IPv6 Traffic Inspection Configuration for GWLB

The Centralized Gateway Load Balancer (GWLB) supports IPv6 traffic inspection with IPv4 Check Point Security Gateways over the GENEVE protocol.

Prerequisites:

To deploy the Gateway Load Balancer to a new VPC CFT or to an existing VPC and enable IPv6 traffic inspection support, make sure that all resources support IPv6.

Configuring the IPv6 traffic inspection

To configure the IPv6 traffic inspection in the new GWLB environment:

  1. Deploy the new Centralized GWLB Security VPC using the CloudFormation template (as described in Step 4: Deploy the Centralized Security VPC).

    Note - In the template, set the value of the "Add support for IPv6 traffic inspection" parameter to "true" (see Check Point CloudGuard Network Security Gateways Auto Scaling Group Configuration: for details).

  2. After the deployment, set the GWLB service Supported IP address type to support IPv4 and IPv6 (see Configure IPv6 for the Endpoint Service for more information).

  3. Deploy Servers subnets with IPv6 support as needed (see Configure IPv6 for a Subnet for more information).

To configure the IPv6 traffic inspection in the existing GWLB environment:

  1. Add IPv6 support to all AWSClosed Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services. resources: first, at the Security VPC, and then at the relevant Servers VPC (see Configure IPv6 for a VPC and Configure IPv6 for a Subnet for more information).

    Important - Check Point GWLB Security Gateways do not support IPv6 address assignment. If you assign an IPv6 address to the Security Gateway, your GWLB environment will stop working.

  2. Update the launch template (see Update the Launch Template for more information).

    1. Change the image in the associated launch template.

    2. Modify the user data to enable IPv6 at the First Time Configuration Wizard.

  3. Update the Launch Template version in the Auto Scaling Group(see Update the Launch Template version in the Auto Scaling Group for more information).

  4. Scale in and scale out the Auto Scaling Group to apply changes to all Security Gateways in a group.

Important: Because of an AWS limitation, the Transit Gateway GWLB architecture does not support IPv6 traffic inspection.

Update Launch Templates

  1. Log in to the AWS Management Console. Make sure you are in the correct region where the Launch Template is deployed.

  2. Go to the EC2 section.

  3. In the navigation pane, select the Launch Templates section.

  4. Find the Launch Template you want to configure.

  5. Click Actions and select Modify template (Create new version).

  6. Change the Launch Template image. For that, in the launch template contents section, under Application and OS Images (Amazon Machine Image), select the correct image for the template.

  7. Change the Launch Template user data:

    1. Go to the Advanced details section.

    2. Add the user data script in the User data text box.

  8. Click Create template version to save the changes.

  1. Log in to the AWS Console. Make sure you are in the correct region where the Auto Scaling group is deployed.

  2. Go to the EC2 section.

  3. In the navigation pane, select the Auto Scaling Groups section.

  4. Find the Auto Scaling group you want to configure.

  5. Under the Details tab, click Edit.

  6. In the Launch Template section, select the correct version number to use in the Auto Scaling group.

  7. Click Override launch template to save the changes.

Copy 
#cloud-config
network:
  version: 1
  config:
  - type: bridge
    name: br0
    mtu: *eth0-mtu
    subnets:
      - address: *eth0-private
        type: static
        gateway: *default-gateway
        dns_nameservers:
        - *eth0-dns1
    bridge_interfaces:
      - eth0
kernel_parameters:
  sim:
    - sim_geneve_enabled=1
    - sim_geneve_br_dev=br0
  fw:
 
    - fwtls_bridge_mode_inspection=1
    - fw_geneve_enabled=1
bootcmd:
    - echo "brctl hairpin br0 eth0 on" >> /etc/rc.local
    - echo "cpprod_util CPPROD_SetValue \"fw1\" \"AwsGwlb\" 4 1 1" >> /etc/rc.local
    - |
      gparam_file_path="$(find $PPKDIR/boot/modules/ -regextype egrep -regex '.*(sim_kern_64_3_10_64_v6|sim_kern_64_v6)\.gparams')"
      if cat $gparam_file_path | grep -q sim_geneve_enabled ; then
          cp /etc/basedb /etc/basedb.bak
          grep -vx "ipv6 t" /etc/basedb.bak | grep -vx "ipv6 f" > /etc/basedb;
          echo "ipv6 t" >> /etc/basedb
          /etc/rc3.d/S07ipv6gen
          insmod -o ssm_api_v6 /etc/ssm_api_stubs/modules/ssm_api_kern_64_v6.o
      fi  
runcmd:
  - |
    python3 /etc/cloud_config.py enableCloudWatch=\"PUT HERE true OR false\" sicKey=\"PUT HERE ONE TIME PASSWORD ENCODED TO BASE64\" installationType=\"autoscale\" osVersion=\"PUT HERE CHECK POINT VERSION\" allowUploadDownload=\"PUT HERE true OR false\" templateVersion=\"20221226\" templateName=\"autoscale_gwlb\" templateType=\"terraform\" shell=\"PUT HERE /etc/cli.sh OR /bin/bash OR /bin/csh OR /bin/tcsh\" enableInstanceConnect=\"PUT HERE true OR false\" passwordHash=\"PUT HASH PASSWORD ENCODED TO BASE64 OR KEEP IT EMPTY\" bootstrapScript64=\"\"

