Integrating CloudGuard Network Security NVA with Azure Virtual WAN

Step 1: Deploy Azure Virtual WAN

1. Log in to the Azure Portal, navigate to the Search resources bar, type Virtual WAN in the search box, and select Enter.

   

2. Select Virtual WANs if needed and select + Create on the Virtual WANs page.

3. Fill in the necessary fields on the Create WAN page > Basics tab. Keep the Type option as Standard. Click Next : Review + create >.

   

4. When the validation passes, click Create to create the virtual WAN.

Important - Terraform and ARM Microsoft® Azure Resource Manager. Technology to administer assets using Resource Group. templates for automatic deployment of the Azure Virtual WAN NVA Network Virtual Appliance - A resource deployed in Azure's Virtual Hub that includes Security Gateways and other networking infrastructure. are supported. ARM template: NVA Into Existing vHub Terraform templates: NVA Into New vWAN and vHub and NVA Into Existing vHub

Step 2: Create an Azure Virtual WAN Hub

1. Navigate to the virtual WAN you created. On the virtual WAN left pane, below Connectivity, select Hubs.

   

2. On the Hubs page, select + New Hub to open the Create virtual hub page. Fill out the applicable fields:

   1. Region: Select the region where you want to deploy the virtual hub.

   2. Name: The name to assign to the virtual hub.

   3. Hub private address space: The hub’s address range in CIDR notation. The minimum address space is /24 to create a hub.

   4. Virtual hub capacity: Select from the drop-down. For more information, see Azure Virtual hub settings.

   5. Hub routing preference: Leave as default. For more information, see Azure Virtual hub routing preference.

3. Once complete, select Review + create.

   

4. After validation passes, select Create. (Creating a new hub takes approximately 30 minutes).

5. To validate that your Virtual Hub is successfully provisioned, navigate to your Virtual WAN below Connectivity > Hubs, and select the Hub you created.

   

6. Check the Routing status; if it is still Provisioning, do not proceed.

   Once the Routing status states Provisioned, you can proceed to the next step.

Step 3: Add permissions to the user-assigned managed identity

To deploy an CloudGuard Network Security NVA, your subscription requires a user-assigned managed identity with these permissions:

• Microsoft.Network/virtualHubs/read permission - on the hub where the NVA is created.

• Microsoft.Network/publicIPAddresses/join/action permission - if a Public IP address is attached for Internet ingress.

To assign the Microsoft.Network/virtualHubs/read permission to your user-assigned managed identity in Azure:

1. Go to the Azure portal.

2. Navigate to the Virtual Hub resource where you want to assign the permission.

3. Select Access control (IAM) from the left menu.

4. Click Add role assignment.

5. In the Role drop-down menu, select Reader.

6. In the Assign access to drop-down menu, select Managed identity.

7. Select the user-assigned managed identity you want to assign the role to.

8. Click Save to apply the changes.

To assign the Microsoft.Network/publicIPAddresses/join/action permission to your user-assigned managed identity in Azure:

1. Go to the Azure portal.

2. Navigate to the Public IP Address resource (if it exists), or to the resource group where it will be created.

3. Select Access control (IAM) from the left menu.

4. Click Add role assignment.

5. In the Role drop-down menu, select a custom role that includes the Microsoft.Network/publicIPAddresses/join/action permission.

   If you prefer not to create a custom role, you can use the predefined Network Contributor role in Azure.

6. In the Assign access to drop-down menu, select Managed identity.

7. Select the user-assigned managed identity you want to assign the role to.

8. Click Save to apply the changes.

Step 4: Deploy new CloudGuard Network Security NVA in the Virtual WAN Hub

1. Navigate to your Azure Virtual WAN Hub > on the left tree, select Network Virtual Appliance.

2. Click Create Network Virtual Appliance

3. From the Network Virtual Appliance drop down box, select check point and click Create.

   

4. On the pop-up, select Leave.

5. Click Create on the CloudGuard Network Security for Azure Virtual WAN screen.

6. On the Create CloudGuard Network Security for Azure Virtual WAN page, provide this information:

   Basics tab

   Parameter	Description
   Subscription	Azure subscription into which you deploy the NVA object.
   Resource group	Azure resource group into which you deploy the NVA object.
   Region	Region into which you deploy the NVA object.
   Application name	The name of the managed app that is displayed in the Resource Group.
   Managed Resource Group	The name of the Azure Managed Resource Group.

