topic Re: Avoid Initial Policy - "Zero Touch" Deployment in Firewall and Security Management

Avoid Initial Policy - "Zero Touch" Deployment

CheckPointerXL — Fri, 19 Apr 2024 14:36:37 GMT

Hi all,

sometimes it happens that we need to configure FWs and then sent to Datacenter/branch offices.

At startup FWs load Initial Policy, so we cannot connect from MPLS or Internet. Every time console access is needed to perform fw unloadlocal.

Any workaround?

Re: Avoid Initial Policy - "Zero Touch" Deployment

Lloyd_Braun — Fri, 19 Apr 2024 18:47:02 GMT

You can customize the default filter policy:

Boot Security (checkpoint.com)

Re: Avoid Initial Policy - "Zero Touch" Deployment

D_W — Fri, 19 Apr 2024 21:34:14 GMT

We always prepare the GWs in our HQ before sending them out to the Sites. Including all Gaia Settings, established SIC and correct policy installed. Last thing before shipping is to change the WAN IP and default Route in Gaia and change the Main IP also in the Management. Only thing to do When it gets connected at the Site is to install the policy again to „activate“ the new WAN IP.

Re: Avoid Initial Policy - "Zero Touch" Deployment

D_W — Fri, 19 Apr 2024 21:35:06 GMT

Good to know that this is also possible. 👍

Re: Avoid Initial Policy - "Zero Touch" Deployment

PhoneBoy — Fri, 19 Apr 2024 22:06:38 GMT

You realize we have a Zero Touch service that can assist with this:? https://sc1.checkpoint.com/documents/SMB_R80.20.15/AdminGuides/Locally_Managed/EN/Topics/Zero-Touch-Cloud-Service.htm
See also: https://welcome.checkpoint.com (production) or https://welcome-stg.checkpoint.com (Staging) which offers another mechanism to onboard appliances.