Network

• Each CloudGuard Network Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. resides in a different GCP Google® Cloud Platform is a suite of products and services that includes hosting, cloud computing, database services and more. Zone.

• Each gateway has a network interface in a subnetwork (in the Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. VPC). The CloudGuard Network High Availability A redundant cluster mode, where only one Cluster Member (Active member) processes all the traffic, while other Cluster Members (Standby members) are ready to be promoted to Active state if the current Active member fails. In the High Availability mode, the Cluster Virtual IP address (that represents the cluster on that network) is associated: (1) With physical MAC Address of Active member (2) With virtual MAC Address. Synonym: Active/Standby. Acronym: HA. solution inspects inbound traffic from this VPC. Therefore, the GCP Firewall rules and routes must be configured to allow all traffic.

• Private access to Google APIs must be enabled for this subnetwork. This is to allow the CloudGuard Network High Availability VM instances access to Google APIs to execute a failover Transferring of a control over traffic (packet filtering) from a Cluster Member that suffered a failure to another Cluster Member (based on internal cluster algorithms). Synonym: Fail-over. process.

• The cluster's public IP address is attached to the network interface of the active State of a Cluster Member that is fully operational: (1) In ClusterXL, this applies to the state of the Security Gateway component (2) In 3rd-party / OPSEC cluster, this applies to the state of the cluster State Synchronization mechanism. gateway in this network.

• Each gateway has a network interface in a subnetwork in the Management VPC. This is the network that manages the gateways.

• The gateways have a network interface in each of the internal, optionally shared VPC networks that the cluster secures. In each of the internal VPC networks, a GCP Route routing all outbound traffic (0.0.0.0/0) to the active member is automatically created.

Use the primary public IP address of the Active member (eth0) to forward traffic that comes from the Internet.

Important - You cannot use these ports:

• 80

• 443

• 444

• 8082

• 8880

• Four Virtual Networks in GCP, each contains four subnets:

  • Cluster

  • Management

  • Web

  • App

• When the active gateway fails, the standby State of a Cluster Member that is ready to be promoted to Active state (if the current Active Cluster Member fails). Applies only to ClusterXL High Availability Mode. member will identify the failure A hardware or software problem that causes a Security Gateway to be unable to serve as a Cluster Member (for example, one of cluster interface has failed, or one of the monitored daemon has crashed). Cluster Member that suffered from a failure is declared as failed, and its state is changed to Down (a physical interface is considered Down only if all configured VLANs on that physical interface are Down)., and then do the following:

  • Detach the cluster's public IP address from the failed member A Cluster Member that cannot send or accept traffic because of a hardware or software problem..

  • Detach the cluster's secondary public IP address from the standby member. When the failed members returns to standby state, it will attach this address to itself.

  • Attach the cluster's public IP address to itself.

  • For each of the internal VPC networks:

    • If Member A becomes the active member, it will create high priority routes that will route all outbound traffic in the internal networks to itself.
      Note - A lower priority number equals a higher priority for the route.

    • If Member B becomes the active member, it will remove the high priority routes created by Member A. The result is that existing, lower priority routes will take effect, and route all outbound traffic in the internal networks to itself.

1. Packet enters the frontend network interface (eth0) of the Active Cluster Member.

2. The Active Cluster Member decrypts the packet.

3. The Active Cluster Member forwards the packet to its destination.

1. Traffic travels to an Active Cluster Member based on the high priority route.

2. The Active Cluster Member inspects the traffic and forwards it to the destination.

1. Traffic travels from one of the internal servers to the Active Cluster Member.

2. The Active Cluster Member forwards the traffic to the destination.

Traffic travels freely in the subnet without inspection.