Management Server Traffic Hits the Implied Rules

[chethan_m]

Hi,

We are currently deploying CGNS firewalls on AWS.

Architecture:

• The management server is hosted on-premises behind a Check Point firewall cluster.
• The CGNS firewall cluster is deployed in the cloud (AWS).
• A route-based IPsec site-to-site VPN is established between the on-prem Check Point firewall cluster and the AWS VPN Gateway.

The Issue:

• Initially, we successfully established SIC communication between the on-prem SMS and the CGNS firewall cluster, and were able to push policies.
• However, after a few minutes, the communication between the SMS and CGNS firewalls dropped (Gateways Lost).
• We observed that traffic related to CPD (port 18191) and CPD_amon (port 18192) was hitting implied rules instead of the explicit VPN access rules configured.
• Non-Check Point related traffic continues to flow over the VPN tunnel and is encrypted as expected.

Should any exclusions be made in the "$FWDIR/lib/implied_rules.def file"  to ensure CP management traffic is properly use the VPN tunnel instead of Implied rules.

Any guidance or suggestions to help resolve this would be greatly appreciated.

Thank you,

Chethan

[_Val_]

SIC traffic should not go via your VPN rules, ever. If your VPn tunnel is down, you would lose control. For that reason, it is covered by implied rules, and it is not recommended to change that.

Management traffic is encrypted, and there is no need to encrypt it again through your IPSec tunnels. 

[chethan_m]

Thank you for the quick response, @_Val_ 

There is currently no alternative communication channel between the on-prem SMS and the cloud-deployed CGNS firewalls. AWS Direct Connect is also not yet in place.

Given that the management server traffic is already encrypted, would it be feasible to re-establish SIC using public IP addresses instead of private IP addresses?

Regards,

Chethan

[_Val_ · Accepted solution]

I don't see why not, I've done this many times with many customers around the globe.

[chethan_m]

Thank you once again, I see — this is the solution.

Regards,

Chethan