topic Re: VPN deployment in SMB appliances through Zero Touch in Spark Firewall (SMB)

VPN deployment in SMB appliances through Zero Touch

Conchi_Maseda_P — Fri, 17 Aug 2018 06:50:12 GMT

hi, I have a doubt regarding deploying SMB appliances through Zero Touch. We successfully run Zero Touch Orchestrated Rollout in our laboratory, but now we want to stablish a vpn between each SMB appliance (defined in demo-profile) and a central Gateway. Where do you define "vpn domain" in demo-profile?
best regards

Re: VPN deployment in SMB appliances through Zero Touch

G_W_Albrecht — Fri, 17 Aug 2018 09:38:54 GMT

Afaik, Zero Touch replaces the First Time Wizard only - VPN config must be deployed using policy install and is defined in dashboard.

Re: VPN deployment in SMB appliances through Zero Touch

Pedro_Espindola — Fri, 17 Aug 2018 14:34:07 GMT

You can run a script with zero touch. Use "set vpn site-to-site" command in your script to configure the blade and "add vpn site" command to configure the sites.

Check the Check Point R77.20.80 600/700/1100/1200R/1400 Appliance CLI Guide for more information.

Re: VPN deployment in SMB appliances through Zero Touch

Conchi_Maseda_P — Mon, 20 Aug 2018 07:41:03 GMT

Hi Pedro, thank you for your comment, may i write the commands on "rollout.py" file? or am I wrong?

i tried but i get a "SyntaxError: invalid syntax"

best regards

Re: VPN deployment in SMB appliances through Zero Touch

G_W_Albrecht — Mon, 20 Aug 2018 08:07:51 GMT

Please see CP ZeroTouch Users Guide p. 8:

In the claimed gateways table, double click your gateway to open the Edit window. Modify your gateway settings: CLI Script - Use this text field to add CLI commands that are executed on the gateway after all the other settings are applied.

Here you can use clish commands, see Check Point R77.20.80 600/700/1100/1200R/1400 Appliance CLI Reference Guide for syntax details.

Re: VPN deployment in SMB appliances through Zero Touch

Pedro_Espindola — Tue, 21 Aug 2018 13:25:23 GMT

Just add the script in the "CLI Script" text box of the claimed gateway in the Zero Touch Page.

Once the gateway connects to Zero Touch, it will set the other configs first and then run the commands from the script.

Remember that you have to reset the gateway for it to pull configuration from Zero Touch again.