Automatic NAT and Access Rules

Prerequisites

• CME Take 137 or higher installed on the Security Management Server or Multi-Domain Server.

• CME controller used for this VMSS with reader permissions for Application gateway resources in Azure.

• A deployed CloudGuard for Azure VMSS solution that uses both an external and internal Application gateway.

  For more information, see the Virtual Machine Scale Sets (VMSS) for Azure R80.10 and Higher Administration Guide > Section Deploy Internal Application Gateway.

Mandatory Configuration

To enable this feature, these tags are required on the internal Application gateway:

NAT Rule Generated

Default Values

Column	Values
Original Source	The traffic to the VMSS instances is initiated from the external Application gateway subnet. By default, the original source is the internal Application gateway VNET. To change this, see Customizing Original Source in the NAT Rule. Important - In an environment with VNET peering (the external and internal Application gateways are on different VNETS). You must change the Original Source to be the external Application gateway subnet or VNET.
Original Services	If the listener listens to protocol HTTP using port 80 or HTTPS using port 443, the original service port is: 9080 for port 80 9443 for port 443 If not, the original service is the same as the listener Protocol and Port.
Translated Services	To change the Original Services, see Customizing Original and Translated Services in the NAT Rule. Example: Listener Protocol and Port Original Service Translated Service HTTP and port 81 HTTP and port 81 HTTP and port 81 HTTP and port 80 HTTP and port 9080 HTTP and port 80 HTTP and port 443 HTTP and port 9443 HTTP and port 443

Access Rule Generated

See the Virtual Machine Scale Sets (VMSS) for Azure R80.10 and Higher Administration Guide > Section Creating Dynamic Objects LocalGatewayInternal and LocalGatewayExternal.

Customizing Original and Translated Services in the NAT Rule

To customize the ports for Original Services, or to configure multiple internal Application gateways to listen to other ports, tag the internal Application gateway as follows:

Examples:

Customizing Original Source in the NAT Rule

To allow traffic from a specific IP addresses or networks based on their CIDRs, tag the internal Application gateways as follows:

Examples:

Enabling Automatic NAT and Access Rules in CME

To enable Automatic NAT and Access rules, run:

When the feature is enabled, CME starts to configure NAT and Access rules based on the Application gateway's x-chkp_management and x_chkp-template tags.

To disable Automatic NAT and Access rules, run:

After the feature is disabled:

1. CME removes the existing NAT and Access rules that were automatically created for this template.

2. CME does not add NAT and Access Rules for new instances.

(Optional) Automatic Rule Placement

By default, automatic Access and NAT rules for each VMSS instance are added at the top of the rulebase.

Sometimes it is recommended to add the rules in a specific place in the policy rather than at the top.

You can achieve this by creating a section for these rules in SmartConsole, and specifying the section name in CME configuration.

Procedure

1. In SmartConsole, in the applicable Security Policy, create a New Section:

   1. To create a New Section, right-click on below a rule number.

   2. Select Create New Section, click Below.

   3. Enter the name for the New Section and make sure to record the name.

   4. Publish the SmartConsole session.

2. Connect to command line on the Security Management Server.

3. Log in to the Expert mode.

4. Run this command:

   autoprov_cfg set template -tn <CONFIGURATION-TEMPLATE-NAME> -secn <SECTION-NAME>

   • Replace <CONFIGURATION-TEMPLATE-NAME> with the name of the configuration template configured with the Automatic NAT and Access rules feature (for example, my-configuration-template).

   • Replace <SECTION-NAME> with the name of the section created in Step 1.

If the section is specified in the configuration template, but not found in the rule base, the rule is added at the top by default.

To change the section name

To change the section in which new automatic Access and NAT rules are added, run:

autoprov_cfg set template -tn <CONFIGURATION-TEMPLATE-NAME> -secn <SECTION-NAME>

To remove the section name

To add the new automatic Access and NAT rules to the top of the rule base, run:

autoprov_cfg delete template -tn <CONFIGURATION-TEMPLATE-NAME> -secn

Known Limitations

• The feature works only with:

  • Azure Application gateways

  • AWS Auto Scale Group solutions

  Azure Load Balancers (layer 4) are currently not supported.

• These ports used with Auto Scaling groups in AWS are not supported:

  • x-chkp-ignore-ports

  • x-chkp-http-ports

  • x-chkp-https-ports

  • x-chkp-ssl-ports

  • x-chkp-source-object