Config - Arista Macro Segmentation Service (MSS) + Check Point

HeikoAnkenbrand — Thu, 20 May 2021 17:23:25 GMT

Modern day applications deployed in the data centers have become multi-tiered and distributed. This has resulted in an increase
in the amount of east-west traffic seen in the data centers. This includes traffic from physical-to-physical (P-to-P), virtual-to-virtual (V-to-V), and between physical and virtual (P-to-V) workload.

Arista Macro-Segmentation Service (MSS) provides a software-driven dynamic and scalable network service to logically insert
security devices into the path of traffic with complete flexibility on placement of security devices and workloads. It is specifically
aimed at physical-to-physical (P-to-P) and physical-to-virtual (P-to-V) workloads.
What makes MSS unique is that it places the control of policy enforcement directly in the hands of security administrators. This is
accomplished using standards based forwarding with no proprietary frame formats and without placing limitations on where the
service devices must exist within the network.

Arista MSS Deployment Mode:

Many data centers have firewalls deployed in layer-3 mode, acting as first hop for the hosts, serving applications. The Layer 3 Firewall
is connected to the network and configured to enforce policy between different security zones or endpoints.
Instead of using routing policy to attract traffic to the firewall, the Macro-Segmentation Service redirects traffic to the firewall,
dynamically inserting it into the path for traffic between relevant endpoints. L3 Firewall is not configured as a gateway for the
subnet.

Requirements:

• Arista CloudVision running EOS release 4.23.2F or later
• Management Server Versions
• Version R80.30 with API version 1.5 (and above). In addition to this Management Server version, Check Point has provided
a “hot fix” that provides a “Proxy API” ability which allows the user to access the Gateway APIs through a special URL on the
Management Server. This hot-fix is required for MSS to work.
• Gateway Versions: Version R80.30 with API version 1.2 (and above)

Config example:

Direct Flow is enabled on all TOR switches with 100Gbps Interfaces:

! cvx no shutdown ! service mss no shutdown policy enforcement rules verbatim ! dynamic device-set checkpoint device 10.0.0.200 username admin password 7 xxxxxxxxxxxxxxxx protocol https 4434 group poc-mss state active type check-point management-server policy tag redirect MSS_redirect policy tag offload MSS_offload policy tag modifier verbatim MSS_verbatim ! service vxlan no shutdown

Check Point:

Interface Configurations:

Interfaces configured in aggregation groups bond1.100 and bond1.200. bond1.100 is part of the zone ‘Tenant C’ and bond1.200 is
part of the zone ‘Tenant D’

Route Configuration:

The firewall needs to have routes back to the original subnets in which the end hosts reside. Static routes have been created for each subnet. Default GW for the Tenant C subnets is the VLAN 10 interface on the TOR and for Tenant D subnets its the VLAN 20 interface on the TOR.

Policy Configuration:

For Tenant C:
• Web servers can talk to each other directly only on port 443 or port 80 the web servers are connected directly on the same VLAN and IP subnet.
• Web Servers can communicate with the proxy servers on port 8080 HTTP as well.
For Tenant D :
• Web servers can talk to each other directly only on port 443 or port 80 the web servers are connected directly on the same VLAN and IP subnet.

For Tenant C, firewall policy tags defined as “MSS-redirect” (red) are enforced by the Active Firewall.

For Tenant C for proxy, Firewall tags defined as “MSS-offload” (blue) are enforced by the Arista switches locally without being redirected to the Active firewall.

Re: Config - Arista Macro Segmentation Service (MSS) + Check Point

HeikoAnkenbrand — Wed, 19 May 2021 09:22:50 GMT

Is there detailed documentation from Check Point side for this Arista MSS feature with configuration examples?

Re: Config - Arista Macro Segmentation Service (MSS) + Check Point

bogdanp — Sat, 04 Dec 2021 11:02:19 GMT

Hello,

I am also interested in this solution. The only documents I have found so far regarding this solution were on the Arista websites (Arista EOS Central).

If someone has more input on this topic, I think it is trully welcomed.

Re: Config - Arista Macro Segmentation Service (MSS) + Check Point

HeikoAnkenbrand — Sun, 05 Dec 2021 13:47:29 GMT

Hi @bogdanp,

Unfortunately there are no official document from Check Point here.

I would contact a local Check Point SE.

topic Re: Config - Arista Macro Segmentation Service (MSS) + Check Point in Firewall and Security Management

Config - Arista Macro Segmentation Service (MSS) + Check Point

Re: Config - Arista Macro Segmentation Service (MSS) + Check Point

Re: Config - Arista Macro Segmentation Service (MSS) + Check Point

Re: Config - Arista Macro Segmentation Service (MSS) + Check Point