- CheckMates
- :
- Products
- :
- CloudMates Products
- :
- Cloud Network Security
- :
- Discussion
- :
- Re: AWS CloudGuard - Security Gateways Auto Scalin...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
AWS CloudGuard - Security Gateways Auto Scaling Group for Gateway Load Balancer (GWLB)
Scenario: We have Production deployments in several AWS regions and want to deploy CloudGuard to protect egress internet traffic. Requirement is for north/south traffic
We have an on prem Checkpoint deployment for all branch and DC. As such our security management servers are on prem
AWS Solution we are trying to deploy:
Security Gateways Auto Scaling Group for Gateway Load Balancer (GWLB) -
AWS CloudFormation Templates (checkpoint.com)
(Deploys a Gateway Load Balancer, Check Point CloudGuard IaaS Security Gateway Auto Scaling Group, and optionally a Security Management Server into an existing VPC.)
We have on prem Security Management servers so will be using them, otherwise all other elements have deployed successfully.
We have created the TGW attachments and have confirmed routing is good.
I am getting stuck on which CGNS to establish SIC with ? For example at the moment I see Security gateways created and I do
have reachability but as these are created as a scale set which do I use to establish SIC with management servers?
Attached image shows the flows. I dont have problem with reachability just understanding what I establish SIC with for SMS servers. As the IP's of the provisioned CGNS are likely to change as they are part of a scale set.
- Labels:
-
AWS
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Finner1976
Are you seeing errors in the /var/log/CPcme/cme.log on the Management machine?
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Roman
I have reachability and I can establish SIC, The question i have is do I need to establish SIC with every GW in the scaleset
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the GWs have only one IP address which is the one connected to the PUBLIC SUBNET of the deployment.
You will be using those IPs to establish SIC. of course they will change when new GWs will be deployed and old will be deleted according to the ASG sizing but we are using the CME component to automatically scan / deploy / delete the ASG GWs from the Management Server.
Check the GWLB admin guide:
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Nir.
I will try that, however its a bit confusing. For example I see two CP gateways provisioned at the moment in public subnet. Do I add both to the SMS and push the same policy?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
first, they need to be added automatically to the Management SmartConsole using CME. this is how it is done.
check the GWLB admin guide.
they will be added and both will have the same policy installed on them.
![](/skins/images/6980CBA140F726D3EF221370390D7B61/responsive_peak/images/icon_anonymous_message.png)