Configure CloudGuard Network for GCP MIG

Prerequisites

Make sure these components are configured before proceeding:

1. An external VPC with at minimum one public subnet. You can also create the external VPC during deployment.

2. An internal VPC with at minimum one private subnet. You can also create the internal VPC during deployment.

3. A Check Point Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. running R81 or higher.

4. A group of applications or web servers deployed in the private subnet or in a subnet peered with the MIG backend subnet.

5. For Marketplace deployments - a Google Cloud Platform Google® Cloud Platform is a suite of products and services that includes hosting, cloud computing, database services and more. Acronym: GCP. Service Account with the following permissions:

   • Compute Admin

   • Cloud Infrastructure Manager Agent

   • Service Account User

   • Infrastructure Manager Service Agent

   • Service Usage Admin

   • Service Usage Consumer

   You can also create the service account during the deployment.

   Note - CloudGuard Network Security Gateways can be deployed as IPv4-only or as dual-stack (IPv4/IPv6). Dual-stack deployment requires: CME Take 320 and higher. IPv6-enabled VPC/subnets and appropriate IPv6 firewall rules (these can also be created during deployment).

Step 1: Install the Check Point Security Management Server

We recommend you to use Smart-1 Cloud (Check Point's Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. as a Service) to manage CloudGuard Network Autoscaling Managed Instance Group (MIG).

Refer to Quantum Smart-1 Cloud Administration Guide > Using the settings > Cloud Management Extension (CME) Configuration for step-by-step instructions for enabling CME in Smart-1 Cloud.

Alternative deployment options for the Check Point Security Management Server include Google Cloud Platform, other cloud platforms, or on-premises.

To control the CloudGuard Security Gateways, make sure:

• The Security Management Server can open connections to the CloudGuard Security Gateways.

• The CloudGuard Security Gateways can open connections to the Security Management Server (for example, for sending logs).

The autoscaling CloudGuard Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. can be deployed with or without a public IP address.

Deployments without a public IP address must have one of these topologies:

• Install the Security Management Server in the same internal VPC.

• Install the Security Management Server in a VPC peered with the internal VPC.

• Install the Security Management Server on-premises and connect it to the internal VPC over Cloud Interconnect.

• Install the Security Management Server on-premises and connect it to the internal VPC over a Cloud VPN.

To deploy the Security Management Server in GCP See 'Google Cloud Platform'., go to the Check Point CloudGuard Network Security NGFW and Threat Prevention (BYOL).

Notes: By default, each Check Point Security Gateway and Security Management Server's Gaia Portal Web interface for the Check Point Gaia operating system. is accessible online at http://<virtual-machine-public-ip>. You can restrict access to the Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Portal by configuring a Firewall Rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. or by adjusting the Security Gateway and Security Management Server settings. A Check Point Security Management Server running R81.10 or higher is required to manage a MIG using External and Internal Load Balancers with CME Take 157 or higher.

Step 2: Configure the Check Point Management Server

Do these steps to manage MIG with the Check PointSecurity Management Server:

1. Downloading and Installing the Latest CME Version.

2. Configuring the CME on the Security Management Server

3. Configure the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

   Important - The policy name must be the same as the name you used when configured a GCP template in CME.

Step 3: Create a Google Cloud Platform (GCP) Service Account

The Check Point Security Management Server uses the GCP Service account to monitor the creation and status of the autoscaling Managed Instance Group. This lets the Security Management Server complete provisioning of these Security Gateways.

To create a GCP service account:

1. Go to https://cloud.google.com/iam/docs/creating-managing-service-accounts.

   Use these parameters:
   

   Name: check-point-autoprovision

   Role: Compute Engine \ Compute Viewer

2. Click Create Key > JSON (as the key type). A JSON file is downloaded to your computer.

   Note - This JSON file is later used as the credentials file in Step 2: Configure the Check Point Management Server.

Step 4: Deploy the Check Point Autoscaling Managed Instance Group

Deploy one of these Google Cloud Marketplace solutions:

• The Check Point CloudGuard Network Security autoscaling with the Bring Your Own License (BYOL) licensing model,

  or

• The Check Point CloudGuard Network Security autoscaling with the Pay as You Go (PAYG) licensing model.