Check and Configure IPv6 AWS resources

  1. Log in to the AWS Console.

  2. Locate the current region in the upper left corner of the navigation bar.

  3. Change the region by clicking the dropdown next to the region name and selecting your desired region.

  1. Log in to the AWS console. Make sure you are in the correct region where the VPC is deployed.

  2. Go to the VPC section.

  3. In the navigation pane, select the Your VPCs section.

  4. Find the VPC you want to check.

  5. Check if this VPC has the IPv6 pool.

  1. Log in to the AWS console. Make sure you are in the correct region where the VPC is deployed.

  2. Go to the VPC section.

  3. In the navigation pane, select the Your VPCs section.

  4. Find the VPC you want to configure.

  5. Click Actions and select Edit CIDRs.

  6. In the IPv6 CIDRs section, click Add new IPv6 CIDR, configure the IPv6, and click Select CIDR.

  7. Click Close.

  1. Log in to the AWS console. Make sure you are in the correct region where the Subnet is deployed.

  2. Go to the VPC section.

  3. In the navigation pane, select the Subnets section.

  4. Find the subnet you want to check.

  5. Check if this subnet has IPv6 CIDR.

  1. Log in to the AWS console. Make sure you are in the correct region where the Subnet is deployed.

  2. Go to the VPC section.

  3. In the navigation pane, select the Subnets section.

  4. Find the subnet you want to configure.

  5. Click Actions and select Edit IPv6 CIDRs.

  6. In the Subnet CIDR block, click Add IPv6 CIDR, configure the CIDR block as needed, and click Save.

  1. Log in to the AWS console. Make sure you are in the correct region where the Endpoint Service is deployed.

  2. Go to the VPC section.

  3. In the navigation pane, select the Endpoint Services section.

  4. Find the Endpoint Service you want to check.

  5. Check if the Subnet has a Supported IP address type parameter set to IPv4 and IPv6.

  1. Log in to the AWS console. Make sure you are in the correct region where the Endpoint Service is deployed.

  2. Make sure the VPC where the Endpoint Service is deployed supports IPv6.

  3. Go to the VPC section.

  4. In the navigation pane, select the Endpoint Services section.

  5. Find the Endpoint Service you want to configure.

  6. Click Actions and select Modify supported IP address types.

  7. In the Supported IP address types settings, select IPv6 and click Save changes.

  1. Log in to the AWS console. Make sure you are in the correct region where the Endpoint is deployed.

  2. Go to the VPC section.

  3. In the navigation pane, select the Endpoints section.

  4. Find the Endpoint you want to check.

  5. Check if the subnet has the IP address type parameter set to Dualstack.

  1. Log in to the AWS console. Make sure you are in the correct region where the Endpoint is deployed.

  2. Make sure the VPC and Subnet for this Endpoint support IPv6.

  3. Go to the VPC section.

  4. In the navigation pane, select the Endpoints section.

  5. Find the Endpoint you want to configure.

  6. Click Actions and select Modify endpoint settings.

  7. At the Modify IP address type settings, select Dualstack and click Save changes.

  1. Log in to the AWS console. Make sure you are in the correct region where the Route Table is deployed.

  2. Make sure the VPC and Subnet support IPv6.

  3. Go to the VPC section.

  4. In the navigation pane, select the Subnets section.

  5. Select the public subnet. On the Route Table tab, select the Route Table you want to check or configure.

  6. On the details page for the route table, open the Routes tab to check if the needed IPv6 routes exist in the route table.

  7. To add Routes:

    1. On the Routes tab, click Edit routes.

    2. Click Add route and add the needed routes for the IPv6 network.

    3. Click Save changes.

  1. Log in to the AWS Management Console. Make sure you are in the correct region where the Load Balancer is deployed.

  2. Go to the EC2 section.

  3. In the navigation pane, select the Load Balancers section.

  4. Find the Load Balancer you want to check.

  5. Check if the Load Balancer's IP address type parameter has the dualstack value.

  1. Log in to the AWS console. Make sure you are in the correct region where the Load Balancer is deployed.

  2. Go to the EC2 section.

  3. In the navigation pane, select the Load Balancers section.

  4. Find the Load Balancer you want to configure.

  5. Click Actions and select the Edit IP address type.

  6. For IP address type, select dualstack and click Save.

  1. Log in to the AWS console. Make sure you are in the correct region where the Security Group is deployed.

  2. Go to the VPC section.

  3. In the navigation pane, select the Security Groups section.

  4. Select the Security Group tied to your resource.

  5. Open Inbound Rules and Outbound Rules tabs to check if the Security Group has inbound and outbound rules for IPv6 subnets.

  1. Log in to the AWS Management Console. Make sure you are in the correct region where the Security Group is deployed.

  2. Go to the VPC section.

  3. In the navigation pane, select the Security Groups section.

  4. Select the Security Group you want to configure.

  5. To edit the Inbound rules:

    1. Open the Inbound rules tab.

    2. Click Edit inbound rules.

    3. Add the rules to allow the IPv6 traffic.

    4. Click Save rules to save the configuration.

  6. To edit the Outbound rules:

    1. Open the Outbound rules tab.

    2. Click Edit outbound rules.

    3. Add the rules to allow the IPv6 traffic.

    4. Click Save rules to save the configuration.