Using the Settings

Migrate

You can migrate your self-hosted Security Management Server to the Smart-1 Cloud environment.

Note - The migration operation overwrites tenant information and does not merge existing tenant data.

CloudGuard Network Configuration

Smart-1 Cloud lets administrators configure CloudGuard Network in the GUI.

Limitations:

• The GUI does not support the Oracle Cloud Infrastructure (OCI).

How to enable CloudGuard Network in Smart-1 Cloud

In the Quantum Smart-1 Cloud view in the Infinity portal, go to Settings > Advanced > CloudGuard Network.

Add an account

1. To add an account, on the corresponding cloud provider tile, click Add account.

   The CME Account window opens.

2. Give the account a name.

3. In the Platform drop-down list, select AWS, GCP, or Azure.

4. Enter the parameters.

5. Click OK to save the changes.

Parameters for AWS

Parameter	Description
Access Key ID	AWS Access Key ID. This parameter is mandatory.
Secret Access Key	AWS Secret Key. This parameter is mandatory.
Regions	The AWS regions in which the Security Gateways are being deployed.
STS Role	The Amazon Resource Name (ARN) of an IAM role to assume.
STS External ID	An optional STS External ID to use when assuming an IAM role in the account.
Scan Gateway Load Balancer subnets	Enable to scan Gateway Load Balancer subnets.
Synchronize VPN	Enable to synchronize VPN.
Sub Accounts	Add new sub accounts or configure properties of existing sub accounts. The sub-account name must be unique. Enter STS Role or STS External ID.

Parameters for Azure

Parameter	Description
Application ID	The service principal’s application ID in UUID format.
Client Secret	The service principal's client secret value.
Directory ID	The service principal's Directory ID in UUID format.
Subscription ID	The subscription ID where the VMSS resides in UUID format.
Azure Environment	Select the environment in the drop-down list. The default value is "Azure Cloud".

Parameters for GCP

Parameter	Description
Service Account Key Authentication	Download a public service account key file in JSON format.

Add Security Gateway configuration template

1. To add a Security Gateway configuration template to the account, on the corresponding cloud provider tile, click Add template.

   The CME Template window opens.

   

2. Give the Security Gateway configuration template a name.

3. In the Gateway Settings section, in the Account drop-down list, select the applicable Account.

4. Select the Security Gateway version.

5. Enter a one-time password.

6. Confirm the one-time password.

7. On the Network Security and Threat Prevention tabs, select the checkboxes for the blades you want to enable on the Security Gateway.

8. In the CME Attributes section, select the policy to install on the Security Gateway.

   Note - To add support for AWS Transit Gateways to the AWS account, configure the below parameters in the CME Attributes section. Parameters for AWS Transit Gateway Parameter Description VPN Domain A VPN Domain. VPN Community A VPN Star community where the VPN Gateway is the center. TGW Static Routes Enter network addresses (CIDR) to create a static route on each Gateway of the Transit Gateway auto-scaling group. TGW Static Spokes Spoke CIDR is learned from the TGW over BGP and is re-advertised by the Gateways of the TGW auto-scaling group to the AWS TGW. For more information on AWS Transit Gateway, refer to CloudGuard Network for AWS Transit Gateway Deployment Guide.

   Note - To add IPv6 support to the Azure account, select the IPv6 checkbox in the CME Attributes section.

9. Provide the repository script name and parameters if necessary.

10. In the Logs section, add log servers.

11. Click OK to save the changes.

Forwarding Events to SIEM

Event forwarding is an easy and secure procedure to export logs. You can forward logs, events, and saved applications data from the Check Point environment to a Syslog server or a SIEM (Security Information and Event Management) provider such as Splunk, QRadar, or ArcSight. These SIEM providers process large amounts of data and then display it on dashboards for analysis or send notifications.

Forward to SIEM configuration

To access the Forward to SIEM Configuration, from the Smart-1 Cloud home page, select Settings > Advanced > Forward to SIEM.

In the configuration page you see a table with forward to SIEM destinations, and information for the destination, such as status, encryption, name, target port, protocol and format.

Adding a new destination

To add a new destination, on the Forward to SIEM Configuration screen, click New.

Note - It is currently supported to add up to 3 destinations.

The Add Forwarding Destination window opens.

• Destination name: Enter a unique name for the destination.

• Destination Server: Enter IP address or FQDN.

  Note - The IP address must be public.

• Destination Port: The destination port number.

• Format: The destination log format. Can be Syslog, CEF, JSON, Splunk, LEEF, Generic, LogRhythm, or RSA.

• Protocol: The destination protocol, can be either TLS over TCP, TCP, or UDP

TLS/SSL over TCP Configuration

It is recommended to export logs over an encrypted connection using the TLS protocol. When using TLS, it is important to know that only mutual authentication is allowed. For mutual authentication, you need these two certificates:

• The Certificate Authority (CA) certificate (in PEM format) that signs both the client (Smart-1 Cloud side) and the server (SIEM side) certificates. The CA certificate can be a self-signed certificate.

• Client certificate.

Procedure:

• Click the Client Certificate box to download the Client certificate sign request (cp_client.csr).

  Note - Signing the request is done in your organization and is not part of Smart-1 Cloud services.

• After you sign the request, click Browse below the Client Certificate box to upload the signed certificate.

  Important - If it takes time to obtain the signed certificate for upload, you can close the Add Forwarding Destination window. Open it again later when you have the signed certificate, fill in all the details, and just click Browse to upload the certificate. You do not need to click the Client Certificate box again, because this will create a new sign request.

• Upload the CA certificate.

Edit the destination

To edit the destination, on the Forward to SIEM page, select a destination and click Edit.

You can change all destination properties except for the destination name.

Delete the destination

To delete a destination, on the Forward to SIEM page, select a destination and click: Delete.

Write confirm in the deletion dialog box.

Start, stop, or restart the destination

To start, stop, or restart sending logs to the destination, on the Forward to SIEM page, select a destination, click More Actions, and select the action you want to perform:

• Stop Forwarding - Stop sending logs to the destination

• Start Forwarding - Start sending logs to the destination

• Restart Forwarding - Restart sending logs to the destination

Troubleshooting

If no logs arrive to your SIEM, follow these steps:

Important - For information and updates on Smart-1 Cloud external FQDNs and their associated IP addresses, see sk182699.

• Make sure that your Security Gateway does not block traffic from the Smart-1 Cloud public FQDN:

  • Ireland: eu-west-1.allowed-ips.checkpoint.com

  • London: eu-west-2.allowed-ips.checkpoint.com

  • N. Virginia: us-east-1.allowed-ips.checkpoint.com

  • Sydney: ap-southeast-2.allowed-ips.checkpoint.com

  • Mumbai: ap-south-1.allowed-ips.checkpoint.com

• Check if all the details in the configuration are correct.

• If you use TLS, make sure you are using the correct certificates.

• Restart the destination.

If the issue persist, contact Check Point support and open a Service Request.