Notes: New provisioned Security Gateways automatically receive the latest published Security Policy. Existing Security Gateways do not automatically receive additional policy installations after provisioning. Autoscaling Security Gateways objects are created and deleted automatically based on environment needs. Do not use these objects explicitly in rules or edit them manually. By default, the WebUI of each Check Point Security Gateway and Security Management Server is accessible online at http://<virtual-machine-public-ip>. To limit access to the WebUI, configure a Firewall Rule or adjust the Check Point Security Gateway and Security Management Server settings.

Step 5: Configure Load Balancers

Load Balancers are automatically deployed and configured as part of the CloudGuard Network Security for GCP MIG solution deployment with Terraform templates.

When the Managed Instance Group (MIG) is deployed in dual-stack (IPv4/IPv6) mode, the required Load Balancer components are automatically created and configured to support IPv4 and IPv6 traffic.

If you deploy the CloudGuard Network Security for GCP MIG solution from GCP Marketplace, you must create and configure Load Balancers manually as described below.

We recommend you to go through Google's Load Balancing documentation at: https://cloud.google.com/load-balancing/docs/network/.

The steps below are for TCP load balancers. HTTP(S) load balancers are also supported and can be used alternatively.

External Load Balancer

You must set up the External (Internet-facing) Load Balancer to receive TCP traffic and distribute it to the pool of Security Gateways.

To create the External Load Balancer, do these steps:

1. Open the Load Balancing section in Google Cloud Console.

2. To create a new Load Balancer, click Create.

3. Select Type > Network Load Balancing. Click Next.

4. Select Passthrough load balancer. Click Next.

5. Select Public facing ("From Internet to my VMs"). Click Configure.

6. For the Backend type, select Backend Service.

7. Enter a name for the new External Load Balancer

   Example: "prod-ext-lb"

In the Backend configuration section:

1. Select the region where you deployed the Security Gateways autoscaling MIG.

2. Select the deployed Security Gateway's autoscaling Managed Instance Group (MIG) from the Instance group drop-down list.

3. In Health check, click Create a new health check.

   1. Enter a name for the health check. For example, "cloudguard-gateways-healthcheck"

   2. For the Port number, enter 8117 (for dual-stack deployments, use port 443).

      Note - Other ports are not supported.

   3. In the Request path, enter a correct path. The application server listens for HTTP health check requests from this path.

   4. Click Save and continue.

   5. From Session affinity, select Client IP and protocol.

In the Frontend configuration section:

1. Enter a name for the frontend.

   Example: "app1-ext-frontend"

2. In IP, select a static public IP address or create a new one.

3. In Port, select the port on which this frontend must listen.

4. Click Review and finalize to review the Load Balancer configuration.

5. To create the Load Balancer, click Ready.

Internal Load Balancer

The Internal Load Balancer (ILB Internal Load Balancer, used to load balance traffic in a virtual network) lets you use a next hop that redirects packets to the Load Balancer's targets and then to the instances in the MIG. You can find the route configuration instructions below.

When Virtual Machine (VM) instances in your Virtual Private Cloud (VPC) network send traffic to the Internet, the traffic is routed through the load-balanced Security Gateway virtual appliances.

Note - Using an internal load balancer with a MIG as the backend is supported starting from R81.10.

To create the Internal Load Balancer, do these steps:

1. Open the Load Balancing section in Google Cloud Console.

2. To create a new Load Balancer, click Create.

3. Select Type > Network Load Balancing. Click Next.

4. Select Passthrough load balancer. Click Next.

5. Select Internal ("Only between my VMs"). Click Configure.

6. Enter a name for the new Internal Load Balancer.

   Example: "prod-int-lb"

In the Backend configuration section:

1. Select the region where you deployed the Security Gateway's Auto Scaling MIG.

2. From the Instance group list, select the deployed Security Gateway's Auto Scaling Managed Instance Group (MIG) and select the TCP/UDP protocol.

3. In the Health check, click Create a new health check.

   1. Enter a name for the health check. For example, cloudguard-gateways-healthcheck.

   2. For the Port number, enter 8117 (for dual-stack deployments, use port 443).

      Note - Other ports are not supported.

   3. Click Save and continue.

In the Frontend configuration section:

1. Enter a name for the frontend.

   Example: "app1-int-frontend"

2. Select the MIG internal sub-network.

3. Select the TCP/UDP protocol.

   Note - L3 protocols are not supported.

4. In Internal IP, select an existing internal IP address or create a new one.

5. Set the Port to All to make the ILB the internal network's next hop.

6. Click Review to review the Load Balancer configuration.

7. To create the Load Balancer, click Ready.

Step 6: Implement the Firewall and NAT Rules for inbound traffic

You must create Firewall and NAT rules to allow traffic to the published service or application. This traffic is then redirected to the Internal Load Balancer.

