topic Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets in Cloud Firewall

Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Eugene_Tcheby — Mon, 08 Jul 2019 12:31:56 GMT

Hi everyone,

This is a step by step guide I created on how to deploy CloudGuard (Vsec) virtual gateways in Azure using virtual machine scale sets in Microsoft Azure. Feel free to comment, leave feedback or contact me directly should you have questions.

For the full list of White Papers, go here.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Nikhil_Deshmukh — Thu, 26 Apr 2018 05:43:47 GMT

Great Work

Does the API need to be assigned the Role of Reader or Contributor?

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Eugene_Tcheby — Thu, 26 Apr 2018 17:23:30 GMT

Both actually work, Reader Role is the minimal role for autoprovision to work.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Oscar_Medina1 — Mon, 14 May 2018 23:41:04 GMT

Hi Eugene,

I know that the ARM templates are available for the VM Scale Sets. But, is it possible to deploy the Gateway Scale Sets without the ARM template, say in Terraform? I know that the ARM template accepts parameters if this was done in a different way, is there a bootstrap file or something to pass along when creating the VM?

Thank you,
Oscar

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Eugene_Tcheby — Thu, 17 May 2018 16:49:24 GMT

Hi Oscar,

To my knowledge deploying VMSS can only be done using the ARM templates.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Oscar_Medina1 — Thu, 17 May 2018 17:27:08 GMT

Hey Eugene,

Thank you for your response; I'd love to eventually be able to do this in Terraform as we can pass parameters as well or use a user_data file to bootstrap the VM.

Thank again,
Oscar

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Eugene_Tcheby — Mon, 28 May 2018 15:37:17 GMT

Updated Version 1, with changes

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Eugene_Tcheby — Mon, 28 May 2018 15:50:33 GMT

Changes based on feedback received:

- Exercise 9: "LocalGatewayExternal" dynamic gateway object created applies for for Virtual machine types B2s and above (page 33), otherwise traditional dynamic gateway object "LocalGateway" applies.

Added how to configure "Hide NAT" rule in NAT policy (page 37)

- Exercise 10: Added comment on why auto-scaling of CloudGuard virtual gateways average 7-10 minutes despite tweaks in Azure Auto scaling parameters; Mostly due to First Time Wizard. New CloudGuard deployment templates including Blink in the roadmap (page 40)- Document to be updated as soon as images with improvements released.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Oscar_Medina1 — Thu, 31 May 2018 19:17:26 GMT

Thanks Eugene Tcheby‌ . I have what may be a silly question; but must ask. In this deployment where the Gateway is deployed as a Scale Set, what IP address does one use to create new NAT Rules or Policies? The Scale Set has multiple nodes, my understanding they are identical. But how is that tracked from a CheckPoint perspective when it comes to updating NAT Rules and Polices etc?

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Oscar_Medina1 — Thu, 31 May 2018 19:33:23 GMT

I think I found the answer to my own question. It looks like your guide, page 33 talks about a LocalGatewayExternal which handles this if I understand correctly.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Omprakash_Kesar — Thu, 07 Jun 2018 11:02:37 GMT

Hi Eugene, After I created the rule using dynamic object LocalGatewayExternal, I get bellow error when I try to view Logs. I am using VMSS 2 x D3v2 Gateway.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Eugene_Tcheby — Thu, 07 Jun 2018 11:55:46 GMT

Hi Omprakash,

Try running this command on any gateway of your scaleset:

# dynamic_object -l

and observe output as shown on page 34.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Omprakash_Kesar — Thu, 07 Jun 2018 14:01:50 GMT

Hi Eugene, I had tried the same, but sadly ssh connection to gateway not working from management server too. I have created the allow SSH rule (with ssh, icmp services) in Access Control Policy of Gateway (SmartConsole). I have tried with destinations LocalGatewayExternal and also with individual Gateway objects, but no luck.Do we need NSG for fronted subnet? not sure as the rules there are driven by Gateway policy rules itself. Also gateways and management server are in the same frontend subnet. I have followed the document for entire configuration. Everything seems ok, except this final configuration.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Omprakash_Kesar — Thu, 07 Jun 2018 17:26:42 GMT

I manage to establish SSH connection to Gateway. The dynamic object name on both the gateways is "LocalGateway". Now it works as expected, I tried with HTTP and RDP services.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Javier_Hijas — Mon, 23 Jul 2018 06:35:59 GMT

Eugene, Oscar Medina‌, creating this same setup with terraform should be a simple as a terraform template including the same load balancer components and the VMSS with the Check Point image. Note that the Check Point management server will be automatically registering the gateways populated by the VMSS so no need to code anything on that side. Let us know if you have issues terraforming this 😉

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Oscar_Medina1 — Mon, 23 Jul 2018 17:34:05 GMT

Thanks https://community.checkpoint.com/people/jhija3895aba2-c664-3ac5-9425-5b0626caeb0f I ended up using the Azure ARM Templates for our CheckPoint Gateway Scale Sets, but it is awesome to know I can do that, and I should have known that, since it is a matter of picking the image from the gallery and adding the bootstrap script.

I've got similar scenario for our Management Servers which I've deployed in HA mode (primary/secondary). I am using the ARM template and modified it to include adding both nodes into an Availability Set. Do you see anything wrong with doing so? I am just trying to use Azure native capabilities for redundancy...

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Javier_Hijas — Tue, 24 Jul 2018 06:55:21 GMT

Not at all, any combination of Check Point HA capabilities with the cloud platform native HA is always recommended. Distributing across regions and combining on-prem mgmt. with cloud mgmt are also combinations we see in other organizations.

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Oscar_Medina1 — Tue, 24 Jul 2018 16:44:25 GMT

Thanks Javier Hijas‌ . I was thinking it might be helpful to the community if I share the ARM Template that adds the Azure Availability Set. I'll setup a Github repository for it!

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Bogdan_Florin_D — Thu, 27 Sep 2018 08:47:43 GMT

Hi Eugene,

This is a very nice exercise that i will like to perform myself.

Although everything looks straightforward i have something to clear out.

Gateways from scale set - how we can ensure that they have the latest hotfix's included as the scaleset scales out? Is this something that concerns only the Cloud Provider, they should offer the latest images?

Thanks a lot again for this exercise which will help me a lot in mastering this solution.

br,

Re: Deploying Auto Scaling CloudGuard gateways in Azure using VM Scale Sets

Eugene_Tcheby — Fri, 05 Oct 2018 01:45:47 GMT

Hi Bogdan,

When defining your scale set configuration and parameters, essentially what happens when scaling out - the additional virtual gateways being deployed are identical to the ones from your default set of Cloudguard virtual gateways. In short, should you update your original virtual gateways with the latest hotfix, auto scaling will inherit the same gateway configuration from your default virtual machines including latest hotfix if already installed