Create a Post
Showing results for 
Search instead for 
Did you mean: 

Using Azure Application Gateway as a WAF in front of CloudGuard IaaS

7 5 3,098

I've been asked several times about if CloudGuard is a WAF product (that's another discussion!) and how best can a dedicated WAF service be placed in front of CloudGuard IaaS gateways. As all the requests came from customers using Microsoft Azure, I decided to look into the Application Gateway.

In short, the Application Gateway is basically a "load balancer on steroids" and provides much the same functionality as a standard SKU Azure Load Balancer, but with the added benefit of WAF capabilities. As our reference architecture in Azure uses a load balancer and one or more gateways, this seemed the obvious choice for the deployment.

I wrote a lab guide to deploying this solution, as with most cloud topics, it will age very quickly, but hopefully give you a good starting point if you have a project that has strict requirements on having a WAF service at the Azure perimeter. It's very much a first draft, so there will be mistakes and also outdated information, please provide any feedback below.

Note this is not official Check Point documentation or advice, deploy this solution at your own risk. No warranties implied, may contain nuts. Check Point are not responsible for any service charges accrued by this deployment. The value of investments may go down as well as up.

Tags (3)

How is it with traffic decryption between app gw and Check Point? 


You can terminate SSL on the Application Gateway itself and reduce the load on the gateways, but that is optional.

Configure an application gateway with SSL termination - Azure portal | Microsoft Docs 


Does it support the latest Cloudguard HA template ??

In standard ELB, it does heath probe on TCP & forwards the traffic to active GW. How it will work with AGW ??



We have a customer requirement of implementing the WAG behind Checkpoint as NVA on Azure, can someone please guide on this configuration.It involves configuration of UDR on Azure


we have used the above recommendations and managed to configure WAF in front of Checkpoint Scale Set, thanks!

one question, if we need to add more inbound NAT rules to other hosted services not using WAF, I believe that similar to a more "traditional" IAAS setupm we would need the Azure Load Balancer acting as the 'front end load balancer'. How will this interact with WAF? Should it be deployed in front of WAF or side by side?