   Managed Identity tab

   Parameter	Description
   Subscription	Select the Azure subscription into which you deploy the NVA object.
   User-assigned managed identity	Select the user-assigned managed identity for this subscription.

   CloudGuard NVA Configurations tab

   Parameter	Description
   Virtual WAN Hub	Select the Virtual WAN Hub to deploy the CGNS NVA into.
   NVA name	Name of the new NVA.
   Scale unit	The scale unit determines the size and number of resources deployed. The higher the scale unit, the greater the amount of traffic that can be handled.
   Version	The CloudGuard Network Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. version.
   License type	Type of license: Security Enforcement (NGTP) - Check Point Security Gateways (NGTP package). Full Package (NGTX + S1C) - Check Point Security Gateways (NGTX package, i.e. NGTP and Threat Extraction Check Point Software Blade on a Security Gateway that removes malicious content from files. Acronym: TEX. and Threat Emulation Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE.) and Smart-1 Cloud Security Management. Full Package Premium (NGTX + S1C++) - Check Point Security Gateways (NGTX package) and Smart-1 Cloud Security Management, Compliance Check Point Software Blade on a Management Server to view and apply the Security Best Practices to the managed Security Gateways. This Software Blade includes a library of Check Point-defined Security Best Practices to use as a baseline for good Security Gateway and Policy configuration., DLP and SmartEvent.
   SSH public key source	Select the SSH key source: If you select to generate a new key pair- select an SSH key type and enter a new name for the key pair. If you select to use an existing key stored in Azure - select your key. If you select to use an existing public key - enter the key to the text box
   SSH key type	Select the key format. This parameter depends on the selected SSH public key source.
   Key pair name	The key pair name. This parameter depends on the selected SSH public key source.
   Stored Keys	Select the stored key pair. This parameter depends on the selected SSH public key source.
   SIC Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server. key	SIC key to the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server..
   Confirm SIC key	Enter the same SIC key for verification.
   Quick connect to Smart-1 Cloud	If you select yes (and provide tokens), the NVA Gateways deploy with a secured tunnel to the Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..
   Smart-1 Cloud Token for instance x	The token you generate in the Smart-1 Cloud portal for Gateway instance number x. (x between 1 to 5).

   CloudGuard Advanced Settings tab

   Parameter	Description
   Default shell for the admin user	Select the shell for the admin user.
   BGP ASN Autonomous System Number – Special number that used for the BGP	BGP autonomous system number. (BGP ASN 64512 to 65534 excluding 65515, 65520).
   Bootstrap script	Custom script that configures the NVA instance after deployment. You can find custom scripts here.
   Use public IP for ingress (public preview)	Select "Yes" to deploy the NVA with the attached public IP address that is used for ingress traffic.
   Create new public IP for ingress traffic	Select "Yes" to create the public IP resource with the NVA.
   Public IP resource ID	If you selected "No" in the previous section, enter the existing public IP resource ID here.

   Tags tab

   Parameter	Description
   Tags	Azure tags (Name, Value) that you attach to the selected resources.

   Notes: Smart-1 Cloud (Check Point's Management Server as a Service) is a recommended option to start using CloudGuard Network Security Gateways. Follow the instructions in sk180501 to create tokens for each member and paste them into the applicable fields.

7. On the Review + Create tab, check the radio box to agree to the terms and conditions and click Create.

8. When the NVA creation completes, go to your Virtual WAN, navigate to the hub you selected in the deployment > on the left tree, select Network Virtual Appliance, and make sure you can see your new NVA and its provisioning state is Succeeded (it can take some time).

9. To see the public IP addresses of your CGNS NVA machines click on Click here below Instances info. (Make note of these IP addresses for future use).

