Configure Cloud Management Extension (CME)

Downloading and Installing the Latest CME Version

To download and install the CME (Cloud Management Extension) on the Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. or Multi-Domain ServerClosed Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS., see sk157492.

Configuring the CME on the Security Management Server

The instructions below contain information about how to configure a VMSS environment in CME. For more information about CME configurations, see the "Overview" section in the Cloud Management Extension Administration Guide.

Configure the CME on the Security Management Server with CME API (recommended)

With CME Management API you can configure the CME tool.

API Documentation:

Prerequisites:


  1. To configure Security Management Server during the CloudGuard Network Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. for Azure VMSS deployment:

    Send a PUT request:

    PUT https://<Management_IP_address>/web_api/v1.8/cme-api/v1.2.3/management

    Request body parameters:

    Parameter Name

    Description

    name

    Your Azure account name (for example, "my-management").

    This operation returns "status-code": 200.

  2. To configure CME on the Security Management Server:

    • With Azure IAM:

      Prerequisite: Security Management Server virtual machine is using a system-assigned managed identity.

      Send a POST request:

      POST https://<Management_IP_address>/web_api/v1.8/cme-api/v1.2.3/azure

      Request body parameters:

      Parameter Name

      Description

      name

      Your Azure account name.

      subscription

      The resource group containing your Security Management Server.

      iam

      Enable/disable IAM. Must be set to true.

      This operation returns "status-code": 200.

    • With Microsoft Entra ID and Service Principal:

      Send a POST request:

      POST https://<Management_IP_address>/web_api/v1.8/cme-api/v1.2.3/azur

      Request body parameters:

      Parameter Name

      Description

      name

      Your Azure account name.

      subscription

      The resource group containing your Security Management Server.

      directory_id

      The Azure Active Directory tenant ID.

      application_id

      The service principal's client ID value.

      client_secret

      The service principal's client secret value.

      This operation returns "status-code": 200.

  3. To configure gw_conf:

    Send a POST request:

    POST https://<Management_IP_address>/web_api/v1.8/cme-api/v1.2.3/gwConfigurations/azure

    Request body parameters:

    Parameter Name

    Description

    name

    The name of the relevant set of VMSS configurations to apply (for example, "my-configuration-template-for-x").

    base64_sic_key

    A random value that has at least 8 alphanumeric characters (for example, "MySICkey123").

    version

    The Security Gateway version.

    policy

    The name of the policy to install (for example, "Standard").

Step

Description

1

Connect to the command line on the Security Management Server.

2

Log in to the Expert mode.

3

Execute this command (see the explanation of parameters):

Run:

autoprov_cfg init Azure -mn "<Management-Name>" -tn "<Configuration-Template-Name>" -otp "<SIC-key>" -ver <Version> -po "<Policy-Name>" -cn "<Controller-Name>" -sb "<Azure-Subscription>" -at "<Active-Directory-Tenant-ID>" -aci "<Client-ID>" -acs "<Client-Secret>"

Example:

autoprov_cfg init Azure -mn "my-management" -tn "my-configuration-template" -otp "MySICkey123" -ver R81.20 -po "Standard" -cn "Azure-Production" -sb "98e34f37-ece4-4cdc-97dc-44a074f84aff" -at "7113cebb-911c-4122-aa5c-34db449380f7" -aci "82fb1445-f40e-46dc-9cd3-c065e14f132b" -acs "xxx="

4

When this message shows, type yes and press Enter to apply the modifications:

Would you like to restart the service now?

5

Confirm the configuration:

service cme test

Every controller in the configuration has to have unique credentials.

6

Follow the instructions in the Enabling and Disabling Software Blades section in the Cloud Management Extension Administration Guide.

Important - The exact values that you select, must be typed exactly when you deploy the VMSS. Make sure to write them down and enter them correctly. Otherwise, the components cannot communicate with each other.

Parameter

Description

Example

"<Management-Name>"

Select a descriptive name.

When you deploy the Check PointVMSS with this name, the Check PointSecurity Management Server identifies and automatically provisions it.

"my-management"

"<Configuration-Template-Name>"

Configurations that automatically provision the Security Gateways in the VMSS are found in this template.

When you deploy the Check PointVMSS with this template name, it references the relevant set of configurations to apply to it.

Therefore, you can maintain multiple sets of configurations and associate them with different VMSS that are managed by the Security Management Server.

"my-configuration-template-for-x"

"<SIC-key>"

Select a random key that has at least 8 alphanumeric characters.

"MySICkey123"

<Version>

The Security Gateway version.

R8X.XX

"<Policy-Name>"

The name of the policy to install.

The name of this policy has to be the exact same name of the policy in SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

"Standard"

"<Controller-Name>"

Select a name that represents the controller.

The controller name includes configurations for your Azure environment, such as the subscription ID and application ID.

You can maintain different controllers to automatically provision different Cloud environments, with the Security Management Server.

"Azure-Production"

"<Azure-Subscription>"

The Azure subscription ID that deploys the CloudGuard Security Gateways.

"98e34f37-ece4-4cdc-97dc-44a074f84aff"

"<Active-Directory-Tenant-ID>"

The Azure directory tenant ID.

"7113cebb-911c-4122-aa5c-34db449380f7"

"<Client-ID>"

The application ID.

"82fb1445-f40e-46dc-9cd3-c065e14f132b"

"<Client-Secret>"

The application key.

Note - This value is not readable in the configuration.