Installing the CloudGuard Network Security Gateway

1. Log in to the NSX-T manager Web Client.

2. Select System > Fabric > Nodes > Host Transport Nodes.

3. From the Managed By drop-down list, choose a vCenter.

4. Select the cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. on which you want to install the NSX VIB, and then click Configure NSX.

   The Configure NSX window opens.

5. In Select Deployment Profile, from the drop-down list, choose the relevant profile you created earlier for your ESXi.

6. Click Save.

7. The VIB is automatically installed on the cluster ESXi.

1. Select VMware > NSX-T > Manage NSX-T Controller > Add NSX-T Controller.

2. Enter the Host IP which is the NSX-T manager IP address.

   When the thumbprint of the server shows, verify it.

   You can get the thumbprint from the NSX-T manager CLI.

   Log in as admin, and run:

   • For unclustered NSX-T managers:

     get certificate API thumbprint

   • For clustered NSX-T managers:

     get certificate cluster thumbprint

3. In CME Take 233 and higher: Configure no_proxy value [ True/False ].

   If you set the no_proxy variable to True, the CME connects to the NSX-T Manager without using the Proxy configured on the Check Point Management server (if the Proxy exists).

4. Enter the Controller Name.

   Notes: The name must be unique for each controller on the Management Server. The name must not exceed 15 characters.

5. Enter the Controller User Name.

   This is the same username used to log in to the NSX-T manager.

   Username supported characters:

   • Upper letters (A-Z).

   • Lowercase letters (a-z).

   • Digits (0-9).

   • Underscore character (_).

6. Enter the Controller User Password, and then confirm.

   This is the same password used to log in into the NSX-T manager.

   Password requirements:

   • Contains at least 8 characters.

   • Contains both upper letters (A-Z) and lowercase letters (a-z).

   • Contains at least one digit (0-9).

   • Contains at least one special character (~ ! @ # $ % ^ & * ( ) _ - + =).

7. If this is Multi-Domain Server Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. environment, select the domain.

8. To confirm the controller is connected select Show NSX controller and confirm your NSX-T controller status is Connected.

   If it necessary to change the user name and password for the controller, go to:

   VMware> NSX-T > Manage NSX-T Controller > Update NSX-T Controller User.

1. Select VMware > NSX-T > Register New Service.

2. Select Attachment Point: East-West or North-South.

   1. For East-West service, enter the URL path for the OVF.

   2. For North-South service:

      1. Select which Tier you want to deploy your service on Tier 0 or Tier 1.

      2. Choose Failure Policy.

      3. Enter the URL path for the OVF.

3. Select the NSX-T controller.

4. Enter and then confirm the SIC one-time password for the gateway to be deployed in the NSX-T manager web client.

   Note - The SIC Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server. one-time password is a string of 8-12 alphanumeric characters. Special characters are not allowed.

5. Enter and then confirm the admin password for the gateway that you want to deploy in the NSX-T manager web client.

The service is now available for deployment on the NSX-T manager web client.

A Service Profile is an instance of a CloudGuard Network vendor template.

To create a new Service Profile in NSX-T 3.0 and higher:

1. Select Security > select Network Introspection Settings for NSX-T 3.0 > Service Profiles.

2. Select the service to create a profile for, and then click Add Service Profile.

3. Enter the Service Profile Name.

4. Select the vendor template.

   The vendors were already created in the service registration.

   Their purpose is to expose protection levels in the policies.

To create a new Service Profile in NSX-T 2.5:

1. Select Security > Network Introspection (E-W) > Service Profiles.

2. Select the service to create a profile for, and then click Add Service Profile.

3. Enter the Service Profile Name.

4. Select the vendor template.

   The vendors were already created in the service registration.

   Their purpose is to expose protection levels in the policies.

1. Click the Objects menu > Objects Explorer > More Object Types > Network Objects > Gateways and Servers > Gateway.

2. The Security Gateway object opens on the General Properties page.

3. In the Name field, enter a name for the Security Gateway object.

4. In the IPv4 Address field, enter the IPv4 address.

5. Click Communication.

6. In the Trusted Communication window:

   1. Enter the SIC one-time password you configured when you deployed the VM.

   2. Click Initialize.

   3. Wait for the Trust state to change to Trust established.

   4. Click OK.

   You are back on the General Properties page.

7. In the Platform section, in the Version field, select the correct version.

8. On the Network Security tab, select the required Software Blades.

9. From the left tree, click the Network Management page:

   1. Double-click the interface eth0.

   2. For HA Cluster, configure Interface Type as Cluster.

   3. In the Topology section, click Modify.

   4. In the Leads To section, select Override > This Network (Internal) > Network defined by the interface IP and Net Mask.

   5. In the Anti-Spoofing section, clear Perform Anti-Spoofing based on interface topology.

   6. Click OK to close the Topology Settings window.

   7. Click OK to close the Interface window.

10. For HA Cluster, configure interface type:

    1. Double-click the interface eth3.

    2. Configure Interface Type as Primary + Sync.

11. Click OK.

12. For HA Cluster, reboot all Cluster members.

1. Dedicated cluster for each tenant. Each tenant's traffic is handled by a single service deployed on the cluster.

   This enforces the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. that applies to the security groups for the specific tenant.

2. Tenants share the same cluster.

   This solution requires a service registration for each tenant.

   Manage each tenant through a different service.

   To control the tenant traffic redirection, separate security groups have to be created for each tenant.

1. Register a new service with a unique name that identifies the tenant.

2. Deploy the service on the required cluster.

   A service instance is added to each host in the cluster.

3. Create a new security group for the tenant. Include all objects that require protection.

4. Redirect each tenant's traffic through the designated service.

1. From the left navigation panel, click Gateways & Servers.

2. If there is no Host object with the IP address 127.0.0.1, then create one.

3. Double-click the CloudGuard Gateway object.

4. On the Network Security tab, enable the Identity Awareness Software Blade Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities..

5. In the Identity Awareness Configuration wizard:

   1. Select only Terminal Servers > click Next.

   2. Select I do not wish to configure an Active Directory at this time > click Next.

   3. Click Finish.

6. From the left tree, click the Identity Awareness page.

7. Select Identity Web API > click Settings.

   1. In the Identity Web API Settings window:

   2. In the Client Access Permissions section, click Edit.

   3. In the Accessibility window, select Through all interfaces > click OK.

   4. In the Authorized Clients section, click the [+] button > select the Host object with the IP address 127.0.0.1.

   5. Optional: In the Authentication Settings section, click Settings > configure the applicable settings > click OK.

   6. Click OK.

8. Click OK.

9. Install the Access Control policy.

1. From the left navigation panel, click Security Policies.

2. In the top section Threat Prevention, click Custom Threat Prevention.

3. In the bottom section Custom Policy Tools, click Profiles.

4. Select the applicable Threat Prevention profile with the enabled Anti-Virus Software Blade > click Edit.

5. In the left panel, click the Anti-Virus page.

6. In the Protected Scope section, select Inspect incoming and outgoing files.

7. Click OK.

8. Install the Threat Prevention policy.