topic Re: 1500 Appliances Central Management Deployment in Spark Firewall (SMB)

1500 Appliances Central Management Deployment

SecuRemote — Wed, 24 Feb 2021 02:31:13 GMT

We are currently deploying 1500 appliances on the branch offices with a central management that is located on the head office. The 1500 appliances set with a dynamic external interfaces. Does someone have any idea on how to setup central management for the said appliances without a SmartProvisiong license?

Thank you in advance.

Re: 1500 Appliances Central Management Deployment

PhoneBoy — Wed, 24 Feb 2021 04:10:14 GMT

There is a checkbox for Dynamic IP in the relevant gateway object that should be used in this case.
This does not require SmartProvisioning.

Re: 1500 Appliances Central Management Deployment

_Val_ — Wed, 24 Feb 2021 12:07:48 GMT

SmartProvisioning means you manage numerous GWs by setting multiple profiles. Without it, you still can manage DIAP GWs on per GW basis

Re: 1500 Appliances Central Management Deployment

G_W_Albrecht — Wed, 24 Feb 2021 12:29:41 GMT

This is covered step by step in the Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.20 Centrally Managed Administration Guide p.14ff: Small-scale Deployment Installation.

Re: 1500 Appliances Central Management Deployment

SecuRemote — Fri, 26 Feb 2021 01:09:34 GMT

Hi PhoneBoy,

Does this mean that the connection of the branch office gateways (1500 appliances) to the management server that is located on the head office can used a public IP address? What if the said dynamic IP changes frequently, do the management server learn the new IP address without initiating a re SIC on the management server?

Thank you.

Re: 1500 Appliances Central Management Deployment

PhoneBoy — Fri, 26 Feb 2021 07:02:56 GMT

The changing IP won't change the authentication with SIC, which happens using certificates.
The management server needs to have an externally reachable IP (can be via NAT).
The gateway "phones home" to the management when it is DAIP and would be sending logs to the management anyway.

Re: 1500 Appliances Central Management Deployment

SecuRemote — Mon, 01 Mar 2021 01:28:01 GMT

Hi PhoneBoy,

Is there any way to still established SIC on the branch gateways even without requesting a bridge connection on the branch ISP? Since the said gateways are setup behind the ISP modem.

Thanks

Re: 1500 Appliances Central Management Deployment

PhoneBoy — Mon, 01 Mar 2021 05:02:05 GMT

Yes, this will work through NAT as the gateway initiates an outbound connection for this purpose.

Re: 1500 Appliances Central Management Deployment

SecuRemote — Mon, 01 Mar 2021 05:28:53 GMT

Hi PhoneBoy,

Do you have any idea on how to established the SIC without requesting a bridge connection on the local ISP of the branch offices?

Thanks

Re: 1500 Appliances Central Management Deployment

PhoneBoy — Mon, 01 Mar 2021 05:50:23 GMT

As I said previously, the gateway can initiate an outbound connection for this purpose.
This will work with NAT.
You configure the gateway object as described here: https://sc1.checkpoint.com/documents/SMB_R80.20.20/AdminGuides/Centrally_Managed/EN/Topics/Small-scale-Deployment-Installation.htm?tocpath=Small-scale%20Deployment%20Installation%7C_____4#Defining_a_Gateway_Object
Then, in the First Time Wizard for the appliance, specify the public Management IP.

Re: 1500 Appliances Central Management Deployment

SecuRemote — Mon, 01 Mar 2021 06:32:09 GMT

Hi PhoneBoy,

Does the gateway object automatically created on the SmartConsole even without SmartProvisioning if we used the Gateway first on the guide?

Thanks

Re: 1500 Appliances Central Management Deployment

PhoneBoy — Mon, 01 Mar 2021 07:05:59 GMT

You have to manually create the gateway object on the management as described in the guide.
SmartProvisioning is not involved at all.

Re: 1500 Appliances Central Management Deployment

SecuRemote — Tue, 02 Mar 2021 08:35:06 GMT

Hi PhoneBoy,

Do you have any idea on how to established SIC on a 5100 appliance that is located to a branch office with a dynamically assigned public IP? The management server is located on the cetral office.

Thanks

Re: 1500 Appliances Central Management Deployment

G_W_Albrecht — Tue, 02 Mar 2021 09:34:40 GMT

This is documented in Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.20 Centrally Managed Administration Guide p.14ff - i would suggest to read about establishing SIC first, then choose one of the methods explained there 8)

I have pointed out this document on 24.2., PhoneBoy again on 1.3. - i would suggest to start reading as your questions are broadly covered there ...

Re: 1500 Appliances Central Management Deployment

PhoneBoy — Tue, 02 Mar 2021 19:45:26 GMT

Works more or less the same way as for SMB appliances: The gateway needs to be flagged as DAIP in the object.
In the case of a non-SMB gateway, SmartConsole will ask for the current public IP when establishing SIC.
See more here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk167473

Note that for a non-SMB gateway behind NAT, several ports may need to be forwarded on the NAT device.
See: https://community.checkpoint.com/t5/Security-Gateways/R80-x-Ports-Used-for-Communication-by-Various-Check-Point/m-p/38153#M3090

Re: 1500 Appliances Central Management Deployment

SecuRemote — Thu, 04 Mar 2021 00:50:56 GMT

This will be noted.

Thank you!