topic CloudGuard Blueprint Architecture Diagrams in Cloud Firewall

CloudGuard Blueprint Architecture Diagrams

Maya_Levine — Wed, 16 Jun 2021 19:55:58 GMT

UPDATED JUNE 16, 2021 - AWS Gateway Load Balancer Diagrams and GCP Architecture Diagrams have been added!

This document is designed to help with deciding how to architect cloud environments. It includes reference architectures for multi-cloud and specific cloud providers. It provides a succinct, technical overview of deployment options, highlighting the values and architecture differences of each one.

Re: CloudGuard Blueprint Architecture Diagrams

mk1 — Thu, 29 Oct 2020 08:05:58 GMT

Very useful document! Thank you!

Re: CloudGuard Blueprint Architecture Diagrams

mk1 — Mon, 01 Mar 2021 08:10:39 GMT

Hello @Maya_Levine,

Is there any videos somewhere in the community or in YouTube showing more details about the designs (AWS) in the document? I'd like to know why VPN is used between TGW and Egress VPCs, instead of standard VPC attachment to the TGW. The part with VPC peering between Ingress VPC and the rest of spokes is also interesting.

Thank you!

Re: CloudGuard Blueprint Architecture Diagrams

Maya_Levine — Sun, 19 Dec 2021 13:22:50 GMT

Hello,

With a standard VPC attachment you are bound to the VPC's public routing. The attachments point to a subnet so you can only point to one ENI at a time. This limits you to an HA solution, you cannot use auto-scaling.

We use VPN because in AWS peering is not transitive. The better way to pass traffic across multiple CP instances is VTI (Virtual Tunnel Interfaces). TGW comes with some sort of VPN GW and has ECMP, which will load balance traffic from any source VPC to CP GW. We also use VPNs because we have automation that allows us to build tunnels with the CME (see the Cloud Management Extension R80.10 and Higher Administration Guide). It will automatically take care of everything when a new auto-scaling instance is in the auto-scaling group. It will trigger a script to build site to site VPNs, advertise routes, and more.

In terms of resources, I attached a PDF made by Cloud Security Architect Eugene Tcheby that goes over the differences between TGW-ASG and TGW-HA. You can also check out this webinar which goes over what is required to deploy an auto-scaling group of CG GWs:

https://www.brighttalk.com/webcast/16731/400673?utm_campaign=viewing-history&utm_source=brighttalk-portal&utm_medium=web

Best Regards,

Maya

Re: CloudGuard Blueprint Architecture Diagrams

mk1 — Thu, 04 Mar 2021 07:27:13 GMT

Thank you for your reply and for the useful links and file!