How to create object for private cloud Kubernetes on SmartConsole

[MarcuzShinz]

Dear Guy,

I would like to find some help with creating a private cloud object for Kubernetes with Check Point on SmartConsole. On Fortigate we can find and create that object easily, but on Check Point we don't know how to do it?

Has anyone done this yet?

Step create on Fortigate, I don't know with filter field we have to use replicate.

[PhoneBoy]

You need to configure it in CloudGuard Controller first.
See: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CloudGuard_Controller_AdminG... 

[MarcuzShinz]

Dear PhoneBoy,

We are using Maestro, not cloudguard. We see on SmartConsole that there is Object Data Center. But I don't know how it will configure the filter similar to Fortigate.

[Chris_Atkinson]

CloudGuard controller is a management component that allows you to integrate with your datacenter object repository.

Once the CloudGuard controller is connected you can then import objects for use within your security policy.

[MarcuzShinz]

I have made the connection to kubernetes and filter the same image below, are these parameters shown below dependent on Kubernetes configuration? Because I configured according to the link PhoneBoy sent, but I can't find the parameter for hostname similar to Fortigate?

[PhoneBoy]

This provides access to all the objects defined in your Kubernetes datacenter, which can then be imported in your Access Policy individually.
What is your precise goal here?

[MarcuzShinz]

Dear PhoneBoy,

As the post title says, I'm looking for a way to map the connection configuration to Kubernetes similar to Fortigate on Check Point. Below link configure on Fortigate.

Collecting only node IP addresses with Kubernetes SDN connectors | FortiGate Private Cloud 7.2.0 | F...

Specifically, on fortigate, a Kubernetes object will be configured and the object will be filtered by Hostname. That means, if the user changes the IP of the Kubernetes server, this object will automatically update the new IP without any action from the administrator to edit the Object.

In Fortigate it is called Dynamic Object, I looked at Check Point's Dynamic Object, but it doesn't seem to be the same. Only the Data Center configuration is similar to the FortiGate configuration above.

[PhoneBoy · Accepted solution]

I'm not seeing where in the Fortinet documentation the IP address of the Kubernetes Connector itself (kuber_cloud, IP "35.236.76.254") can change.
This is equivalent to the Data Center object you created on the Check Point side.

What I suspect you're looking for is all the IPs used within the Kubernetes cluster.
I believe this can be done with a Data Center Query object: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_CloudGuard_Controller_AdminG... 

Also, adding individual objects from the list you showed to the policy allows for much more granular policy creation.
When those objects change IP addresses in the Data Center, they will automatically update in the Access Policy as well.

[MarcuzShinz]

Dear PhoneBoy, 

Many thanks! I was also thinking about data center query would be what I need. I will try it.

Also I have a side issue, specifically related to NAT, if you have experience with this could you please clarify it for me?

It is the "S" and "H" symbols in object translate in NAT rule. What does it mean?

[Alex-]

S = Static NAT, 1-1

H = Hide NAT, Many-to-One