Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
tropicanaslim
Contributor
Jump to solution

Check Point Cloud FW on AWS

Hi Checkmates,

We are currently redesigning cloud security adoption on AWS, especially in the area of ​​network security.

From the architecture blueprint owned by Check Point and adapting it to the internal design, we see that there are 2 potential designs that we can use:
CloudGuard Network for AWS Auto Scale Group with Transit Gateway and CloudGuard Network for AWS Cross Availability Zone Cluster with Transit Gateway, because we use TGW to connect from Direct Connect and 2 VPCs.

After reading the admin guide, I am still unsure which of the two designs above is suitable for our needs.

Do you guys have any suggestions from Checkmates regarding which design is suitable for us? and what is the difference between the two?

Our situation :

  • TGW enable
  • Traffic from DX
  • 2 VPCs
  • Access from internal and external (public)

 

Thanks! 🙂

0 Kudos
1 Solution

Accepted Solutions
Roman_Kats
Employee
Employee

Hi @tropicanaslim 

The recommended solution for E/W and N/S is Gateway Load Balancer Autoscaling.
Admin guide: https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_A... 
Workshop:

https://unrivaled-melba-1a81a6.netlify.app/

In case Site to Site VPN is required the Cross AZ Cluster should be added to architecture.

Thanks,

Roman


 

View solution in original post

0 Kudos
6 Replies
avivs
Employee Alumnus
Employee Alumnus

The main difference between Cross-AZ Cluster and AutoScale is VPN.

If you require the CloudGuard Gateways to act as a VPN termination device, then Cross-AZ Cluster is the way to go.

Otherwise, the AutoScale solution would be recommended.

For a comparison of Public Cloud solutions, please see sk178668 

tropicanaslim
Contributor

Hi @avivs 

Thank you for the answer and suggestions.. CMIIW, means both can be used to protect N/S and E/S traffic, right? and the most obvious difference is only from the VPN side?

0 Kudos
PhoneBoy
Admin
Admin

More details about your specific requirements and what you're trying to achieve might help.

tropicanaslim
Contributor

Hi PhoneBoy,

Sorry if my question is not clear enough. The goals is protecting for E/W and N/S traffic that passes through the transit gateway from public, internal via DX.

I see there are 2 suitable solutions as per my post, but I'm looking for which option is the best.

0 Kudos
Roman_Kats
Employee
Employee

Hi @tropicanaslim 

The recommended solution for E/W and N/S is Gateway Load Balancer Autoscaling.
Admin guide: https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_A... 
Workshop:

https://unrivaled-melba-1a81a6.netlify.app/

In case Site to Site VPN is required the Cross AZ Cluster should be added to architecture.

Thanks,

Roman


 

0 Kudos
Jeff_Engel
Employee
Employee

In place of the unrivaled melba link above please use this one > https://checkpoint.awsworkshop.io/ 

 

@tropicanaslim 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.