Deployment Steps for CloudGuard Network Geo Cluster in AWS

Before deploying Check Point's Security Geo Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. in AWS Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services., you first need to prepare your AWS account and subscribe to Check Point 's CloudGuard Network Security.

After completing these two steps, decide if you need to deploy the Geo Cluster in a new or existing VPC.

Deploy the Check Point Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. and configure the Security CloudGuard Geo Cluster in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

Review and test your deployment.

Step 1: Prepare Your AWS Account

To prepare your AWS account, do these steps:

1. If you do not already have an AWS account, create one at AWS.

2. Use the region selector in the navigation bar to choose the AWS region where you want to deploy the Check Point CloudGuard Cross AZ Cluster.

3. Create a key pair in your preferred region.

4. If necessary, request a service limit increase for the AWS resources you are going to use.

   You may need to do this if you have an existing deployment that uses the AWS resources below and you may exceed the default limit with this deployment.

   The resources that may need a service limit increase are:

   • Number of On-demand EC2 instances

   • Number of Elastic IP addresses

   • Number of VPCs for each region

   • Number of VPN connections for each region

   • Number of Customers for each region

   • Number of virtual private gateways for each region

   • VPN connections for each VPC

By default, this Deployment guide uses c5.xlarge for the Security Gateways and m5.xlarge for the Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

Deployment minimum permissions

For a successful deployment, the relevant IAM policy must have the minimum permissions set as configured below.

In the AWS VPC AWS Virtual Private Cloud. A private cloud that exists in the public cloud of Amazon. It is isolated from other Virtual Networks in the AWS cloud. Console, navigate to the IAM service, select the relevant IAM policy, copy and paste this text:

Step 2: Subscribe to CloudGuard Network Security

To subscribe to Check Point CloudGuard Network, do these steps:

1. Log in to the AWS Marketplace.

2. Search for "CloudGuard Network Security".

3. Select one of these licensing options for Check Point CloudGuard Security Gateways:

   • CloudGuard Network Security with Threat Prevention & SandBlast BYOL

   • CloudGuard Network Security Next-Gen Firewall with Threat Prevention

   • CloudGuard Network Security with Threat Prevention and SandBlast

   Or one of these licensing options for a Check Point CloudGuard Security Management Server:

   • CloudGuard Network Security Management (BYOL)

   • CloudGuard Network Security Management

   Note - If you want to manage more than five Security Gateways, select the BYOL option and contact Check Point Sales to purchase a license.

4. Select Continue to subscribe.

5. Select Accept Terms to confirm that you accept the AWS Marketplace license agreement.

Note - In the deployment steps that follow, you are prompted for the licensing information for the Security Gateways and Security Management Server that you selected.

Step 3: Deploy the Security CloudGuard Network Geo Cluster in AWS

This step details the necessary procedure for deploying the Security CloudGuard Network Geo Cluster in AWS. To deploy the Transit Gateway High Availability (HA) in AWS, see .Deployment Steps for Geo Cluster in AWS Transit Gateway High Availability.

Before you deploy Check Point's Security Geo Cluster in AWS's HA, select a CloudFormation template for either a new or existing VPC. Next, follow the instructions in this section on how to deploy the AWS HA. Finally, review and test the deployment. If you decide to deploy the Geo Cluster without association of Elastic IP to the Cluster Members, see Deploying Geo Cluster Members without an Elastic IP.

Select one of the CloudFormation templates to launch the Geo Cluster template in to your AWS account:

Notes:

• When you deploy this template, there is no need to run the Check Point First Time Configuration Wizard. Instead, the wizard is executed automatically. As a result, there is single, one time reboot of the Cluster Members.

• The CloudFormation template automatically creates an AWS routing table, and associates the internal subnets from both Availability Zones to it. This is to route all traffic going outside the VPC by means of Check Point's Cluster Active Member.

• After running the template, by default, the Active Member is Member "A".

Parameters for Deploying a Geo Cluster into a New VPC

Use these parameters for deploying a Geo Cluster in to a New VPC:

Parameters for Deploying a Geo Cluster into an Existing VPC

Use these parameters for deploying a Geo Cluster in an Existing VPC:

Step 4: Deploy the Check Point Security Management Server

We recommend you to use Smart-1 Cloud (Check Point's management server as a Service) to manage CloudGuard Network Security gateways.

Refer to sk180501 for step-by-step instructions for connecting CloudGuard Network Public Cloud Gateways to Smart-1-Cloud management.

You can also use one of the options below to deploy the Check Point Security Management Server.

1. Use the existing on-premises Security Management Server, or existing Security Management Server in AWS.

   Note - The Security Management Server must be R80.40 and higher.

   If the Security Management Server is communicating over a private IP addresses with the CloudGuard Cluster Members, then make sure that the Security Management Server has connection to the Security VPC in which they are deployed (see sk130372).

2. Deploy a new Security Management Server with the Management CloudFormation template.

   Note - For direct access to the CloudGuard Security Cluster, deploy the management in the same Security VPC in which you deployed the cluster in step 4.

Step 5: Configure the Security CloudGuard Geo Cluster in SmartConsole

To enforce a Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection., the Security CloudGuard Geo Cluster must first be configured on the Security Management using Check Point's SmartConsole application.

Limitation:

During failover, outbound traffic that runs over protocols and save sessions must be restarted.

Step 6: Review and Test the Deployment

Use these steps to check for proper configuration and set up of all components.

Step	Description
1	Go to the AWS WebUI: In the VPC console, under Route Tables, go to the Private Route table (these are the Private Subnets of the Security VPC are associated with). In the Routes tab, make sure there is a default route to the Active member's private interface (eth1).
2	Log in to both members through SSH in the Expert mode: Run cphaprob state to validate that the cluster is operating correctly. Output of cphaprob state command on both cluster members must show identical information for Load State (“ACTIVE”). Example: [Expert@HostName:0]# cphaprob state Cluster Mode: Active Active with IGMP Membership Number Unique Address Assigned Load State Name 1 (local) 10.0.1.20 N/A Active Member-A 2 10.0.1.30 N/A Active Member-B Run $FWDIR/scripts/aws_ha_test.py and make sure that it ends successfully without errors.
3	Simulate a cluster failover: From the Active member, that is not on standby, run in the Expert mode: clusterXL_admin down After two seconds, you will see in AWS WebUI > VPC Console > Route Tables that all route tables (that had a default route directed to the Active Member) are now directed to the Standby Active member. Notes: To see the changes, refresh the AWS WebUI. It can take a few minutes until failover is fully configured to pass traffic through the Active Member. After you finish the test, it is necessary to bring the Down member back up, run in the Expert mode: clusterXL_admin up