• The autoscaling MIG deployed by the Google Cloud Marketplace template creates a network interface in the external and internal networks. Each Security Gateway in the autoscaling Managed Instance Group (MIG) has a dynamic object for each network interface. This allows for easier and clearer configuration of Firewall and NAT rules.

• A dynamic object is a "logical" object where the IP address is resolved differently for each Security Gateway.

• With a dynamic object for each network interface, you can describe Firewall and NAT rules. This dynamic object uses the network interface on which the Security Gateway sends or receives traffic without explicitly stating its IP address.

  These dynamic objects are created automatically on each Security Gateway in the autoscaling fleet:

  Network	Interface	Dynamic Object
  External	eth0	LocalGatewayExternal
  Internal	eth1	LocalGatewayInternal

How to create dynamic objects

Note - Dynamic objects on the Security Gateway are created automatically.

To create dynamic objects on the Security Management Server, do these steps:

1. In SmartConsole, connect to the Security Management Server (also referred to as the Domain Management Server).

2. Create a Dynamic Object named LocalGatewayExternal. For this, in the Object Browser, click New > More >Network Object > Dynamic object. A Dynamic Object window opens.

   Note - Skip this step if this Dynamic Object Special object type, whose IP address is not known in advance. The Security Gateway resolves the IP address of this object in real time. already exists.

3. Enter the name of the object. For example, LocalGatewayExternal.

4. Click OK,

5. Repeat Step 2 for LocalGatewayInternal.

How to create the External Load Balancer Host object

Note - Create a Host object for each Public IP address published on the External Load Balancer.

1. In the Object Browser, click New > More > Network Object > Host. The Host window opens.

2. Enter a descriptive name (for example, App1-ELB).

3. Enter the External Load Balancer's public IP address.

   Example:

   

How to create the Internal Load Balancer Host object

Note - Create a Host object for each Internal Load Balancer.

1. In the Object Browser, click New > More > Network Object > Host. The Host window opens.

2. Enter a descriptive name (for example, App1-ILB).

3. Enter the Internal Load Balancer's private IP address.

   Example:

   

How to create a new TCP service

Note - Create a new TCP service for each service port on which the External Load Balancer listens. Skip this step if you use a standard port (such as HTTP 80 or HTTPS 443) that already exists in the services list.

Note - The All_Internet object represents IPv4 Internet addresses only. For dual-stack deployments, modify the All_Internet object to also include the full IPv6 address range (:: – ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff).

1. In the Object Browser, click New > More > Service > TCP.

2. Enter a descriptive name (for example, acme-54321).

3. From the General > Protocol list, select the protocol.

4. In the Match By > Port menu , select Customize.

5. Enter the port number (for example, 54321).

Notes: GCP TCP Load Balancers forward traffic to the CloudGuard Security Gateways without changing the destination address of the original request. The request's destination address remains the public IP address of the External Load Balancer. If you have not created an outbound CA certificate, follow the instructions below to create one.

Important - You must have an Outbound CA certificate for an inbound SSL inspection use case.

How to set the HTTPS Inspection

1. In SmartConsole, go to each Security Gateway object and click the HTTPS Inspection tab.

2. Click Server Certificates > Create Certificate.

3. Enter the required information and click OK.

4. Create an HTTPS service similar to the HTTP service created in Step 6: Implement the Firewall and NAT Rules for inbound traffic (select port number 8443).

5. In the Security policy, go to the HTTPS inspection table and add this rule:

   • Source: Any

   • Destination: Any (do not use the Internet object)

   • Service: Select the HTTPS service created in External Load Balancer

   • Action: Inspect

   • Certificate: The certificate you created in step 2.

6. Save the changes. Click the diskette icon at the top or press CTRL+S.

To enable HTTPS Inspection (as explained in Enabling and Disabling Software Blades):

1. Publish the changes in SmartConsole.

2. Install the Security Policy on any existing CloudGuard Security Gateway.

Updating Auto Provisioning

To download and install the latest Auto Provisioning Check Point Software Blade on a Management Server that manages large-scale deployments of Check Point Security Gateways using configuration profiles. Synonyms: SmartProvisioning, SmartLSM, Large-Scale Management, LSM. version, follow the instructions in sk157492 for the latest Cloud Management Extension (CME) update.