topic Re: Smart-1 Cloud with onPrem Gateways (replacing existing edge 3rd-party firewalls) in General Topics

Smart-1 Cloud with onPrem Gateways (replacing existing edge 3rd-party firewalls)

L3on — Tue, 28 Jan 2025 10:34:40 GMT

Hello everyone,

I'm trying to setup an OnPrem cluster with Smart-1 Cloud management.

Quantum Security Gateways version: R81.20 JHF Take 89

I've followed the "Quantum Smart-1 Cloud Admin Guide" to connect the gateways.
I 've managed to create the cluster in Smart Console, connect the gateways to Smart-1 Cloud and establish SIC successfully.

A bit about the topology.
I need to replace the existing 3rd-Party edge firewalls. I have to use the same IP addresses for the external and internal interfaces as the existing firewalls (apart from the MGMT).
In the attached topology picture we see the Checkpoint Gateway Cluster connected only to the management network (as only the MGMT IPs are unique).

Currently I have default route via the MGMT interfaces. So the MaaS Tunnels have been established via the MGMT interfaces (temporarily set as external during initial setup).
All interfaces are physically disconnected apart form the MGMT interfaces.
Please find attached the screenshot with the Network Management picture of the cluster.

One strange thing is that the Cluster member IPs have not been automatically changed to the maas_tunnel IPs. However, everything seems to be working fine.

During the migration phase, I plan to change the default route of the Gateways (as well as some other specific routes) so that the Gateways reach the Internet via the edge router (outside interface).

My QUESTION is: will the MaaS_Tunnels be re-established via the external interfaces?
Should I consider NAT before the default route change? The outside interface of the Gateways use public IPs.
I also have the option "Hide internal networks behind the Gateway's external IP" disabled.
Should I also change the IP of the cluster from private to the public IP?

I'd appreciate your input in this..
I'm at your disposal for any clarification.

Re: Smart-1 Cloud with onPrem Gateways (replacing existing edge 3rd-party firewalls)

PhoneBoy — Tue, 28 Jan 2025 14:39:22 GMT

As long as the gateways can reach out via port 443 to our cloud, the IP which they appear to come from shouldn't matter.
Having said that, if you're changing the interfaces/routing, it's possible a cprestart or similar may be needed.
In case there are issues after doing so, check the troubleshooting steps here: https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Check-Point-SmartCloud-Admin-Guide/Topics-Smart-1-Cloud/Troubleshooting.htm

Re: Smart-1 Cloud with onPrem Gateways (replacing existing edge 3rd-party firewalls)

L3on — Tue, 28 Jan 2025 15:08:40 GMT

Thank you for your prompt response!
I'll try 'cpstop'/'cpstart' and keep you posted..

Re: Smart-1 Cloud with onPrem Gateways (replacing existing edge 3rd-party firewalls)

G_W_Albrecht — Tue, 28 Jan 2025 15:23:16 GMT

You could also call CP TAC to be on standby during the migration in case anything goes wrong!

Re: Smart-1 Cloud with onPrem Gateways (replacing existing edge 3rd-party firewalls)

the_rock — Tue, 28 Jan 2025 18:14:31 GMT

What does maas_tunnel show from fw ifconfig command? Also, what is the status in S1C portal for the gateways?

Andy

When all works, below is what you would see when running maas status command from the fw:

maas status
MaaS Status: Enabled
MaaS Tunnel State: Up
MaaS domain-name: *****************.maas.checkpoint.com
Connected to Infinity Portal: https://cloudinfra-gw-us.portal.checkpoint.com
Gateway IP for MaaS Communication: 100.64.0.1

Re: Smart-1 Cloud with onPrem Gateways (replacing existing edge 3rd-party firewalls)

L3on — Wed, 29 Jan 2025 08:08:28 GMT

Thank you for your response!

Please find attached the screenshot from S1C Portal.

