Configuring a High Availability Cluster in GCP

Prerequisites:

1. Google Cloud Platform Service Account with the following permissions:

   • Compute Admin

   • Cloud Infrastructure Manager Agent

   • Service Account User

   • Infrastructure Manager Service Agent

   • Service Usage Admin

   • Service Usage Consumer

   You can also create the service account during the deployment.

   Note - This prerequisite is required only for Marketplace deployments.

Step 1: Enable Google Private Access to the Cluster Network

Note - If the VPC was created during deployment, you can skip this step.

To enable Google Private Access to the Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Network:

1. From Cloud Platform, select VPC network > VPC networks.

2. Select cluster-network / cluster network-subnet.

3. Set Private Google access to On.

Step 2: Deploy a Template in GCP

Deploy this solution throughout the GCP Google® Cloud Platform is a suite of products and services that includes hosting, cloud computing, database services and more. Portal:

• Check Point CloudGuard High Availability A redundant cluster mode, where only one Cluster Member (Active member) processes all the traffic, while other Cluster Members (Standby members) are ready to be promoted to Active state if the current Active member fails. In the High Availability mode, the Cluster Virtual IP address (that represents the cluster on that network) is associated: (1) With physical MAC Address of Active member (2) With virtual MAC Address. Synonym: Active/Standby. Acronym: HA. BYOL (Bring Your Own License)

  OR

• Check Point CloudGuard High Availability PAYG (Pay as You Go)

Manage the GCP HA with Management High Availability/Multi-Domain Security Management Server High Availability

To manage the GCP HA with Management High Availability Deployment and configuration mode of two Check Point Management Servers, in which they automatically synchronize the management databases with each other. In this mode, one Management Server is Active, and the other is Standby. Acronyms: Management HA, MGMT HA./Multi-Domain Security Management Server High Availability you must set a static route to the Secondary Management IP address on both Cluster Members:

1. Connect with SSH to each one of the Cluster members.

2. From the Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)., run the command:

   set static-route <SECONDARY_MANAGEMENT_IP> nexthop gateway address <MANAGEMENT_NETWORK_GATEWAY> on

   • SECONDARY_MANAGEMENT_IP - The public address of the secondary Management server using the CIDR notation (IPv4 Address / Mask Length).

   • MANAGEMENT_NETWORK_GATEWAY - The Management (nic1) subnet Gateway: In the GCP portal, go to VPC networks, select the Management VPC (nic1) > SUBNETS, and copy the value below Gateway.

3. Run: save config

The deployment takes about five minutes. After the deployment is finished, information is displayed in the deployment details page, such as the Public IP addresses created and the network used for Primary Cluster Synchronization used later in this guide.

Components of the Check Point Solution

Important - No other Virtual Machines can be deployed in the solution's subnet.

Step 3 (Optional): Deploy the Cluster without a Public IP address

When you configure High Availability in GCP, you automatically receive Public IP addresses. Do this procedure to remove the Public IP addresses and configure your HA to work with Private IP addresses.

Note - For new deployments from the GCP Marketplace only, you can clear the Deploy HA with Public IPs checkbox and skip this procedure.

Notes: You must configure External and Internal Load Balancers to use HA without a Public IP address. Threat Emulation Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE. blade is not supported on HA without a Public IP address. When deploying an HA Cluster without Public IP addresses, the Security Management Server must manage the Cluster with its Private IP addresses. To receive updates, the two Cluster members must have access to the Internet. If the Security Management Server that manages the HA Cluster and the Cluster's management network (NIC 1) are in the same VPC, they must be in different subnets.

Step 4: Configure Cluster Objects in SmartConsole

To configure objects in SmartConsole:

