Internet Inbound/Ingress for Azure Virtual WAN - Deep Dive Recording

[Shay_Levin]

We are excited to announce that Check Point is the first vendor to support ingress traffic on Azure Virtual WAN, making exposing your applications to the Internet easier than ever!

Admin guide link

[jmaresky]

Great work Shay!

[Simon_Macpherso]

hello, what is the mgmt_cli command to configure the controller for CME?

[Shay_Levin]

mgmt_cli cme-api/v1/accounts/azure name "azure_unique_name" subscription "xxxxx" application_id "xxxxxxxxxx" directory_id "xxxxxxxxx" client_secret "xxxxxx" --format json

[Nir_Shamir]

Hi,

What role does the service principal needs in order to create ingress rule , and on what resource ?

thanks.

[Shay_Levin]

• CME account (controller) with a service principle assigned to:

  • NVA’s Managed resource group with Reader and Network Contributor roles.

  • Relevant public IP addresses (or their resource group) with Reader role.

[Simon_Macpherso]

@Shay_Levin 

[EnriqueGB]

Regarding to the VMs provisioned, would be possible to use a VMSS to make this solution scalable?

[Shay_Levin]

Currently, VMSS is not supported

[Jeff_Engel]

@EnriqueGB   Also be aware that this is an Azure limitation, not Check Point.

[EnriqueGB]

But limitation nevertheless. The traditional VMSS + CheckPoint works wonderfully and it's great to forget sizing the just big enough sku. Once you get use to scalability is very difficult to go back.