parameter.

In order to check what parameter value to use , you will need to run the command: autoprov_cfg show templates

In the example above the template, az-uk-south does not have the generation value.

In the example above the template, az-uk-south has generation value of 2.

I order to make a change and enforce immediately the new configuration, you will need to check the version first , and use a value that is greater than the current value.

For example , if you will want to add and Identity awareness blade to the last template shown here.

I will use the command: autoprov_cfg set template -g 3 -tn az-uk-south -ips -ia

Re: How to enforce CME template configuration change on existing CloudGuard ScaleSet/VMSS/MIG

Bryan-Smith — Tue, 19 Jul 2022 13:52:32 GMT

@Shay_Levin nice post. Do you have any examples of the "-sl" flag in the CME? Does this allow the GW's to send logs to a specific logger upon creation? Thanks!

CME Structure and Configurations (checkpoint.com)

topic Re: How to enforce CME template configuration change on existing CloudGuard ScaleSet/VMSS/MIG in Cloud Firewall

How to enforce CME template configuration change on existing CloudGuard ScaleSet/VMSS/MIG

Re: How to enforce CME template configuration change on existing CloudGuard ScaleSet/VMSS/MIG