CloudGuard VMSS Policy "__monitor__-restrictive-policy" question?

[HeikoAnkenbrand]

I have a question about the CloudGuard VMSS Policy "__monitor__-restrictive-policy".

Nothing is described in the admin guides to CloudGuard or CME:
- CloudGuard Network for Azure VMSS R80.10 and Higher Administration Guide
- Cloud Management Extension R80.10 and Higher Administration Guide

From the local SEs I only get the information to enter "any, any, any, accept" here.

I think this policy controls access to the CloudGuard public IP of each VMSS instance.
If that's the case, I don't think it should be a "any, any, accept" rule.

Which ports should be used here. I think these should be the typical ports between SMS and firewall gateway:
257 Log, 18192 CPD, 18192 CPD_amon, 18211 CP_ica_push, 18264 FW1_ica_service, 443 GAIA Web, 22 SSH

Where can I find more information here?

Can someone from the CloudGuard team provide information on this topic.

[Nir_Shamir]

the restrictive policy is the first policy the GW gets during the deployment, during its first phase of configuration (IP addresses etc.) after that phase the actual policy you configured in the template is installed together with activated blades etc.

it's "Any Any Drop" in order to protect your GW + Internal Assets before installing your actual policy.

"Any Any Drop" will work here if you are working with implied rules.

If the customer doesn't work with implied rules you will need to create your own "Restrictive Policy" allowing CP ports to access the GWs and change it in the CME.

[HeikoAnkenbrand]

Hi @Nir_Shamir,

Thank you for the fast answer.

If I use an onpremise management server and connect it behind an internet gateway with hide NAT, the implied rules no longer work. This means that I no longer have access to the VMSS instances after the automatic policy installation via CME as drop is used in the "__monitor__-restrictive-policy" policy. It would make more sense for me if Check Point had already set the policy to accept. 

Can I also create the policy manually in advance with "accept" before I start the template roll out with "autoprov-cfg init Azure ...."?
Or would the policy automatically overwritten with drop if I created it manually before?

[Nir_Shamir]

you can create your own "Restrictive Policy" and change it in the CME script so it will be installed instead of the default one:

autoprov_cfg set template -tn <CONFIGURATION-TEMPLATE-NAME> -rp <RESTRICTIVE-POLICY-PACKAGE-NAME>

[HeikoAnkenbrand]

Nice,

This is exactly what I was looking for.