Step	Description
Note - If the Security Management Server is deployed in GCP and manages a Cluster Member in a different VPC, then modify the Security Management IP object in SmartConsole to be the Public IP address of the Management Server. Click Publish to apply the change.
1	Click the Objects menu > New > More > Network Object > Gateways & Servers > Cluster > New Cluster.
2	Select Wizard Mode. The Check Point Installed Gateway Cluster wizard window opens.
3	Enter a Cluster Name. Example: checkpoint-cluster
4	In the Cluster IPv4 Address field, enter the cluster IP address (VIP). You can find the cluster IP address in the GCP portal: Browse to the VM instances page. Locate and select member a instance. From the Network interfaces section, copy the value of the External IP address for nic0 (the name ends with primary-cluster-address).
5	Click Next. The Gateway Cluster Properties window opens.
6	Click Add new cluster member. In the Name field, enter the first Cluster Member's name. Example: member1 In the IPv4 address field: Enter the Cluster Member's Public IP address from Management VPC (Member A external IP address and Member B external IP address are displayed on the deployment details page). In the Activation Key field, enter the SIC key (set up in GCP). In the Confirm Activation Key field, enter the SIC key again. Click Initialize. If the Activation Key is confirmed, the Trust State field shows Trust Established. Click OK.
7	Repeat the Step 7 to add the second Cluster Member.
8	Click Next. The Cluster Topology window opens.
9	Select the subnetwork provided in the Management network field during the deployment as the Synchronization network.
10	Configure the other subnetworks as Private use for each member.
11	Complete the wizard, and then click Publish to save the settings.
12	Open the Cluster object.
13	Configure the ClusterXL Cluster of Check Point Security Gateways that work together in a redundant configuration. The ClusterXL both handles the traffic and performs State Synchronization. These Check Point Security Gateways are installed on Gaia OS: (1) ClusterXL supports up to 5 Cluster Members, (2) VRRP Cluster supports up to 2 Cluster Members, (3) VSX VSLS cluster supports up to 13 Cluster Members. Note: In ClusterXL Load Sharing mode, configuring more than 4 Cluster Members significantly decreases the cluster performance due to amount of Delta Sync traffic. mode: In the Cluster's object left tree, click ClusterXL and VRRP. Select High Availability. In versions R81.20 and higher, select Use Geo Mode in a Cloud.
14	Click OK
15	Open the Cluster object.
16	In the Network management tab, disable Anti-Spoofing for all interfaces by editing those interfaces in the cluster object.
17	The IPsec VPN Check Point Software Blade on a Security Gateway that provides a Site to Site VPN and Remote Access VPN access. blade is automatically enabled. To use the VPN blade, see Step 9: Configure VPN. Otherwise, disable the VPN blade.
18	Click OK.
19	Install the applicable Access Control Policy on the cluster object.

A few minutes after the applicable Access Control Policy is installed, the following changes occur automatically in GCP:

1. The following Public IP addresses for each Cluster Member in Cluster VPC will be attached:

   • Primary Public IP address.

   • Secondary Public IP address.

2. In each of the internal VPC networks, a GCP Route routes all outbound traffic (0.0.0.0/0) to the Active member with high priority (1) and to the secondary member with lower priority (2).

Notes: For the failover Transferring of a control over traffic (packet filtering) from a Cluster Member that suffered a failure to another Cluster Member (based on internal cluster algorithms). Synonym: Fail-over. process to function, each Cluster Member initiates outbound HTTP and HTTPS traffic which is allowed by the gateway's implied rules. Do not override these implied rules. By default, every Check PointSecurity Gateway and Security Management Server's WebUI is accessible from the internet by browsing to Restricting access to the WebUI is possible by configuring a Firewall Rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session., or by configuring the Check PointGateway and Management Server settings. When deleting the Standby member from SmartConsole, it must also be deleted from the GCP portal. The termination must be done to release secondary Public IP addresses.

Step 5 (Optional): Configure External and Internal Load Balancers

You can add a Load Balancer to your CloudGuard Network for the GCP environment. After you complete this procedure, the Security Gateways start responding to GCP probes.

Note - This feature is only available to machines that run CloudGuard Network version R81.10 and higher.

1. Create an instance group in GCP.

   1. In the GCP Portal, search for Instance groups.

   2. Click Create instance group > New unmanaged instance group.

   3. Select the region where the HA is deployed.

   4. Select the Cluster's external network.

   5. In VM instances, select both Cluster's members.

   6. Click Create.

   Note - If each Cluster Member is in a different zone, create one unmanaged instance group for each.

2. Create an External Load Balancer in Google Cloud Console.

   1. Open the Load Balancing section in Google Cloud Console.

   2. Click Create.

   3. Select Type > Network Load Balancing. Click Next.

   4. Select Passthrough load balancer. Click Next.

   5. Select Public facing ("From internet to my VMs").

   6. Click Configure.

   Backend configuration

   1. Enter a name for the new External Load Balancer.

   2. Select the region where the Security Gateways High Availability Cluster was deployed.

   3. From the Instance group drop-down State of a Cluster Member during a failure when one of the Critical Devices reports its state as "problem": In ClusterXL, applies to the state of the Security Gateway component; in 3rd-party / OPSEC cluster, applies to the state of the State Synchronization mechanism. A Cluster Member in this state does not process any traffic passing through cluster. list, select the deployed Security Gateways unmanaged instance group. (If you created two unmanaged instance groups, select both by adding another backend).

