topic Re: Need to enable Geo Fencing on CLoudguard IaaS with External ALB(Application Load Balancer) in Firewall and Security Management

Need to enable Geo Fencing on CLoudguard IaaS with External ALB(Application Load Balancer)

avi3383 — Sat, 26 Jun 2021 05:06:29 GMT

Hi,

We have deployed Cloudguard IaaS security gateway on AWS cloud for inbound and Northbound traffic with AWS External Application Load Balancer.

There are multiple application hosted in customer AWS account behind same Cloudguard IaaS gateway.

Now We have a requirement to apply Geo fencing restriction on all application and These should be only accessible from INDIA only.

I have created a access policy with updateable object on firewall to achieve the same.

But in this case I am not seeing client real public IP in traffic on firewall. ALB send the traffic to firewall with its own private IPs. So in this case traffic is not hitting that rule.

Kindly let me know how we can archive this.

Re: Need to enable Geo Fencing on CLoudguard IaaS with External ALB(Application Load Balancer)

PhoneBoy — Sat, 26 Jun 2021 16:14:18 GMT

This has been supported for a while using the XFF headers that the ALBs should be providing (or can be configured to provide).
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk115532&partition=Advanced&product=CloudGuard
However, this may only apply to the legacy Geo Filtering and not the mechanism with Updatable Objects.
@Micky_Michaeli do you happen to know for sure?

Re: Need to enable Geo Fencing on CLoudguard IaaS with External ALB(Application Load Balancer)

avi3383 — Mon, 05 Jul 2021 13:22:46 GMT

Thanks for your reply...you are correct we can achieve this by Geo Policy...but first achieve this I have to enable https inspection on same traffic to inspect by firewall/IPS.I need certificate to enable https inspection on firewall.

In my environment team is using Amazon public certificate on ALB and managing it through ACM(Amazon certificate Manager).Due to ACM limitation public certificate can't be export outside from ACM.

Due to this limitation I am not able to find the certificate and not able to import in checkpoint firewall and So https inspection not able to enable.

Kindly let me know how to enable https inspection on my checkpoint firewall in this scenario....and achieve Geo fencing restriction.

It will be very helpful your reply.

Re: Need to enable Geo Fencing on CLoudguard IaaS with External ALB(Application Load Balancer)

_Val_ — Mon, 05 Jul 2021 14:09:14 GMT

It looks like the most reasonable way would be to enable geo-fencing on the load balancer itself.

Re: Need to enable Geo Fencing on CLoudguard IaaS with External ALB(Application Load Balancer)

PhoneBoy — Wed, 07 Jul 2021 00:02:01 GMT

You'd actually need the private key in order to do inbound HTTPS Inspection.
Unless the ALB can provide a cleartext version of the traffic or the relevant private key, there's not much we can do on the Check Point side of things.