This is the very first dip in the water I've had with configuring CloudGuard, so I realise my question will sound novice and stupid to those who already know, but I'm really struggling to grasp setting up a GWLB CloudGuard in AWS. I can't seem to find any admin guides or documentation that cover my questions below.
Firstly - I've watched Shay's "Deep Dive" webinar, but I'm still confused.
I've run through the GWLB TGW CloudFormation template (actually an AWS partner did this bit).
I've installed CME to the management server (on-prem).
I've run the "autoprov_cfg" command with the relevant parameters.
Two AWS gateways magically appeared in SmartConsole, so I'm guessing that bit worked OK. SIC is communicating with both. WEB API automatically installs the policy every 3-4 minutes, which after the first install, promptly blocked my SSH to the gateways.
On advice from my local SE, I've opened the __monitor__-restrictive-policy and changed that Any Any rule from Drop, to Allow & log. Now I can SSH to them again.
WEB API says it's installing the proper policy name, but when I SSH to the CloudGuards and run #fw stat, it shows they have __monitor__-restrictive-policy installed. Not the proper policy name.
So, I'm confused.
I've added the Data Center in SmartConsole, which connects fine. When I click + on a rule I can open the Data Center object and browse it all... So I think that's working fine too.
My novice questions are:
1) Why is it still pushing the __monitor__-restrictive-policy policy? Why isn't it installing the main/proper policy that it says it is, and that I specified in the autoprov_cfg command?
2) How do I configure my security rules for these gateways? I get that I need to use the Data Center tagged objects in my rules, but how do the gateways get the policy? Firstly as it's still pushing the __monitor__-restrictive-policy policy instead of the proper policy, and secondly as I can't add the gateways to the "Install On" column. Or to be more accurate I can add the current two gateways, but when the ASG grows - the new gateways won't be automatically included in "Install On", so that can't be the way to do it?
3) At the moment the policy installation targets for the main/proper rulebase specifies the existing physical gateways. Do I need to change this to "All gateways" for it to work with AWS as the number of gateways in the ASG dynamically grows and shrinks?
4) How do I put a Stealth rule on these to protect the public IP? Or in the case of GLWB gateways is that done only via the AWS firewall/access list?
5) When I manually install the policy, the Threat Prevent gives a verification error about the topology not being defined on the AWS instances, and that Threat blades won't apply until the topology is fixed. Shouldn't this be done automatically by whatever process creates the gateway objects in SmartConsole? (CME?)
If there is any documentation etc. that covers this I'd be grateful if someone could point me at it. So far I can't find anything that tells me how to get past the __monitor__-restrictive-policy policy, or configure what security rules I want on these GWLB gateways, differently to my other physical gateways... Or fix the topology verification warning... I'm sure I'm missing something obvious and simple, but rightly or wrongly I'm extremely confused and documentation around this stuff seems to be lacking? 🤔 Any help would be hugely appreciated.