Important - CloudGuard Network Security Gateways deployed in the Virtual WAN hub do not scale in or out in response to demand. If your throughput increases, you must deploy a new Managed Application that supports the required throughput and modify routing intent from old to new. Refer to Upgrade.

Step 5: Connect to the Security Management Server or Quantum Smart-1 Cloud (Management-as-a-Service)

These steps are required only if you do not have an installed Check Point Security Management Server or Quantum Smart-1 Cloud instance.

If you already have a Check Point Security Management Server installed or Quantum Smart-1 Cloud instance configured, skip to Step 5.

Notes: The supported Security Management Server version is R81.10 or higher. The Security Management Server must communicate with CloudGuard Network Security Gateways. The Security Gateways must communicate with the Security Management Server. For example, to send logs.

Deploying a Security Management Server in Azure

Item	Description
1	From the Azure Marketplace, deploy this solution to create a Check Point Security Management Server: Check Point Security Management Server.
2	Select the Check Point Security Management software plan. Important - It must be R81.10 and higher. Use these parameters: Server name - The name of the Security Management Server. Credentials - The SSH public key or the SSH password to manage the server. Subscription - The Azure subscription where the servers are deployed. Resource Group - The name of the Resource Group where the server is deployed. Location - The Azure location where the server is deployed. Network setting - A pre-existing Virtual Network Environment of logically connected Virtual Machines. and its subnets or a name of a new Virtual Network and subnets where the server is deployed. Virtual Machine size - The size of the Security Management Server Virtual Machine. Storage setting - The name of a storage account the Security Management Server uses. Allowed GUI clients - IP addresses (in CIDR notation) of the allowed SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Portal, and SSH clients.
3	This template deploys the Security Management Server in the selected subnet. When the management instance starts, it automatically executes the Gaia First Time Configuration Wizard. This can take up to 30 minutes.

Deploying a Security Management Server On-premises

Follow the instructions in the Check Point Installation and Upgrade Guide for your Security Management Server version.

Configuring the Security Management Server

1. Download, install, and configure the latest CME (Cloud Management Extension).

   To download and install the CME on the Security Management Server or Multi-Domain Security Management Server, see sk157492.
   

   To configure the CME, see the Cloud Management Extension Administration Guide.

2. Configure the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. in SmartConsole.

Note - By default, you can access each Check Point Security Gateway and Security Management Server's Gaia Portal Web interface for the Check Point Gaia operating system. from the Internet by browsing to http://<virtual-machine-public-ip>. Restriction of access to the Gaia Portal is possible by configuring a Network Security Group or by configuring the Check Point Security Gateway and Security Management Server settings.

Configuring a Quantum Smart-1 Cloud Instance

If this is your first Check Point deployment, note that the Quantum Smart-1 Cloud service is included with CloudGuard Network Security for Azure Virtual WAN when purchased with these bundles:

• Full Package

• Full Package Premium

Primary benefits of using Quantum Smart-1 Cloud:

• Always the latest security management

  The newest features are automatically updated in a unified management platform.

• Zero Maintenance

  No installation, no upgrade.

• On-demand Expansion

  Seamlessly expand capacity by supporting additional Gateways and storage.

Step 6: Configure NVA Security Gateways on the Security Management Server or Quantum Smart-1 Cloud

There are three options to configure the NVA Security Gateways: with the CME API (recommended), cme_menu, and manually.

Step 7: Set Routing Intent and Routing Policies

Select your Virtual WAN > Select the applicable virtual hub > on the left tree, select Routing Intent and Routing Policies.

• For Internet bound Traffic:
  In the Internet Traffic drop-down select Network Virtual Appliance, in the Next Hop Resource select the NVA you created and click Save.

  

  

• For private traffic:
  In the Private Traffic drop-down select Network Virtual Appliance, in the Next Hop Resource select the NVA you created and click Save.

  

Note - To add prefixes for routing intent click on Additional prefixes.

Step 8: Configure NAT

For outbound traffic, the packets should be NATTed behind the Security Gateway's IP address.

