Additional Information

Deploying and configuring High-Availability Security Management Servers

Follow these steps:

1. Deploy the Secondary Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

   In the Azure portal, create a new instance for the Secondary Management Server.

   On the CloudGuard Advanced Settings tab, set the Installation type to Configure manually.

   

2. Complete the First Time Configuration Wizard (FTW) on the Secondary Management Server.

   After the instance starts, connect to the Secondary Management Server using the Web UI. Complete the First Time Configuration Wizard.

   In the Products section of the FTW, set the Security Management option to Secondary. This step registers the server as the Secondary Management Server in the HA pair.

   

3. Add the Secondary Management Server in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

   After the FTW completes, log in to the Primary Management Server using SmartConsole. Add the Secondary Management Server as a Check Point Host object.

   For that, on the Primary Management Server:

   1. Go to Objects > New > More > Check Point Host.

      

   2. Fill in the Machine details: Name and IP Address of the Secondary Management Server.

      On the Management tab, flag the Network Policy Management and Secondary Server checkboxes. Also flag the Logging & Status checkbox.

      

   3. Publish the changes.

After you publish the changes, the HA status becomes visible in SmartConsole. The Secondary Management Server appears as synchronised with the Primary Management Server.

Using the Azure High Availability Daemon

The cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. solution in Azure uses the daemon to make API calls to Azure when a cluster failover takes place.

This daemon uses a configuration file $FWDIR/conf/azure-ha.json on each Cluster Member Security Gateway that is part of a cluster..

When you deploy the solution above from the template supplied, this file is created automatically.

The configuration file is in JSON format and contains these attributes:

You can confirm that the daemon in charge of communicating with Azure runs on each Cluster Member.

From the Expert mode, run:

The output should look like in this example:

APP        PID    STAT  #START  START_TIME             MON  COMMAND

AZURE_HAD  3663   E     1       [12:58:48] 15/1/2016   N    python3 /opt/CPsuite-R81.20/fw1/scripts/azure_had.py

To troubleshoot issues related to this daemon, generate debug. From the Expert mode, run:

• To enable debug printouts:

  azure-ha-conf --debug --force

• To disable debug printouts:

  azure-ha-conf --no-debug --force

The debug output is written to $FWDIR/log/azure_had.elg* files.

Using a Different Azure Cloud Environment

If you want to deploy your cluster in an environment other than the standard Azure environment, make sure to edit this file:

$FWDIR/conf/azure-ha.json

Example:

{
...
    "environment": "[Azure-cloud-environment]",
...
}

The Azure-Cloud-Environment has to be one of these:

• Azure Cloud (the default global cloud environment)

• Azure China Cloud

• Azure US Government

Procedure:

1. From the Expert mode, run:

   azure-ha-conf --environment '<Azure-cloud-environment>' --force

2. Make sure the file syntax is correct. From the Expert mode, run:

   python3 -m json.tool $FWDIR/conf/azure-ha.json

3. Apply the changes. From the Expert mode, run:

   $FWDIR/scripts/azure_ha_cli.py reconf

   Note - If you deploy in the default global cloud environment, you can omit this attribute.

Working with a Proxy

In some deployments, you can only access the Internet through a web proxy.

To allow the Cluster Member to make API calls to Azure through the proxy, edit the $FWDIR/conf/azure-ha.json file and add this attribute:

{
...
    "proxy": "http://[Proxy-Server]:[Proxy-Port]",
...
}

• Proxy-Server is the host name or IP address of the web proxy server

• Proxy-Portis the port on the proxy server

Example:

{
...
    "proxy": "http://proxy.example.com:8080",
...
}

Procedure:

1. Change the proxy settings. From the Expert mode, run:

   azure-ha-conf --proxy 'http://[Proxy-Server]:[Proxy-Port]' --force

2. Make sure the file syntax is correct. From the Expert mode, run:

   python3 -m json.tool $FWDIR/conf/azure-ha.json

3. Apply the changes. From the Expert mode, run:

   $FWDIR/scripts/azure_ha_cli.py reconf

Changing Template Components

The Check Point cluster's public IP address has to be in the same resource group as the Cluster Members.

These resources can be in any resource group:

• Virtual Network

• Network interfaces

• Route tables

• Storage account

Naming Constraints

Cluster Members VM names must match the Cluster name with a suffix of '1' and '2'.

Example:

<member_name1>

<member_name2>

Network Interface names must match the Cluster Member VM names with a suffix of '-eth0' and '-eth1'.

Example:

<member_name1-eth0>

<member_name1-eth1>

<member_name2-eth0>

<member_name2-eth1>

The IP address of the cluster has to match the configuration file.

By default it should match the cluster name.

Permissions

It is possible to assign service principal permissions to specific Azure resources. See sk116585 for information on how to find the image version.

To allow the cluster to update the necessary Azure resources on failover, you must assign the service principal at least these roles on resources in that list that follows, or on their related resource group:

Creating Objects in SmartConsole

For more information, see the Check Point Security Management Administration Guide for your Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. version.

To create a Host object:

1. From the top right Objects Pane, click New > Host.

   The New Host window shows.

2. In the Machine field, enter the private IP address of the machine.

To create a Network object:

1. From the top right Objects Pane, click New > Network.

   The New Network window opens.

2. Enter the Object Name (specifically the subnet name).

3. Enter the Network address and Net mask.

To create a Service (port) object:

1. From the top right Objects Pane, click New > More > Service.

2. Select your TCP/UDP service.

3. Enter the Object name.

4. In the Enter Object Comment field, enter the port name.

5. In the General field, select your Protocol.

6. In the Match By field, select the Port number.

7. Click OK.

To create a Network Group object:

1. From the top right Objects Pane, click New > Network Group.

   The New Network Group window opens.

2. Click + to select your internal subnets.

3. Click OK.

SecureXL Traffic Acceleration

SecureXL traffic acceleration is supported for these versions:

• R81.10 Jumbo Hotfix Accumulator Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA. Take 177 and higher

• R81.20 Jumbo Hotfix Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior. Accumulator Take 99 and higher

• R82 Jumbo Hotfix Accumulator Take 25 and higher

Enabling SecureXL Traffic Acceleration

To enable SecureXL Check Point product on a Security Gateway that accelerates IPv4 and IPv6 traffic that passes through a Security Gateway. traffic acceleration on existing Cloud Firewall Gateways, follow these steps on both members of the High Availability cluster:

1. Log in using SSH to the Cluster member.

2. Backup the current fwkern.conf file. For that, in Expert mode run:

   cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

3. Open the configuration file for editing. For that, in Expert mode, run:

   vi $FWDIR/boot/modules/fwkern.conf

4. Add the following line at the end of this file:

   accel_dnat_to_cluster=1

5. Save and exit the file.

6. Enable the parameter for the current session (no reboot required):

   fw ctl set int accel_dnat_to_cluster 1

Monitoring SecureXL Traffic Acceleration

To monitor accelerated traffic and connections on the Cloud Firewall Gateways, use these commands:

• To view SecureXL statistics:

  fwaccel stats

• To view accelerated connections:

  fwaccel conns

Related Solutions

• sk109360 - Check Point Reference Architecture for Azure