Traffic Enforcement in Servers Subnets with CME

As displayed in the illustration above, the Centralized GWLB architecture includes a Security VPC containing Check Point GWLB Security Gateways and a Server VPC containing customer Servers/Applications.

The Cloud Management Extension (CME) monitors routes within the Server's VPC on AWSClosed Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services. and configures the necessary SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. rules to enforce application traffic to go only through the GWLB Endpoint.

The monitored routes include:

  • Routes from the Internet (IGW) to Servers subnets

  • Routes from Servers subnets to the Internet (IGW)

The GWLB Endpoint sends all traffic to and from the Server subnets to the Check Point GWLB for inspection. The CME automatically create SmartConsole rules by monitoring defined Tags on the subnets.

This feature is supported only for the Centralized GWLB architecture.

Enabling Subnets Scanning with CME API

With CME API, you can configure the CME to use Subnets Scanning.

API Documentation:

Prerequisites:

To enable Subnets Scanning on the Security Management Server:

  • For a new AWS Account:

    Send a POST request:

    POST https://<Management_IP_address>/web_api/v1.8/cme-api/v1.3.1/accounts/aws/

    Request body parameters:

    Parameter Name

    Description

    regions

    A comma-separated list of AWS regions where the Security Gateways are deployed.

    scan_subnets

    Set to "true" to scan subnets with AWS GWLB.

    scan_subnet_6

    Set to "true" to scan IPv6 subnets with AWS GWLB. (Requires the scan_subnets parameter to be set to "true".)

    This operation returns "status-code": 200.

  • For the existing AWS Account:

    Send a PUT request:

    PUT https://<Management_IP_address>/web_api/v1.8/cme-api/v1.2.X/accounts/aws/<Account_Name>

    Request body parameters:

    Parameter Name

    Description

    Name

    A unique account name in CME for identification.

    scan_subnets

    Set to "true" to scan subnets with AWS GWLB.

    scan_subnet_6

    Set to "true" to scan IPv6 subnets with AWS GWLB. (Requires the scan_subnets parameter to be set to "true".)

    This operation returns "status-code": 200.

Configuring Server Subnets Tags for SmartConsole Rules

Customers can configure SmartConsole rules with tags on the server's subnets (see Step 7: Post Deployment - Tag Subnets for Inspection for more information).

Two tags must be set:

  • x-chkp-gwlb-inbound

  • x-chkp-gwlb-outbound

As values of these tags, a list of comma-separated CIDRs is used. It defines the allowed sources and destinations in SmartConsole rules. These rules are installed only on the GWLB Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. group.

Example: