Deployment Steps

Use the steps listed below to deploy your AWS Auto Scaling Group.

Step 1: Preparing Your AWS Account

To prepare your AWS account, do these steps:

1. If you do not already have an AWS account, create one at AWS.

2. Use the region selector in the navigation bar to choose the AWS region, where you want to deploy Check Point CloudGuard Auto Scaling on AWS.

3. Create a key pair in your preferred region.

4. If necessary, request a service limit increase for the AWS resources you are going to use.

You may have to do this, if you have an existing deployment that uses the AWS resources below, and you may exceed the default limit with this deployment.

The resources that may need a service limit increase are:

• Number of On-demand EC2 instances.

• Number of Elastic IP addresses.

• Number of VPCs for each region.

• Number of Network Load Balancers.

• Number of Application Load Balancers.

By default, this Deployment guide uses c5.xlarge for the Security Gateways and m5.xlarge for the Security Management Server.

Deployment minimum permissions

For a successful deployment, the relevant IAM policy must have minimum permissions set configured below.

In the AWS VPC Console navigate to IAM service, select the relevant IAM policy and copy/paste this text:

For AWS Autoscale:

Copy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Permissions",
            "Effect": "Allow",
            "Action": [
                "SNS:CreateTopic",
                "SNS:DeleteTopic",
                "SNS:GetTopicAttributes",
                "SNS:Subscribe",
                "autoscaling:CreateAutoScalingGroup",
                "autoscaling:DeleteAutoScalingGroup",
                "autoscaling:DeletePolicy",
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeScalingActivities",
                "autoscaling:PutNotificationConfiguration",
                "autoscaling:PutScalingPolicy",
                "autoscaling:UpdateAutoScalingGroup",
                "cloudformation:CreateStack",
                "cloudformation:DeleteStack",
                "cloudformation:DescribeStacks",
                "cloudformation:ListStackResources",
                "cloudformation:ValidateTemplate",
                "cloudwatch:DeleteAlarms",
                "cloudwatch:PutMetricAlarm",
                "ec2:AllocateAddress",
                "ec2:AssociateAddress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CreateLaunchTemplate",
                "ec2:CreateNetworkInterface",
                "ec2:CreateSecurityGroup",
                "ec2:CreateTags",
                "ec2:DeleteLaunchTemplate",
                "ec2:DeleteNetworkInterface",
                "ec2:DeleteSecurityGroup",
                "ec2:DescribeAddresses",
                "ec2:DescribeInstances",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeLaunchTemplateVersions",
                "ec2:DescribeLaunchTemplates",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "ec2:DescribeRegions",
                "ec2:ModifyNetworkInterfaceAttribute",
                "ec2:ReleaseAddress",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RunInstances",
                "ec2:TerminateInstances",
                "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
                "elasticloadbalancing:AttachLoadBalancerToSubnets",
                "elasticloadbalancing:ConfigureHealthCheck",
                "elasticloadbalancing:CreateLoadBalancer",
                "elasticloadbalancing:CreateLoadBalancerListeners",
                "elasticloadbalancing:CreateLoadBalancerPolicy",
                "elasticloadbalancing:DeleteLoadBalancer",
                "elasticloadbalancing:DeleteLoadBalancerPolicy",
                "elasticloadbalancing:DescribeInstanceHealth",
                "elasticloadbalancing:DescribeLoadBalancerAttributes",
                "elasticloadbalancing:DescribeLoadBalancerPolicies",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTags",
                "elasticloadbalancing:DescribeTargetHealth",
                "elasticloadbalancing:ModifyLoadBalancerAttributes",
                "iam:AddRoleToInstanceProfile",
                "iam:CreateInstanceProfile",
                "iam:CreateRole",
                "iam:DeleteInstanceProfile",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:PutRolePolicy",
                "iam:RemoveRoleFromInstanceProfile"
            ],
            "Resource": "*"
        },
        {
            "Sid": "IAMPassRole",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "ec2.amazonaws.com"
                }
            }
        }
    ]
}

Step 2: Subscribing to Check Point CloudGuard Network

To subscribe to Check Point CloudGuard Network, do these steps:

1. Log in to AWS Marketplace.

2. Select one of these licensing options for Check Point CloudGuard Network Security Gateways:

   • CloudGuard Network Security with Threat Prevention & Sandblast BYOL

   • CloudGuard Network Security Next-Gen Firewall with Threat Prevention (PAYG-NGTP)

   • CloudGuard Network Security with Threat Prevention and Sandblast (PAYG-NGTX)

3. Select Continue to subscribe.

4. Select Accept Terms to confirm that you accept the AWS Marketplace license agreement. After accepting the terms you can continue to Step 3: Deploy the Check Point Security Management Server (SMS).

   Note - Do this step one time for each account subscription.

5. If you want to deploy a Check Point CloudGuard Security Management Server, repeat Steps 3 and 4 in this procedure and select one of these licensing options:

   • Check Point Security Management (BYOL)

   • Check Point Security Management (PAYG)

   Note - If you want to manage more than five Security Gateways, select the BYOL option to purchase a license. Contact Check Point Sales to purchase a license.

Step 3: Deploy the Check Point Security Management Server (SMS)

We recommend you to use Smart-1 Cloud (Check Point's management server as a Service) to manage CloudGuard Network AWS Auto Scale Group.

Refer to Quantum Smart-1 Cloud Administration Guide > Using the settings > Cloud Management Extension (CME) Configuration for step-by-step instructions for enabling CME in Smart-1 Cloud management.

Other available options to deploy the Check Point Security Management Server are:

• Deploying a New Security Management Server with a Management CloudFormation Template

• Using the Existing On-Premises Security Management Server or the Security Management Server in AWS

To configure the Security Management Server to automatically provision newly deployed CloudGuard Security Gateways, refer to sk130372 > Automatic Provisioning with Security Management Server.

Deploying a New Security Management Server with a Management CloudFormation Template

Deploy the Security Management Server separately as described in sk130372.

Then, create an IAM role with read write permissions as described in Using the Existing On-Premises Security Management Server or the Security Management Server in AWS or deploy IAM role and attach it to the Security Management.

Using the Existing On-Premises Security Management Server or the Security Management Server in AWS

In AWS VPC Console, configure the required permissions for the Security Management Server:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "autoscaling:DescribeAutoScalingGroups",
        "ec2:DescribeInstances",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeSubnets",
        "ec2:DescribeRegions",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeRules",
        "elasticloadbalancing:DescribeTargetHealth"
      ],
      "Resource": "*",
      "Effect": "Allow"
       }
  ]
}

Step 4: Creating an External Elastic Load Balancer

Set up an external ELB to receive traffic from the Internet and forward it to the pool of CloudGuard Security Gateways.

It is assumed that an internal ELB with these settings already exists:

• The internal ELB is in front of a group of internal server instances.

• The internal ELB is listening on a unique high port (for example, 8081).

Create an External ELB in your VPC with these settings:

• Listens on a public port (for example, port 80).

• Sends traffic to the high port (for example, port 8081).

• Deployed in the same subnets where you intend to deploy the CloudGuard Auto Scaling group.

• Has a Security Group that allows traffic from any source to the public port.

• Health checks should use the same high port (e.g. 8081).

Follow these steps to configure the Application Load Balancer:

1. Log into the AWS Management Console.

2. From the menu bar, select Load Balancers > click Create Load Balancer > select Application Load Balancer.

3. Enter the Load Balancer name.

4. Select Internet-facing.

5. On the Network Mapping section select the VPC to locate the ELB in.

6. Select the Availability Zones for the ELB, and in each Availability Zone select the applicable external subnet.

7. In the Security Groups section select at minimum one Security Group.

8. In Listeners and routing section, enter the protocol and port that the Load Balancer will route traffic to.

9. For Target Group, select a target group or create a new one. Do not register any targets. These are configured at a later step through the Auto Scaling group.

10. Review the configuration.

11. Click Create.

Content Based Routing:

Instead of deploying multiple internal ELB's to route traffic to multiple applications, you can use Content Based Routing with Application Load Balancer. To do this, follow these steps:

1. After deploying an Application Load Balancer, open the AWS Management Console.

2. From the menu bar, click Load Balancers > select an Application Load Balancer > Listeners.

3. Select the listener that routes the traffic to the applications.

4. Click View/edit rules and select the plus icon.

5. Click Insert Rule.

6. Add the conditions and actions for your application.

7. Click Save.

Content Based Policy

1. Verify that the Application Control is enabled on the Auto Scaling Security Gateways.

2. In SmartConsole, from the Navigation Toolbar, select Security Policies.

3. Select a policy tab such as Standard.

   1. In the Access Control, right click on Policy and click Edit Policy.

   2. Select the plus icon on the Access Control pane and click New Layer.

   3. Enter a name for the new policy layer (e.g. Application Control Layer).

   4. Below Blades, select the checkbox Application & URL Filtering.

   5. Click OK.

5. Select the newly created Access Control Policy Layer.

   For each application, it is necessary to configure an Access Control rule.

   1. Select the Add Rule Above icon.

   2. Configure the rule's Name, Source, Destination, Action, and Track.

   3. Below Services & Applications, select the plus icon and then select the asterisk icon.

   4. Select Custom Application/Site > Application/Site.

   5. Enter a name for the new application, e.g. "applicaiton1".

   6. Add the application URL to the list. Regular expressions are supported.

   7. Click OK.

6. To apply the new rules to existing gateways (new gateways in the Auto Scaling group enforce the policy automatically), click Install Policy.

Follow these steps to configure the Network Load Balancer:

3. Log into the AWS Management Console.

4. From the main menu bar, select Load Balancers > click Create Load Balancer > select Network Load Balancer.

5. Enter the Load Balancer name.

6. Check "Internet-facing".

7. Select your VPC and Availability Zones.

8. In Listeners and routing enter the Load Balancer Port.

9. For Default action, select a target group or create new one. Do not register any targets, these are configured at a later stage through the Auto Scaling group.

10. Review the configuration.

11. Click Create load balancer.

Using Standard Ports on the Internal ELB Listeners

If you set the internal ELB listeners to listen to protocol HTTP, HTTPS or SSL\TLS on their standard ports, i.e. port 80 for HTTP and port 443 for HTTPS or SSL\TLS, the CloudGuard Security Gateways will automatically expect to receive traffic from a custom high port. The default high ports are 9080 for port 80 and 9443 for port 443.

The NAT and Firewall rules will be automatically configured with the custom high port as the origin port and the standard port as the destination port.

To change the default high ports, or to configure multiple internal ELBs to listen to the standard ports, tag the internal ELB as follows:

Tag Key: x-chkp-forwarding

Tag Value: a space separated list of <PROTOCOL>-<ORIGIN-PORT>-<DESTINATION-PORT> items representing the desired forwarding rules.

Replace <PROTOCOL> with a protocol (TCP, HTTP, HTTPS, SSL, UDP or TCP_UDP), <ORIGIN-PORT> with the port that the external ELB forwards traffic to, and <DESTINATION-PORT> with the internal ELB listener port, e.g. "HTTP-9081-80 HTTPS-9444-443 TCP-9022-22 SSL-9444-443".

This modifies the created NAT and Firewall rules to the selected protocol, origin and destination port.

Step 5: Deploying the CloudGuard Auto Scaling Group

To launch the Auto Scale group template, refer to sk111013 > CloudGuard Network for AWS Auto Scale Group.

Prerequisites:

• A VPC with a minimum of two Availability Zones, each with a public and private subnet.

• A workload of servers deployed in the private subnets (possibly part of its own Auto Scaling group).

• An internal Elastic Load Balancer (ELB) that sends traffic to the workload of servers.

To deploy a web service secured by an Auto Scaling group of Check Point CloudGuard Security Gateways, and automatically complete this configuration, see the AWS Quick Start for Check Point CloudGuard Auto Scaling.

To launch the Transit Gateway template into your AWS account, go to sk111013 > CloudGuard Network for AWS Auto Scale Group with Transit Gateway.

