topic Re: Build Your Own POC (BYOPoC) - CloudGuard GWLB Reference Architecture in Cloud Firewall

Build Your Own POC (BYOPoC) - CloudGuard GWLB Reference Architecture

Jeff_Engel — Mon, 24 Oct 2022 16:54:39 GMT

Hi Everyone,

We are starting a new initiative whereby we give everyone(customers, partners, Check Pointers, etc.) the ability to quickly and easily stand up an otherwise complex architecture featuring various CloudGuard products and product integrations using IaC.

In our first installment, we have built out an entire deployment of CloudGuard Network Security integrated with AWS Gateway Load Balancer with an AWS CloudFormation template and provided step-by-step instructions on the process.

This does assume that you have a lab and/or sandbox of some kind in order to build this environment in.

Please let us know what you think. We have plans to do many of these and keep them updated.

CHECK POINT CLOUDGUARD NETWORK SECURITY - INTEGRATION WITH AWS GATEWAY LOAD BALANCER

Thanks!

Jeff Engel

Re: Build Your Own POC (BYOPoC) - CloudGuard GWLB Reference Architecture

Bryan-Smith — Tue, 25 Oct 2022 16:55:37 GMT

@Jeff_Engel one thing to note you have to select an AMI that you are subscribed too. I did not have access to the AWS Jams "...

BYOL-WorkshopVersion" AMI. Just wanted to pass that along. If I come across anything else, I'll post it here.

Re: Build Your Own POC (BYOPoC) - CloudGuard GWLB Reference Architecture

Jeff_Engel — Wed, 26 Oct 2022 04:40:19 GMT

Thanks for the feedback @Bryan-Smith! I will get that added to the documentation.

Re: Build Your Own POC (BYOPoC) - CloudGuard GWLB Reference Architecture

Bryan-Smith — Wed, 26 Oct 2022 14:17:28 GMT

@Jeff_Engel - For some reason the Cloud Management Extension (CME) was not running on the manager as well. I had to run the following command to get the gateways to add to the Manager (SMS):

autoprov_cfg init AWS -mn "gwlb-management-server" -tn "gwlb-ASG-configuration" -otp "checkpoint" -ver R80.40 -po "AWS-TGW-ASG" -cn "AWSJAMS" -r "us-east-1" -ak XXXXXXXXXRTXD -sk XXXXXXXXXXXXXXXXXXXX

CME Structure and Configurations (checkpoint.com)

Helpful command for seeing CME logs in real-time --> tail -f /var/log/CPcme/cme.log

This probably isn't an issue if you are using R81.10-BYOL-WorkshopVersion AMI which might have the preconfigured CME config. Everything else seems to work great! Thanks for sharing.

I attached the Managment Server CFT that ran if it helps.

Re: Build Your Own POC (BYOPoC) - CloudGuard GWLB Reference Architecture

Jeff_Engel — Fri, 17 Feb 2023 00:54:53 GMT

Hi Everyone,

Just a heads up that this workshop has been updated to support R81.20.

Please use this CFT to build this environment in your own subscription > CloudGuard/GWLB Workshop CFT

Re: Build Your Own POC (BYOPoC) - CloudGuard GWLB Reference Architecture

Jeff_Engel — Fri, 17 Feb 2023 00:57:35 GMT

Just to follow up on this, I updated the workshop to support R81.20 and updated the CFT to include new launch templates now being deployed with all of our CFTs which may have resolved this issue as I did not have to do any post setup work to get it functioning.

Tested combinations:

- R81.20 Mgmt with R80.40 Gateways

- R81.20 Mgmt with R81.20 Gateways

Re: Build Your Own POC (BYOPoC) - CloudGuard GWLB Reference Architecture

Jeff_Engel — Fri, 17 Feb 2023 01:14:37 GMT

Also a reminder that you will need to subscribe to the following Check Point software listings(depending on desired deployment) within the AWS marketplace before running the CFT.

Check Point Security Management - BYOL

Check Point Security Management - PAYG

Check Point Security Gateways - R80.40 for Gateway Load Balancer - BYOL

Check Point Security Gateways - R80.40 for Gateway Load Balancer - PAYG

Check Point Security Gateways - R81.20 - BYOL

Check Point Security Gateways - R81.20 - PAYG