Check Point Cloud FW on AWS

[tropicanaslim]

Hi Checkmates,

We are currently redesigning cloud security adoption on AWS, especially in the area of ​​network security.

From the architecture blueprint owned by Check Point and adapting it to the internal design, we see that there are 2 potential designs that we can use:
CloudGuard Network for AWS Auto Scale Group with Transit Gateway and CloudGuard Network for AWS Cross Availability Zone Cluster with Transit Gateway, because we use TGW to connect from Direct Connect and 2 VPCs.

After reading the admin guide, I am still unsure which of the two designs above is suitable for our needs.

Do you guys have any suggestions from Checkmates regarding which design is suitable for us? and what is the difference between the two?

Our situation :

• TGW enable
• Traffic from DX
• 2 VPCs
• Access from internal and external (public)

Thanks! 🙂

[avivs]

The main difference between Cross-AZ Cluster and AutoScale is VPN.

If you require the CloudGuard Gateways to act as a VPN termination device, then Cross-AZ Cluster is the way to go.

Otherwise, the AutoScale solution would be recommended.

For a comparison of Public Cloud solutions, please see sk178668 

[tropicanaslim]

Hi @avivs 

Thank you for the answer and suggestions.. CMIIW, means both can be used to protect N/S and E/S traffic, right? and the most obvious difference is only from the VPN side?

[PhoneBoy]

More details about your specific requirements and what you're trying to achieve might help.

[tropicanaslim]

Hi PhoneBoy,

Sorry if my question is not clear enough. The goals is protecting for E/W and N/S traffic that passes through the transit gateway from public, internal via DX.

I see there are 2 suitable solutions as per my post, but I'm looking for which option is the best.

[Roman_Kats · Accepted solution]

Hi @tropicanaslim 

The recommended solution for E/W and N/S is Gateway Load Balancer Autoscaling.
Admin guide: https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_A... 
Workshop:

https://unrivaled-melba-1a81a6.netlify.app/

In case Site to Site VPN is required the Cross AZ Cluster should be added to architecture.

Thanks,

Roman

[Jeff_Engel]

In place of the unrivaled melba link above please use this one > https://checkpoint.awsworkshop.io/ 

@tropicanaslim