• Newly provisioned Security Gateways automatically receive the most recently published Security Policy. For existing Security Gateways to get the Security Policy after manual changes, you must manually install the policy on the existing Security Gateways.

• Important- As scaling events occur, Security Gateways objects are automatically created and deleted. Therefore, it is not recommended to use those objects explicitly in rules or to manually edit them.

Parameters for Deploying a Security Gateway Auto Scaling into an Existing VPC

VPC Network Configuration:

EC2 Instance Configuration:

Auto Scaling Configuration:

Check Point Settings:

Automatic Provisioning with Security Management Server Settings:

Proxy Configuration (optional):

Step 6: Post Deployment Configuration

Attaching the External Elastic Load Balancer to the CloudGuard Auto Scaling group

If you have a Target Group ARN in the CloudGuard Auto Scaling group CloudFormation template, then the Load Balancer is attached to your newly deployed CloudGuard Auto Scaling group and you can proceed to section Adding Tags to the Internal Elastic Load Balancer.

Otherwise, it is required to manually attach the external ELB to the CloudGuard Auto Scaling group.

If you created a Network Load Balancer, follow these steps to attach the external ELB to the CloudGuard Auto Scaling group:

1. Open the Amazon VPC console.

2. From main menu bar, select Target Groups.

3. Select the target group.

4. Set a target group’s health check:

   • For CME Take 250 and Security Gateway's versions R81.10 and higher:

     Follow the steps in Configuring Health check settings for Network Load Balancer’s Target Group.

   • For CME Take lower than 250 or Security Gateway’s versions R81 and lower:

     Set the target group's health check for traffic port.

5. Open the Amazon EC2 console.

6. From the main menu bar, select Auto Scaling Groups.

7. Select the CloudGuard Auto Scaling group and click Edit.

8. In the Load Balancing section, select the checkbox next to Network Load Balancer target groups.

9. Select the Target Group of your External Load Balancer from the list.

10. Click Update.

If you created an Application Load Balancer, follow these steps to attach the external ELB to the CloudGuard Auto Scaling group:

1. Open the Amazon VPC console.

2. From the main menu bar, select Target Groups.

3. Select the target group.

4. Set the target group’s health check for the traffic port.

5. Open the Amazon EC2 console.

6. From the main menu bar, select Auto Scaling Groups.

7. Select the CloudGuard Auto Scaling group and click Edit.

8. In the Load Balancing section, select the checkbox next to Application Load Balancer target groups.

9. Select the Target Group of your External Load Balancer from the list.

10. Click Update.

Configuring Health check settings for Network Load Balancer’s Target Group

1. Open the Amazon EC2 console.

2. From main menu bar, select Load Balancing > Target Groups.

3. Select the applicable target group.

4. Select the Health checks section and click Edit.

5. Below the Health checks section, select TCP for Health check protocol.

6. Click on Advanced health check settings.

7. In the Health check port section, select Override and insert port 8117.

8. Click Save changes.

Adding Tags to the Internal Elastic Load Balancer

For the Security Management Server to recognize your AWS tags, you must add them to the internal ELBs. The Security Management Server is then able to automatically provision the Security Gateways to forward traffic to these internal ELBs.

1. Open the Amazon EC2 console.

2. From main menu bar, select Load Balancers > select the internal ELB.

3. From the Tags tab, add these tags:

   • Tag Key: x-chkp-management
     Tag Value: <MANAGEMENT-NAME>

   • Tag Key: x-chkp-template
     Tag Value: <TEMPLATE-NAME>

   • Tag Key: x-chkp-ignore-ports  (optional)
     Tag Value: <PORTS-LIST>

Where:

• <MANAGEMENT-NAME> - Specifies the name of the Management Server. Use the same name you used when you executed the autoprov_cfg utility or when you deployed the CloudFormation template.

• <TEMPLATE-NAME> - Specifies the name of the Autoscaling group's template. Use the same name you used when you executed the autoprov_cfg utility or when you deployed the CloudFormation template.