Using Azure Application Gateway as a WAF in front of CloudGuard IaaS

[Chris_Beckett1]

I've been asked several times about if CloudGuard is a WAF product (that's another discussion!) and how best can a dedicated WAF service be placed in front of CloudGuard IaaS gateways. As all the requests came from customers using Microsoft Azure, I decided to look into the Application Gateway.

In short, the Application Gateway is basically a "load balancer on steroids" and provides much the same functionality as a standard SKU Azure Load Balancer, but with the added benefit of WAF capabilities. As our reference architecture in Azure uses a load balancer and one or more gateways, this seemed the obvious choice for the deployment.

I wrote a lab guide to deploying this solution, as with most cloud topics, it will age very quickly, but hopefully give you a good starting point if you have a project that has strict requirements on having a WAF service at the Azure perimeter. It's very much a first draft, so there will be mistakes and also outdated information, please provide any feedback below.

Note this is not official Check Point documentation or advice, deploy this solution at your own risk. No warranties implied, may contain nuts. Check Point are not responsible for any service charges accrued by this deployment. The value of investments may go down as well as up.

[Martin_Valenta]

How is it with traffic decryption between app gw and Check Point? 

[Chris_Beckett1]

You can terminate SSL on the Application Gateway itself and reduce the load on the gateways, but that is optional.

Configure an application gateway with SSL termination - Azure portal | Microsoft Docs 

[Rajesh_Sawant]

Does it support the latest Cloudguard HA template ??

In standard ELB, it does heath probe on TCP & forwards the traffic to active GW. How it will work with AGW ??

[JeetJ]

Hello,

We have a customer requirement of implementing the WAG behind Checkpoint as NVA on Azure, can someone please guide on this configuration.It involves configuration of UDR on Azure

[Kurt_Abela]

we have used the above recommendations and managed to configure WAF in front of Checkpoint Scale Set, thanks!

one question, if we need to add more inbound NAT rules to other hosted services not using WAF, I believe that similar to a more "traditional" IAAS setupm we would need the Azure Load Balancer acting as the 'front end load balancer'. How will this interact with WAF? Should it be deployed in front of WAF or side by side? 

[Prabulingam_N1]

Hello Chris,

Tried your setup and worked fine.

Now how can access 2nd Webserver if deployed?

Regards, Prabu

[Oded_Gonda]

Alternatively you can use Check Point Web Application Protection in Azure

https://azuremarketplace.microsoft.com/en-us/marketplace/apps/checkpoint.checkpoint_waap?tab=Overvie...

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Infinity-Next-Admin-Guide/Top...

[Prabulingam_N1]

Hello Oded_Gonda,

Thanks for your inputs. (Yet to try Infinity/WAAF and will checkup)

Since customer using VMSS, I followed Chris document and able to secure 1 Web server.

But if I deploy 2nd Server or more how to use in HTTP Settings?

Im unable to use it.

@Chris - Any idea to use 2nd Web server as per your document please. (using Azure ApplicationGW)

Regards, Prabu