Create a Post
Showing results for 
Search instead for 
Did you mean: 

Scalable Remote Access VPN with CloudGuard IaaS: Video, Slides, and Q&A

Materials available to CheckMates members:

Q&A from the session:

Can we use a single VMSS for Access to Azure Applications/Resources, Site-to-Site VPN, and Remote Access VPN?

The same VMSS deployment can be used for inbound, outbound, and east-west traffic inspection, and for Remote Access VPN. No site-to-site support at this time, but you set up a separate Check Point Cluster or Gateway for this.

Is Remote Access VPN Load Balanced using MEP?

No, it is using DNS.

Is this configuration documented?

The existing CloudGuard IaaS Admin Guides will be updated to fully document this new feature.

If I use BYOL, do I need to have licenses for the autoscaling gateways?

Yes. The licenses will be distributed via the Central Licensing Tool similar to existing NGTP/NGTX licenses. You will need to purchase the appropriate Remote Access VPN licenses.

How was this environment built?

Using an Azure ARM template, which will be available via Github and the Azure Marketplace.

Given a user can terminate on any gateway, how is symmetry maintained?

Using HIDE NAT, which each gateway is doing.

How is the VPN client dynamically updated with the current VPN gateways in the VMSS? 

This is done using DNS, which requires a specific version of the VPN client currently. Over time, this should result in load balancing.

Is there a way to force "round robin" selection of the Remote Access gateway?

Not currently. We will add additional mechanisms over time.

Do PAYG licenses include Remote Access capabilities?


Is Office Mode supported?

Yes, each gateway uses the same Office Mode pool. However, the end user is subject to HIDE NAT to maintain symmetry.

Does the VPN client see a fingerprint change if it connects to a different scale set member?


Will this design become a SASE solution?

This is similar to a SASE solution, except you build it/manage it yourself. CloudGuard Connect is our SASE solution, which operates "as a service."

6 Replies
Employee Alumnus
Employee Alumnus

Does it support autoscaling on AWS?


0 Kudos

Not yet, but believe this is planned.

0 Kudos


Any update on this solution being supported in AWS with Auto-scaling?

Thank you!

0 Kudos

Does this solution work when connecting via Mac OS based clients?


0 Kudos

PAYG licenses include Remote Access capabilities means unlimited? 

0 Kudos

How many remote users can this scale up to? Or, how many remote users can each Gateway support?

0 Kudos


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events