   4. In Health check, click Create a new health check:

      1. Enter a name for the health check. For example, "cloudguard-gateways-healthchecks".

      2. For Port number, enter 8117. (Other ports are not supported.)

      3. Click Save and continue.

   5. From Session affinity, select Client IP and protocol.

   Frontend configuration

   1. Enter a name for the frontend. For example, "app1-ext-frontend".

   2. In IP, select a static Public IP address or create a new one.

   3. In Port, select the port on which this frontend should listen.

   4. Click Review and finalize to review the External Load Balancer configuration.

   5. Click Create.

3. Create an Internal Load Balancer in Google Cloud Console.

   1. Open the Load Balancing section in Google Cloud Console.

   2. Click Create.

   3. Select Type > Network Load Balancing. Click Next.

   4. Select Passthrough load balancer. Click Next.

   5. Select Internal ("Only between VMs").

   6. Click Configure.

   Backend configuration

   1. Enter a name for the new Internal Load Balancer.

   2. Select the region where the Security Gateways High Availability Cluster was deployed.

   3. Choose the internal network the Internal Load Balancer will be facing.

   4. From the Instance group drop-down list, select the deployed Security Gateways unmanaged instance group. (If you created two unmanaged instance groups, select both by adding another backend).

   5. In Health check, click Create a new health check (if you have already created one for the External Load Balancer, you can use it here as well):

      1. Enter a name for the health check. For example, "cloudguard-gateways-healthchecks".

      2. For Port number, enter 8117. (Other ports are not supported.)

      3. Click Save and continue.

   6. From Session affinity, select Client IP and protocol.

   Frontend configuration

   1. Enter a name for the frontend. For example, "app1-int-frontend".

   2. In IP, select a static internal IP address or create a new one.

   3. In Port, select All.

   4. Click Review and finalize to review the Internal Load Balancer configuration.

   5. Click Create.

4. Create Firewall and NAT Rules to allow inbound traffic to the published service or application.

   The HA Cluster deployed using the Google Cloud Marketplace template creates a network interface in the external and internal networks. Each Security Gateway in the Cluster has a dynamic object for each network interface. This allows for easier and clearer configuration of Firewall and NAT rules.

   A dynamic object is a "logical" object where the IP address is resolved differently for each Security Gateway.

   With a dynamic object for each network interface, you can describe Firewall and NAT rules. This dynamic object uses the network interface on which the Security Gateway sends or receives traffic without explicitly stating its IP address.

   These dynamic objects are created automatically on each Security Gateway in the Cluster:

   Network	Interface	Dynamic Object
   External	eth0	LocalGatewayExternal
   Internal	eth1	LocalGatewayInternal

   How to create dynamic objects

   Note - Dynamic objects on the Security Gateway are created automatically.

   To create dynamic objects on the Security Management Server, do these steps:

   1. In SmartConsole, connect to the Security Management Server (or to the Domain Management Server in the Multi-Domain Security Management Server environment).

   2. Create a Dynamic Object Special object type, whose IP address is not known in advance. The Security Gateway resolves the IP address of this object in real time. named LocalGatewayExternal. For this, in the Object Browser, click New > More > Network Object > Dynamic Object. A Dynamic Object window opens.

      Note - Skip this step if the corresponding Dynamic Object already exists.

   3. Enter the name of the object. For example, LocalGatewayExternal.

   4. Click OK.

   5. Repeat Step b for LocalGatewayInternal.

   How to create the External Load Balancer Host object

   Note - Create a Host object for each Public IP address published on the External Load Balancer.

   To create the External Load Balancer Host object, do these steps:

   1. In the Object Browser, click New > More > Network Object > Host.
      The Host window opens.

   2. Enter a descriptive name (for example, App1-ELB).

   3. Enter the External Load Balancer's Public IP address.

      Example:

      

   How to create the Internal Load Balancer Host object

   Note - Create a Host object for each Internal Load Balancer.

   To create the Internal Load Balancer Host object, do these steps:

   1. In the Object Browser, click New > More > Network Object > Host. The Host window opens.

   2. Enter a descriptive name (for example, App1-ILB).

   3. Enter the Internal Load Balancer's Private IP address.

      Example:

      

   Notes: GCP TCP Load Balancers forward traffic to the CloudGuard Security Gateways without changing the destination address of the original request. The request's destination address remains the Public IP address of the External Load Balancer. If you have not created an outbound CA certificate, follow the instructions below to create one.

   Important - You must have an Outbound CA certificate for an inbound SSL inspection use case.