Creating Dynamic Objects 'LocalGatewayExternal' and 'LocalGatewayInternal'

For the manual NAT rules, you must create these Dynamic Objects in SmartConsole:

• LocalGatewayExternal

• LocalGatewayInternal

Procedure:

1. Click Objects menu > More object types > Network Object > Dynamic Object > New Dynamic Object.

2. Enter this exact name (case-sensitive, no spaces):

   LocalGatewayExternal

3. Click OK.

4. Click Objects menu > More object types > Network Object > Dynamic Object > New Dynamic Object.

5. Enter this exact name (case-sensitive, no spaces):

   LocalGatewayInternal

6. Click OK.

7. Publish the SmartConsole session.

Note - The NVA instances IP addresses are automatically associated with the LocalGatewayInternal and LocalGatewayExternal objects.

Creating Manual NAT Rules

Add these two manual NAT rules to the Access Policy:

1. No NAT for internal communication:

   Source	Destination	Port	Xlate Source	Xlate Destination	Xlate Port
   Internal Networks Group	Internal Networks Group	Any	Original	Original	Original

2. For Internet access, Hide NAT to external interface:

   Source	Destination	Port	Xlate Source	Xlate Destination	Xlate Port
   Internal Networks Group	All Internet	Any	LocalGatewayExternal	Original	Original

3. Publish the SmartConsole session.

Step 9: Configure Ingress traffic

Prerequisites:

1. Generate a public IP address with the standard SKU (in the same region as the NVA in the Azure portal).

2. A deployed NVA with attached public IP.

3. NVA instances are configured (See Step 5).

4. See the CME API requirements in the Cloud Management Extension Administration Guide > Azure Virtual WAN.

5. The Security Gateway image version must be at minimum 8120.900631.1522 for R81.20 and 8110.900335.1522 for R81.10.

Configuring rules for ingress traffic

We recommend using CME API to configure ingress rules. For detailed information about configuring ingress rules in Azure vWAN NVA, refer to the Cloud Management Extension Administration Guide > Azure Virtual WAN > Configure Ingress Rules for NVA with CME API.

API Documentation:

• SwaggerHub: Azure Virtual WAN

• Postman Collection: CME API Postman collection

To configure ingress rules with the CME API:

Send a POST request:

POST https://<Management_IP_address>/web_api/v1.8/cme-api/v1.2.1/azure/virtualWANs/accounts/<account_id>/resourceGroups/<nva_resource_group>/inboundRules/<nva_name>

Required parameters:

• account_id: Your Azure account name from the CME configuration file.

• nva_resource_group: The resource group containing your NVA.

• nva_name: Your NVA's name.

Rule parameters:

• name: Unique rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. identifier.

• original_source: Where traffic comes from (IP address).

• lb_public_ips: Load Balancer public IP addresses attached to the NVA.

• original_ports: Ports to accept traffic on.

• protocol: TCP or UDP.

Notes - This API: Supports multiple rules in one request. Allows port ranges (for example, "80-85"). Can assign multiple public IP addresses to a rule. Supports both TCP and UDP protocols.

This asynchronous operation returns a request_id to track progress.

You check progress using a separate GET request:

GET https://<Management_IP_address>/web_api/cme-api/status/<request_id>

To enable ingress traffic, in addition to the rules on the Azure side created with CME API, you also need to add manually the corresponding access and NAT rules on the Security Management Server.

Attach or detach additional existing public IP addresses to the Network Virtual Appliance (NVA) SLB:

1. Log in to Azure Portal.

2. Enter your virtual WAN and navigate to your Hub.

3. On the left tree, click Network Virtual Appliance.

4. Select the applicable NVA and, below NVA Configuration, click Manage Configuration.

5. On the left tree, click Internet Inbound.

6. Click the Add or Delete button on the top left.

7. For adding IP address only:

   1. Select the resource group where you created the public IP address and the public IP address name and click Save.

   2. After the process is complete, make sure that the NVA provisioning state is Succeeded.