topic Re: How to create object for private cloud Kubernetes on SmartConsole in Cloud Firewall

How to create object for private cloud Kubernetes on SmartConsole

JohnnyWang — Tue, 03 Sep 2024 13:20:06 GMT

Dear Guy,

I would like to find some help with creating a private cloud object for Kubernetes with Check Point on SmartConsole. On Fortigate we can find and create that object easily, but on Check Point we don't know how to do it?

Has anyone done this yet?

Step create on Fortigate, I don't know with filter field we have to use replicate.

Re: How to create object for private cloud Kubernetes on SmartConsole

PhoneBoy — Tue, 03 Sep 2024 14:41:24 GMT

You need to configure it in CloudGuard Controller first.
See: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CloudGuard_Controller_AdminGuide/Content/Topics-CGRDG/Supported-Data-Centers-Kubernetes.htm

Re: How to create object for private cloud Kubernetes on SmartConsole

JohnnyWang — Wed, 04 Sep 2024 01:35:59 GMT

Dear PhoneBoy,

We are using Maestro, not cloudguard. We see on SmartConsole that there is Object Data Center. But I don't know how it will configure the filter similar to Fortigate.

Re: How to create object for private cloud Kubernetes on SmartConsole

Chris_Atkinson — Wed, 04 Sep 2024 02:09:41 GMT

CloudGuard controller is a management component that allows you to integrate with your datacenter object repository.

Once the CloudGuard controller is connected you can then import objects for use within your security policy.

Re: How to create object for private cloud Kubernetes on SmartConsole

JohnnyWang — Wed, 04 Sep 2024 03:17:33 GMT

I have made the connection to kubernetes and filter the same image below, are these parameters shown below dependent on Kubernetes configuration? Because I configured according to the link PhoneBoy sent, but I can't find the parameter for hostname similar to Fortigate?

Re: How to create object for private cloud Kubernetes on SmartConsole

PhoneBoy — Wed, 04 Sep 2024 14:23:44 GMT

This provides access to all the objects defined in your Kubernetes datacenter, which can then be imported in your Access Policy individually.
What is your precise goal here?

Re: How to create object for private cloud Kubernetes on SmartConsole

JohnnyWang — Thu, 05 Sep 2024 01:16:47 GMT

Dear PhoneBoy,

As the post title says, I'm looking for a way to map the connection configuration to Kubernetes similar to Fortigate on Check Point. Below link configure on Fortigate.

Collecting only node IP addresses with Kubernetes SDN connectors | FortiGate Private Cloud 7.2.0 | Fortinet Document Library

Specifically, on fortigate, a Kubernetes object will be configured and the object will be filtered by Hostname. That means, if the user changes the IP of the Kubernetes server, this object will automatically update the new IP without any action from the administrator to edit the Object.

In Fortigate it is called Dynamic Object, I looked at Check Point's Dynamic Object, but it doesn't seem to be the same. Only the Data Center configuration is similar to the FortiGate configuration above.

Re: How to create object for private cloud Kubernetes on SmartConsole

PhoneBoy — Thu, 05 Sep 2024 15:12:55 GMT

I'm not seeing where in the Fortinet documentation the IP address of the Kubernetes Connector itself (kuber_cloud, IP "35.236.76.254") can change.
This is equivalent to the Data Center object you created on the Check Point side.

What I suspect you're looking for is all the IPs used within the Kubernetes cluster.
I believe this can be done with a Data Center Query object: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CloudGuard_Controller_AdminGuide/Content/Topics-CGRDG/Integrating-with-Data-Center-Servers.htm#Data_Center_Query_Objects

Also, adding individual objects from the list you showed to the policy allows for much more granular policy creation.
When those objects change IP addresses in the Data Center, they will automatically update in the Access Policy as well.

Re: How to create object for private cloud Kubernetes on SmartConsole

JohnnyWang — Fri, 06 Sep 2024 09:08:08 GMT

Dear PhoneBoy,

Many thanks! I was also thinking about data center query would be what I need. I will try it.

Also I have a side issue, specifically related to NAT, if you have experience with this could you please clarify it for me?

It is the "S" and "H" symbols in object translate in NAT rule. What does it mean?

Re: How to create object for private cloud Kubernetes on SmartConsole

Alex- — Fri, 06 Sep 2024 09:18:23 GMT

S = Static NAT, 1-1

H = Hide NAT, Many-to-One