Advanced Configuration

Security Management Server in AWS

To deploy a new Security Management Server in AWS, see sk130372 > Section Installing the Check Point Security Management Server.

Note - Make sure to select Create with read-write permissions in the IAM role dropdown field. This is required to include these permissions in the IAM policy of the IAM role attached to the Security Management Server.

Security Management Server on-premises

To deploy a new Security Management Server on-premises, or use an existing Security Management Server on-premises, see sk130372 > Section Deploying a Security Management Server on-premises.

1

Connect to the command line on the Check Point Security Management Server.

2

Log in to the Expert mode.

3

Run all the commands below.

Commands and their description:

• autoprov_cfg init AWS -mn "<MANAGEMENT-NAME>" -tn "<TEMPLATE-NAME>" -otp "<SIC-KEY>" -ver R80.10 -po "<POLICY-NAME>" -cn "<CONTROLLER-NAME>" -r "<REGIONS>" -iam

  Initializes configuration with IAM credentials.

  Options:

  • -mn - Specifies the name of the Security Management Server
  • -tn - Specifies the template name
  • -otp - Specifies the one-time SIC password
  • -ver - Specifies the Gateway version
  • -po - Specifies the name of the policy package
  • -cn - Specifies the name of the Controller
  • -r - Specifies the list of regions, separated by commas
  • -iam - Specifies to use IAM to connect to AWS

• autoprov_cfg set controller AWS -cn "<CONTROLLER-NAME>" -sg -sv -com "<VPN-COMMUNITY-NAMES>" -sn "<SUBACCOUNT-NAME>" -ssr "<STS-ROLE-ARN>"

  Sets Controller with the required attributes for transit.

  Options:

  • -sg - Specifies to scans gateways (enables Autoprovision)
  • -sv - Specifies to scan VPN (enables Transit)
  • -com - Specifies the list of VPN communities allowed to be used by this Controller
  • -sn - Specifies the custom name for your sub-account
  • -ssr - Specifies the STS role name of trustee (spoke account)

• autoprov_cfg set template -tn "<TEMPLATE-NAME>" -vpn -vd "<VPN-DOMAIN>" -com "<VPN-COMMUNITY-NAME>"

  Sets template with the required attributes for transit.

  Options:

  • -vpn - Enables the IPsec VPN blade on gateways
  • -vd - Specifies the name of the VPN Domain object
  • -com - Specifies the name of the VPN Community

• autoprov_cfg show all

  Shows all the used configurations.

  Run this command to confirm all the configurations are correct.

4

Run this command to test the configuration:

service cme test

Make sure there are no errors.

If the test ends with any error, see the Troubleshooting section.

1

autoprov_cfg init AWS -mn "my-mgmt" -tn "my-template" -otp "my-one-time-password" -ver R80.10 -po "my-policy" -cn "my-controller" -r "us-east-1" -iam

2

autoprov_cfg set controller AWS -cn "my-controller" -sg -sv -com "my-vpn-community"

3

autoprov_cfg set template -tn "my-template" -vpn -vd "my-vpm-domain" -com "my-vpn-community"

1

autoprov_cfg init AWS -mn "my-mgmt" -tn "my-template" -otp "my-one-time-password" -ver R80.10 -po "my-policy" -cn "my-controller" -r "us-east-1" -iam

2

autoprov_cfg set controller AWS -cn "my-controller" -sg -sv -com "my-vpn-community" -sn "my-account" -ssr "arn:aws:iam::123456789012:role/SpokeAccountRole"

3

autoprov_cfg set template -tn "my-template" -vpn -vd "my-vpm-domain" -com "my-vpn-community"

1

autoprov_cfg init AWS -mn "my-mgmt" -tn "my-template" -otp "my-one-time-password" -ver R80.10 -po "my-policy" -cn "my-controller" -r "us-east-1" -iam

