topic Re: MUH with VMSS to protect AVD (VDI in Azure) in Cloud Firewall

MUH with VMSS to protect AVD (VDI in Azure)

ChristianCastil — Thu, 25 Nov 2021 19:33:44 GMT

this post will show a use case for my past post about ID-Sharing.

Customer with VDI solution uses our MUH agent to identify users behind the same machine and apply rules based on their identity, this is great and uses the agent to communicate with a GW that stores the identity and ports used by a specific user, the issue is when we are in the Cloud and a VMSS, the agent can communicate only to one GW so VMSS environments are an issue, so we can use the ID Sharing mechanism to connect the MUH agent to one GW that only will serve as Collector and Share the learned Identities from this one to the VMSS members, this can be automated with a simple script that I shared in the past (past post).

Here a simple diagram from my demo.

and a video showing all the stuffs

Re: MUH with VMSS to protect AVD (VDI in Azure)

Shay_Levin — Fri, 26 Nov 2021 09:56:56 GMT

@ChristianCastil You bring great architecture and ideas here!
Wonderful

Re: MUH with VMSS to protect AVD (VDI in Azure)

jmaresky — Mon, 06 Dec 2021 12:59:30 GMT

Awesome!

Re: MUH with VMSS to protect AVD (VDI in Azure)

Martin_Valenta — Mon, 06 Dec 2021 15:56:22 GMT

wouldn't it be better to have simple gateway deployed in same backend subnet as VMSS and use it ? instead of going back to on-prem via vpn/express route.

Re: MUH with VMSS to protect AVD (VDI in Azure)

ChristianCastil — Wed, 08 Dec 2021 19:00:52 GMT

meanwhile there is connectivity the place of the collector/sharing GW is not relevant, in this scenario I place on-prem to avoid the use of rented compute in the cloud, since will be static and no benefit from any cloud feature, also because normally the customer will have some on-prem devices, in case this is not true or they are allowed to pay for a collector machine in the cloud, they can place it.

Re: MUH with VMSS to protect AVD (VDI in Azure)

Chris_Atkinson — Sun, 02 Jan 2022 11:16:08 GMT

Nice work, on a related note I know many have been waiting for the Identity Awareness APIs coming in R81.20.

https://community.checkpoint.com/t5/Product-Announcements/R81-20-EA-Program-Production/bc-p/135943#M1005

For MUH on Windows 10 please see sk177024

Re: MUH with VMSS to protect AVD (VDI in Azure)

Diego_Cambroner — Wed, 29 Dec 2021 15:36:24 GMT

Nice Document!!

Re: MUH with VMSS to protect AVD (VDI in Azure)

Norbert_Bohusch — Thu, 30 Dec 2021 09:20:37 GMT

Nice!

Unfortunately the Word document is protected by Capsule Docs!