CloudGuard Controller for Microsoft Azure

CloudGuard Controller Provisions SDDC services as Virtual Data Centers that provide virtualized computer networking, storage, and security. integrates the Microsoft Azure Collection of integrated cloud services that developers and IT professionals use to build, deploy, and manage applications through a global network of data centers managed by Microsoft®. cloud with Check Point security.

Important - The CloudGuard Controller server clock must be synchronized with the current, local time. Use of a NTP server is recommended. Time synchronization issues can cause polling information from the cloud to fail.

Connecting to a Microsoft Azure Data Center Server from SmartConsole

To connect to a Microsoft Data Center Server:

Best Practice - In Microsoft Azure create a service principal (see this article for details) and assign relevant rights.

The minimum recommended permission is Reader.

You can assign the Reader permission in one of these ways:

Assign to all Resource Groups, from which you want to pull an item
Add the permission on a subscription level

Step

Instructions

In SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., create a new Data Center Virtual centralized repository, or a group of physical networked hosts, Virtual Machines, and datastores. They are collected in a group for secured remote storage, management, and distribution of data. object in one of these ways:

In the top left corner, click Objects menu > Cloud > Data Center > New Microsoft Azure.
In the top right corner, click Objects Pane > New > Cloud > Data Center > Microsoft Azure.

In the Enter Object Name field, enter a name.

Select the applicable authentication method:

Service Principal - Uses the Service Principal to authenticate.
Azure AD User Authentication - Uses the Azure AD User to authenticate.

If you selected Service Principal Authentication (default):

Enter your Application ID, Application Key, and Directory ID.

You can create the Service Principal in the Azure Portal, with the Azure PowerShell, or with the Azure CLI.

If you selected Azure AD User Authentication:

Enter your Username and Password.

The minimum recommended permission is Reader.

You can assign the Reader permission in one of these ways:

Assign to all Resource Groups, from which you want to pull an item
Add the permission on a subscription level

Important - If you do not have the necessary permissions, some of the functionality might not work.

Click Test Connection.

Click OK.

Import objects from your Microsoft Azure server to your policy (for more about these objects, see the next sections).

Network by Subscriptions - Import VNETS, subnets, Virtual Machines, or VMSS.
Network Security Groups (NSG) - Import all IP addresses that belong to a specific NSG.

The NSG is used only as a container for the list of all IP addresses (assigned to NICs and subnets) that are attached to this group.
Tags - Imports all the IP addresses of Virtual Machines and VMSS that have specific tags and values.

Note - All changes in Microsoft Azure are updated automatically with the Check Point Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection..

Users with permissions to change Resource Tags in Microsoft Azure can change their access permissions.

Publish the SmartConsole session.

Install the Access Control policy on the Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. object.

Connecting to a Microsoft Azure Data Center Server with Management API

Go to Management API Reference > Click on see arguments per Data Center Server type and select Microsoft Azure.

Connecting to a Microsoft Azure Data Center Server with Terraform

See checkpoint_management_azure_data_center_server.

Azure Objects and Properties

Azure Objects

Object	Description
Subscription	Helps you organize access to your cloud components.
Virtual Network	Represents your Microsoft Azure Virtual Network Environment of logically connected Virtual Machines. (VNET) in the cloud.
Subnet	A range of IP addresses in a VNET. A VNET can be divided into many subnets.
Virtual Machine (VM)	Virtual computing environment.
Virtual Machine Scale Set (VMSS)	Manages sets of Virtual Machines.
Network Security Group (NSG)	NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to the Virtual Machines instances in a Virtual Network. NSGs can be associated with either subnets or individual Virtual Machine instances in that subnet.
Load Balancer	Load Balancer distributes incoming traffic that arrives into the Load Balancer's frontend to backend pool instances, according to rules and health probes.
Tags	Keys and values attached to the object.
Application Security Group	ASGs enable you to configure network security as a natural extension of an application's structure, allowing you to group virtual machines and define network security policies based on those groups.
Private Endpoint	A private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service powered by Azure Private Link. By enabling a private endpoint, you're bringing the service into your virtual network.
Virtual network Gateway (VNet GW)	A virtual network gateway is composed of two or more VMs that are automatically configured and deployed to a specific subnet you create called the gateway subnet. The gateway VMs contain routing tables and run specific gateway services.
VPN Gateway (VWAN)	The gateway type '`Vpn`' specifies that the type of virtual network gateway created is a 'VPN gateway'. This distinguishes it from an ExpressRoute gateway, which uses a different gateway type. A virtual network can have two virtual network gateways - one VPN gateway and one ExpressRoute gateway.
Application Gateway	Application Gateway is supported starting R81.20 CloudGuard Controller self-updatable package Take 15. Note: This object is disabled by default. To enable it: Edit the vsec.conf file on the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. ($FWDIR/conf/ on Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server., $MDSDIR/conf/ on a Multi-Domain Security Management Server.) Add the line: `azure.enableApplicationGateways=true` Restart the CloudGuard Controller with the command: `vsec stop;vsec start`

Azure Imported Properties

Imported Property	Description
Name	Name of the object and the object's Resource Group Format is: `obj_name (obj_resource_group_name)` The user can edit the name after importing the object.
Name in server	Name of the object and the object's Resource Group Format is: `obj_name (obj_resource_group_name)`
Type in server	Object type
IP address	Virtual Machines and VMSS: Public and Private IP addresses Load Balancers: Frontend IP addresses Subnets: VMs, VMSSs, and Internal Load Balancers Frontend IPs NSGs: VMSSs and Subnets IP addresses associated with this NSG Tags: VNETS, VMs, VMSSs and Load Balancers IP addresses associated with this specific Tag Key or Tag Value
Note	Contains the address prefixes for VNETs and subnets
URI	Object path
Tags	Keys and Values attached to the Object
Location	Physical location in Microsoft Azure

Auto Scaling in Microsoft Azure

The Microsoft Azure Auto Scaling service with the Check Point Auto Scaling group can increase or decrease the number of CloudGuard Gateways according to the current load.

The CloudGuard Controller for Microsoft Azure can work with the Check Point Auto Scaling Group.

The Check Point Security Management Server can update Data Center objects automatically on the Check Point Auto Scaling group.

CloudGuard CME for Microsoft Azure automatically configures CloudGuard Gateways in Auto Scaling group to support updates of Data Center Objects from the CloudGuard Controller.