2

autoprov_cfg set controller AWS -cn "my-controller" -sg -sv -com "my-vpn-community" -ssr "arn:aws:iam::210987654321:role/TransitAccountRole" -sn "my-account" -ssr "arn:aws:iam::123456789012:role/SpokeNameOne"

3

autoprov_cfg set template -tn "my-template"

1

autoprov_cfg init AWS -mn "my-mgmt" -tn "my-template" -otp "my-one-time-password" -ver R80.10 -po "my-policy" -cn "my-controller" -r "us-east-1" -ak AKIKBJKKGPVSLTTVCGFU -sk m97031r93aa7x6plnkdum97031r93aa7x6plnkdu

2

autoprov_cfg set controller AWS -cn "my-controller" -sg -sv -com "my-vpn-community" -sn "my-account" -ssr "arn:aws:iam::123456789012:role/SpokeNameOne"

3

autoprov_cfg set template -tn "my-template" -vpn -vd "my-vpm-domain" -com "my-vpn-community"

1

Connect to the command line on the Check Point Security Management Server.

2

Log in to the Expert mode.

3

Run:

/opt/CPcme/menu/additions/config-community.sh "<VPN-COMMUNITY-NAME>"

Example:

/opt/CPcme/menu/additions/config-community.sh "Transit-VPN-Community"

1

Connect with SmartConsole to your Check Point Security Management Server.

2

If the Security Management Server and the Security Gateway have to communicate through public IP addresses, make sure that the Security Management Server object is defined with the elastic IP address.

Edit the Security Management Server object and change the IP address.

Important - If you change the main IP address of the Security Management Server, you must issue and install the license(s) for the new IP address.

3

Create the Security Policy you want to install on the Transit Gateways.

When you name the policy package, use the package name you set when you executed the autoprov_cfg utility.

4

We recommend you create an explicit VPN Directional rule in the Access Control Policy to allow the required services to work over the VPN tunnels:

4A

Enable the support for VPN directional rules:

1. In SmartConsole, click Menu > Global properties.
2. In the left tree, click VPN > Advanced.
3. Select Enable VPN Directional Match in VPN Column.
4. Click OK.

4B

Create an explicit VPN Directional rule:

• Source - Applicable Objects
• Destination - Applicable Objects
• VPN - All these:
  • Community -> Community
  • Community -> Internal_clear
  • Internal_clear -> Community
• Services & Applications - Applicable Services
• Action - Accept
• Track - None, or Log
• Install On - Transit gateways

5

Install the Access Control Policy on the Transit gateways.

1

Connect to the command line on the Check Point Multi-Domain Server.

2

Log in to the Expert mode.

3

Execute the autoprov_cfg tool on the Multi-Domain Server. See sk120992.

4

Execute the config-community.sh script on the Multi-Domain Server:

env MGMT_CLI_DOMAIN="<DOMAIN_NAME>" /etc/fw/scripts/autoprovision/config-community.sh "<VPN-COMMUNITY-NAME>" [<SPOKE-ROUTES> [<EXPORT-ROUTES>, <EXPORT-ROUTES> ...]]

Replace the "<DOMAIN_NAME>" with the name of your Domain.

5

Tag a spoke VPC on a Multi-Domain Server.

On a Multi-Domain Server, you have to indicate the specific Domain, on which Transit has to manage the VPN connection to the spoke VPC. Therefore, the tag value structure for the spoke VPC also must have the Domain name.

Tag key: x-chkp-vpn

Tag value: <MANAGEMENT_NAME>/<DOMAIN_NAME>/<VPN_COMMUNITY_NAME>

Where:

• <MANAGEMENT_NAME> - Specifies the name of your Multi-Domain Server. Use the same name you used when you executed the autoprov_cfg command.
• <DOMAIN_NAME> - Specifies the name of the Domain as defined in the SmartConsole.
• <VPN_COMMUNITY_NAME> - Specifies the name of your VPN Community. Use the same name you used when you created the VPN Community.