   How to create a Firewall rule

   Do these steps:

   Step	Description
   1	For each GCP forwarding Process of transferring of an incoming traffic from one Cluster Member to another Cluster Member for processing. There are two types of forwarding the incoming traffic between Cluster Members - Packet forwarding and Chain forwarding. For more information, see "Forwarding Layer in Cluster" and "ARP Forwarding". rule, create a corresponding Firewall rule with these values: Source: Any (or any other applicable value) Destination The Public IP address on the External Load Balancer that will accept this traffic. For example, App1-ElB. Services: The service on which the External Load Balancer is listening. For example, http. Example: Name Source Destination Services & Applications Data Action Track Allow Appl All_Internet App1-ELB http * Any Accept Log
   2	For each Load Balancer rule, create an applicable NAT rule with these values: Rule Value Original Source All_Internet (do not use "Any") Original Destination App1-ELB Original Services The service on which the External Load Balancer is listening (HTTP). Translated Source LocalGatewayInternal- Right-click on the cell and set the NAT Method to Hide. Host The Host object representing the Internal Load Balancer. Translated Service HTTP (or any service representing the port on which the Internal Load Balancer is listening). Example: Original Source Original Destination Original Services Translated Source Translate Destination Translated Service All_Internet App1 ELB http H LocalGatewayInternal S App1 ILB Original

   How to set the HTTPS Inspection

   Do these steps:

   1. In SmartConsole, go to each Security Gateway object and click the HTTPS Inspection tab.

   2. Click Server Certificates > Create Certificate.

   3. Enter the required information and click OK.

   4. Create an HTTPS service similar to the HTTP service from the Create Firewall and NAT Rules to allow inbound traffic to the published service or application. section (select port number 8443).

   5. In the Security policy, go to the HTTPS inspection table and add this rule:

      • Source: Any

      • Destination: Any (do not use the Internet object)

      • Service: Select the HTTPS service created in Create an External Load Balancer in Google Cloud Console.

      • Action: Inspect

      • Certificate: The certificate you created in Step b

   6. Save the changes. Click the diskette icon at the top or press CTRL+S.

   7. Publish the changes in SmartConsole.

   8. Install the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. on any existing CloudGuard Security Gateway.

5. Configure a GCP route.

   For the traffic to pass through the Internal Load Balancer, add a route with priority 0 in the internal VPCs in GCP. For example:

   

6. Configure subnets on the Security Management Server.

   1. On the Security Management Server, create a table of subnets that are transferred to the Security Gateways after policy installation.

   2. Add this section to the $FWDIR/conf/user.def.FW1 file on the Security Management Server:

      Copy

      cloud_balancer_ips = {
                                      <35.191.0.1, 35.191.255.254>,
                                      <130.211.0.1, 130.211.3.254>,
                                      <209.85.152.1, 209.85.155.254>,
                                      <209.85.204.1, 209.85.207.254>
                                  };

      Important - For R82 Security Management Server, add the section above to these files: $FWDIR/conf/user.def.FW1 $FWDIR/conf/user.def.R8120CMP

   3. Install the policy.

For more information on Google's Load Balancer, refer to: https://cloud.google.com/load-balancing/docs/network/.

Step 6: Enable Outbound Traffic

To enable outbound traffic:

1. From SmartConsole, connect to the Security Management Server.

2. Find the Security Cluster object in the Gateways & Servers tab.

3. Select the NAT tab.

4. Select the Hide internal networks behind the Gateway's external IP checkbox.

5. Click OK.

6. Install policy.

Note - NAT does not support connection synchronization during failover. If you configure the cluster to always hide the internal networks (by selecting to automatically add address translation rules - instead of the option described above) this prevents connection synchronization in additional use cases, such as East-West traffic between internal VPCs.

Step 7: Create Object LocalGatewayExternal in SmartConsole

In SmartConsole, create the Dynamic object called LocalGatewayExternal.

This object represents the Cluster Member's Private IP addresses.

Note - This Dynamic object step is used in Step 9: Configure VPN.

Step 8: Configure Inbound Protection (Without Load Balancers)

About this NAT rule:

• Matches any traffic that arrives at the CloudGuard Security Gateway on the applicable internal port.

• Translates the destination IP address to the IP address of the Web Servers.

Step 9: Configure VPN

For more information, see the Check Point Security Management Administration Guide for your Management Server version.

Step 10: (Optional) Deploying an Additional HA Cluster in a Shared VPC

Important - Version B991001727 or higher is required for this deployment. To verify your version number: SSH into your machine. Run cat /etc/cloud-version.