AWS CloudGuard - Security Gateways Auto Scaling Group for Gateway Load Balancer (GWLB)

[Finner1976]

Scenario: We have Production deployments in several AWS regions and want to deploy CloudGuard to protect egress internet traffic. Requirement is for north/south traffic

We have an on prem Checkpoint deployment for all branch and DC. As such our security management servers are on prem

AWS Solution we are trying to deploy:

Security Gateways Auto Scaling Group for Gateway Load Balancer (GWLB) -

AWS CloudFormation Templates (checkpoint.com)

(Deploys a Gateway Load Balancer, Check Point CloudGuard IaaS Security Gateway Auto Scaling Group, and optionally a Security Management Server into an existing VPC.)

We have on prem Security Management servers so will be using them, otherwise all other elements have deployed successfully.
We have created the TGW attachments and have confirmed routing is good.

I am getting stuck on which CGNS to establish SIC with ? For example at the moment I see Security gateways created and I do
have reachability but as these are created as a scale set which do I use to establish SIC with management servers?

Attached image shows the flows. I dont have problem with reachability just understanding what I establish SIC with for SMS servers. As the IP's of the provisioned CGNS are likely to change as they are part of a scale set.

[Roman_Kats]

Hi @Finner1976 
Are you seeing errors in the /var/log/CPcme/cme.log on the Management machine?
Thanks

[Finner1976]

Hi Roman

I have reachability and I can establish SIC, The question i have is do I need to establish SIC with every GW in the scaleset

[Nir_Shamir]

the GWs have only one IP address which is the one connected to the PUBLIC SUBNET of the deployment.

You will be using those IPs to establish SIC. of course they will change when new GWs will be deployed and old will be deleted according to the ASG sizing but we are using the CME component to automatically scan / deploy / delete the ASG GWs from the Management Server.

Check the GWLB admin guide:

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Lo...

[Finner1976]

---

---

Thank you Nir.

I will try that, however its a bit confusing. For example  I see two CP gateways provisioned at the moment in public subnet. Do I add both to the SMS and push the same policy?

[Nir_Shamir]

first, they need to be added automatically to the Management SmartConsole using CME. this is how it is done.

check the GWLB admin guide.

they will be added and both will have the same policy installed on them.