topic Re: Scalable Remote Access VPN with CloudGuard IaaS: Video, Slides, and Q&A in SASE and Remote Access

Scalable Remote Access VPN with CloudGuard IaaS: Video, Slides, and Q&A

PhoneBoy — Tue, 21 Jul 2020 21:38:31 GMT

Materials available to CheckMates members:

Q&A from the session:

Can we use a single VMSS for Access to Azure Applications/Resources, Site-to-Site VPN, and Remote Access VPN?

The same VMSS deployment can be used for inbound, outbound, and east-west traffic inspection, and for Remote Access VPN. No site-to-site support at this time, but you set up a separate Check Point Cluster or Gateway for this.

Is Remote Access VPN Load Balanced using MEP?

No, it is using DNS.

Is this configuration documented?

The existing CloudGuard IaaS Admin Guides will be updated to fully document this new feature.

If I use BYOL, do I need to have licenses for the autoscaling gateways?

Yes. The licenses will be distributed via the Central Licensing Tool similar to existing NGTP/NGTX licenses. You will need to purchase the appropriate Remote Access VPN licenses.

How was this environment built?

Using an Azure ARM template, which will be available via Github and the Azure Marketplace.

Given a user can terminate on any gateway, how is symmetry maintained?

Using HIDE NAT, which each gateway is doing.

How is the VPN client dynamically updated with the current VPN gateways in the VMSS?

This is done using DNS, which requires a specific version of the VPN client currently. Over time, this should result in load balancing.

Is there a way to force "round robin" selection of the Remote Access gateway?

Not currently. We will add additional mechanisms over time.

Do PAYG licenses include Remote Access capabilities?

Yes.

Is Office Mode supported?

Yes, each gateway uses the same Office Mode pool. However, the end user is subject to HIDE NAT to maintain symmetry.

Does the VPN client see a fingerprint change if it connects to a different scale set member?

No.

Will this design become a SASE solution?

This is similar to a SASE solution, except you build it/manage it yourself. CloudGuard Connect is our SASE solution, which operates "as a service."

Re: Scalable Remote Access VPN with CloudGuard IaaS: Video, Slides, and Q&A

Xiaojiang_Wen — Wed, 05 Aug 2020 12:05:56 GMT

Does it support autoscaling on AWS?

Re: Scalable Remote Access VPN with CloudGuard IaaS: Video, Slides, and Q&A

PhoneBoy — Thu, 06 Aug 2020 01:36:00 GMT

Not yet, but believe this is planned.

Re: Scalable Remote Access VPN with CloudGuard IaaS: Video, Slides, and Q&A

Will_Hargreaves — Mon, 12 Oct 2020 16:12:54 GMT

Does this solution work when connecting via Mac OS based clients?

Re: Scalable Remote Access VPN with CloudGuard IaaS: Video, Slides, and Q&A

kusch444 — Wed, 25 Nov 2020 07:43:27 GMT

PAYG licenses include Remote Access capabilities means unlimited?

Re: Scalable Remote Access VPN with CloudGuard IaaS: Video, Slides, and Q&A

Kamil_Kolo — Tue, 27 Apr 2021 21:17:34 GMT

How many remote users can this scale up to? Or, how many remote users can each Gateway support?

Re: Scalable Remote Access VPN with CloudGuard IaaS: Video, Slides, and Q&A

Kamil_Kolo — Fri, 07 May 2021 22:39:38 GMT

Hello,

Any update on this solution being supported in AWS with Auto-scaling?

Thank you!