Nutanix Flow

[Magnus-Holmberg]

Hi,

Is there anyone running Nutanix Flow and have it integrated with check point?
Its listed as opsec partner but there is no solution brief,

https://next.nutanix.com/blog-40/security-is-frictionless-with-nutanix-flow-32910

"Not only have physical networking vendors embraced the Nutanix vision, but major firewall vendors have joined as well to bring enhanced inspection that compliments Flow microsegmentation. Firewall VMs from CheckPoint, Juniper, Palo Alto Networks, and more are certified to run on Nutanix AHV with Flow traffic redirection for additional traffic inspection and threat detection."

[Kfir_Bachar]

HI All,

Nutanix Flow at this point is not supported by us.
We do support a qcow2 image that can be used on Nutanix as appears on our HCL. (Virtual Machines Section)

If there is a special request for this feature please let me know.

Thanks

KfirB

[Magnus-Holmberg]

Thanks for the reply,

We are looking on Nutanix and would like the have similar integration as NSX for building firewall rule bases in check point with dynamic objects. If this is on the roadmap or a special release for it, it could be very interesting for us.

[Daniel_Mirkin]

Hi Magnus,

I'm glad to inform you that we are currently in EA state of CloudGuard for Nutanix.

We have been developing the following capabilities:

• CloudGuard Controller support for Nutanix DC.
• Deployment of CloudGuard Network Security Gateways with Nutanix Calm Blueprint.
• Applying Micro-segmentation with Nutanix Flow and CloudGuard Network Security Gateways.
• Cloud Management extension (CME) integration with Nutanix.

Please PM me if it's still relevant. 

[ISSAMJILAD]

Hi Daniel,

Are you still developping CloudGuard for Nutanix solution.

Because our customers have newer versions of AHV, Flow and Calm than those mentioned in sk173224 and they are not considering downgrade.

We have tried the blueprint as it is with these new versions of nutanix and it doesn't work.

Thanks for help

[Daniel_Mirkin]

Hi,

What are the versions they are using ? 
What is the error message they get when using the Nutanix Calm Blueprint ? 

[ISSAMJILAD]

Thank you for asking.

AHV: 20220304.392

AOS: 6.5.2.7

FLOW: 1.0.1

CALM: v3.5.2

NCC: 4.6.3.1

PC: 2022.6.0.4

The error message:

VM created with Name: Check_Point_R81.10_GW-01, UUID: 6f1b5bf7-1be9-4f29-b46f-d50b1e97c9d5
Waiting for 0 seconds to finish the guest customization
Waiting for VM 6f1b5bf7-1be9-4f29-b46f-d50b1e97c9d5 to get an IP

ERROR: Failed to get an IP for the VM 6f1b5bf7-1be9-4f29-b46f-d50b1e97c9d5

NB:

when we configure IPs manually in the gateways, they show up in smart console.

But we can't steer traffic in the security policy (there is no "redirect traffic to service chain..." when editing inbound rule for example)

[Daniel_Mirkin]

Have you tried reaching out to Nutanix Support regarding this issue? 

[ISSAMJILAD]

Yes we did.

they are working on it.

[rajaa]

hI 

did you find a solution for your problem. i face the same issue 

[Jeff_Engel]

Hi @rajaa , can you provide additional details on your issue?  Can't redirect traffic?

[rajaa]

Hi Jeff, 

I have deployed all my gateways using nutanix calm and also create the security policy to redirect the traffic but when i assign my category to my vms it block all (no ping, no traffic ) . on sms i have the default policy (allow any ) 

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CloudGuard_Network_for_Nutanix_Deploymen...

[Magnus-Holmberg]

Default policy in check point is to deny everything.
Do you see the blocks in the log?

[rajaa]

i have change it to allow . no block logs 

[Jeff_Engel]

Hi @rajaa , apologies for the delayed reply.  I will contact you directly.  We will report back here with our findings.