topic Re: Check Point Cloud FW on AWS in Cloud Firewall

Check Point Cloud FW on AWS

tropicanaslim — Mon, 08 Jan 2024 12:54:13 GMT

Hi Checkmates,

We are currently redesigning cloud security adoption on AWS, especially in the area of network security.

From the architecture blueprint owned by Check Point and adapting it to the internal design, we see that there are 2 potential designs that we can use:
CloudGuard Network for AWS Auto Scale Group with Transit Gateway and CloudGuard Network for AWS Cross Availability Zone Cluster with Transit Gateway, because we use TGW to connect from Direct Connect and 2 VPCs.

After reading the admin guide, I am still unsure which of the two designs above is suitable for our needs.

Do you guys have any suggestions from Checkmates regarding which design is suitable for us? and what is the difference between the two?

Our situation :

TGW enable
Traffic from DX
2 VPCs
Access from internal and external (public)

Thanks! 🙂

Re: Check Point Cloud FW on AWS

avivs — Mon, 08 Jan 2024 13:48:02 GMT

The main difference between Cross-AZ Cluster and AutoScale is VPN.

If you require the CloudGuard Gateways to act as a VPN termination device, then Cross-AZ Cluster is the way to go.

Otherwise, the AutoScale solution would be recommended.

For a comparison of Public Cloud solutions, please see sk178668

Re: Check Point Cloud FW on AWS

PhoneBoy — Mon, 08 Jan 2024 14:20:42 GMT

More details about your specific requirements and what you're trying to achieve might help.

Re: Check Point Cloud FW on AWS

tropicanaslim — Tue, 09 Jan 2024 07:23:59 GMT

Hi @avivs

Thank you for the answer and suggestions.. CMIIW, means both can be used to protect N/S and E/S traffic, right? and the most obvious difference is only from the VPN side?

Re: Check Point Cloud FW on AWS

tropicanaslim — Tue, 09 Jan 2024 07:26:14 GMT

Hi PhoneBoy,

Sorry if my question is not clear enough. The goals is protecting for E/W and N/S traffic that passes through the transit gateway from public, internal via DX.

I see there are 2 suitable solutions as per my post, but I'm looking for which option is the best.

Re: Check Point Cloud FW on AWS

Roman_Kats — Tue, 09 Jan 2024 13:17:15 GMT

Hi @tropicanaslim

The recommended solution for E/W and N/S is Gateway Load Balancer Autoscaling.
Admin guide: https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Default.htm
Workshop:

https://unrivaled-melba-1a81a6.netlify.app/

In case Site to Site VPN is required the Cross AZ Cluster should be added to architecture.

Thanks,

Roman

Re: Check Point Cloud FW on AWS

Jeff_Engel — Tue, 23 Jan 2024 16:23:04 GMT

In place of the unrivaled melba link above please use this one > https://checkpoint.awsworkshop.io/

@tropicanaslim