topic Re: Checkpoint firewall in SPAN mode in Google cloud in Cloud Firewall

Checkpoint firewall in SPAN mode in Google cloud

Narsimha_Rao_Ko — Thu, 24 Sep 2020 07:33:08 GMT

We were testing R80.40 CP Firewall in SPAN mode in Google cloud. But it is not working. It seems to be not working if we assign an IP address to the SPAN interface but that is what’s required in GCP for getting mirror traffic from the load balancer.

Re: Checkpoint firewall in SPAN mode in Google cloud

Ofir_Shikolski — Thu, 24 Sep 2020 13:37:42 GMT

AFAIK there is a product that can do it : https://community.checkpoint.com/t5/SandBlast-Now/bd-p/sandblast-now

Re: Checkpoint firewall in SPAN mode in Google cloud

Narsimha_Rao_Ko — Thu, 24 Sep 2020 15:36:15 GMT

Thanks for the update.

We actually trying to use the Mirroring feature of Google Cloud Platform (GCP) to get the data from load balancer to CP firewall. It requires the IP address needs to be assigned to SPAN interface for the load balancer to send the data. But when we assign the IP, CP firewall dropping all the packets which are coming to SPAN interface saying 'missing OS route'

Can you suggest which CP product we have to choose in GCP Marketing place for this to work?

Re: Checkpoint firewall in SPAN mode in Google cloud

Nir_Naaman — Thu, 24 Sep 2020 18:18:22 GMT

A firewall is a layer 3 device and as such is not applicable to a traffic mirroring scenario. Traffic mirroring is typically used for IDS or NDR solutions. As Ofir indicated above, CloudGuard Now (the cloud variant of SandBlast Now) is such a product, and can indeed interoperate with GCP traffic mirroring. However, CloudGuard Now for GCP is not in General Availability yet, so if you're interested in trying it out, please contact me offline. See the SandBlast Now product brief for more details.

Re: Checkpoint firewall in SPAN mode in Google cloud

Narsimha_Rao_Ko — Wed, 14 Oct 2020 14:11:56 GMT

Thanks for the info. I will send you an email for further details.

Re: Checkpoint firewall in SPAN mode in Google cloud

Narsimha_Rao_Ko — Thu, 15 Oct 2020 02:57:55 GMT

Can you please provide me with your email id?

Re: Checkpoint firewall in SPAN mode in Google cloud

PhoneBoy — Thu, 15 Oct 2020 03:15:49 GMT

I’ll make sure @Nir_Naaman has your email and contacts you.