AWS CloudGuard IaaS: Change external interface topology via cli/bash

rjpereira — Mon, 17 Feb 2020 20:45:05 GMT

Hi.

I have a deployment of a R80.40 AMI, dual homed, with eth0 on a private subnet and eth1 on a public subnet.

On the cloud-init script, I remove the default route from eth0, add it to eth1, and add a static route for 10.0.0.0/8 on eht0.

When Management server tries to auto-configure it via tagging it is failing saying that "all the interfaces have a EXTERNAL policy, that is not allowed".

I confirm that if I go through SmartConsole, and change the topology of eth0 to Internal the error disappears.

The problem that I have is that I want to script this change using cli, or know how I could avoid the problem in a first instance.

Any suggestions ?

Thanks in advance

Re: AWS CloudGuard IaaS: Change external interface topology via cli/bash

PhoneBoy — Thu, 20 Feb 2020 00:45:51 GMT

You've asked this question a second time here: https://community.checkpoint.com/t5/CloudGuard-IaaS/Multi-homed-EC2-How-to-force-topology-for-auto-provisioning/m-p/75663#M1631
As that thread has discussion, I am going to lock this thread.

topic Re: AWS CloudGuard IaaS: Change external interface topology via cli/bash in Cloud Firewall

AWS CloudGuard IaaS: Change external interface topology via cli/bash

Re: AWS CloudGuard IaaS: Change external interface topology via cli/bash