Interfaces on GWY#01:

[Expert@CheckPoint01:0]# ifconfig

Mgmt Link encap:Ethernet HWaddr 00:1C:7F:C3:CA:78

inet addr:10.1.6.52 Bcast:10.1.6.255 Mask:255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:1929565 errors:0 dropped:0 overruns:0 frame:0

TX packets:1864370 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:357377407 (340.8 MiB) TX bytes:235796941 (224.8 MiB)

Mgmt:1 Link encap:Ethernet HWaddr 00:1C:7F:C3:CA:78

inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

Sync Link encap:Ethernet HWaddr 00:1C:7F:C3:CA:77

inet addr:169.254.22.1 Bcast:169.254.22.3 Mask:255.255.255.252

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:17609446 errors:0 dropped:0 overruns:0 frame:0

TX packets:17114981 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:3216375377 (2.9 GiB) TX bytes:2179704654 (2.0 GiB)

eth1 Link encap:Ethernet HWaddr 00:1C:7F:C3:CA:6F

inet addr:172.16.0.2 Bcast:172.16.0.255 Mask:255.255.255.0

UP BROADCAST MULTICAST MTU:1500 Metric:1

RX packets:1978574 errors:0 dropped:0 overruns:0 frame:0

TX packets:156032 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:263979275 (251.7 MiB) TX bytes:18522867 (17.6 MiB)

eth2 Link encap:Ethernet HWaddr 00:1C:7F:C3:CA:71

inet addr:192.168.68.2 Bcast:192.168.71.255 Mask:255.255.248.0

UP BROADCAST MULTICAST MTU:1500 Metric:1

RX packets:12185 errors:0 dropped:0 overruns:0 frame:0

TX packets:13020 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:2636284 (2.5 MiB) TX bytes:1271910 (1.2 MiB)

eth7 Link encap:Ethernet HWaddr 00:1C:7F:C3:CA:74

inet addr:10.5.208.3 Bcast:10.5.223.255 Mask:255.255.240.0

UP BROADCAST MULTICAST MTU:1500 Metric:1

RX packets:6112 errors:0 dropped:0 overruns:0 frame:0

TX packets:12960 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:734518 (717.3 KiB) TX bytes:1258796 (1.2 MiB)

eth8 Link encap:Ethernet HWaddr 00:1C:7F:C3:CA:76

inet addr:195.x.x.251 Bcast:195.x.x.255 Mask:255.255.255.0

UP BROADCAST MULTICAST MTU:1500 Metric:1

RX packets:301594 errors:0 dropped:0 overruns:0 frame:0

TX packets:148139 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:47032214 (44.8 MiB) TX bytes:85654052 (81.6 MiB)

lo Link encap:Local Loopback Media:unknown(auto)

inet addr:127.0.0.1 Mask:255.0.0.0

UP LOOPBACK NOTRAILERS RUNNING NOARP ALLMULTI MULTICAST DYNAMIC MTU:65536 Metric:1

RX packets:1499240 errors:0 dropped:0 overruns:0 frame:0

TX packets:1499240 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:484885542 (462.4 MiB) TX bytes:484885542 (462.4 MiB)

maas_tunnel Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00

inet addr:100.100.x.91 P-t-P:100.64.0.52 Mask:255.255.255.0

UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1

RX packets:122876 errors:0 dropped:0 overruns:0 frame:0

TX packets:106544 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:500

RX bytes:59780882 (57.0 MiB) TX bytes:110292654 (105.1 MiB)

'maas status' output from GWY#01:

[Expert@CheckPoint01:0]# maas status

MaaS Status: Enabled

MaaS Tunnel State: Up

MaaS domain-name: ******************.maas.checkpoint.com

Connected to Infinity Portal: https://cloudinfra-gw.portal.checkpoint.com

Gateway IP for MaaS Communication: 100.100.x.91

Re: Smart-1 Cloud with onPrem Gateways (replacing existing edge 3rd-party firewalls)

L3on — Fri, 31 Jan 2025 15:32:25 GMT

No service restart was required.
As soon as the gateways were able to get DNS & Internet Access after the default route change, the tunnels got re-established straightaway!

Re: Smart-1 Cloud with onPrem Gateways (replacing existing edge 3rd-party firewalls)

the_rock — Fri, 31 Jan 2025 15:35:04 GMT

Great job!