Example Config for Check Point VM in Azure
In this document, we provide an example to set up the Check Point Security Gateway instance for you to validate that packets are indeed sent to the Check Point Security Gateway for VNet-to-VNet and from VNet to internet traffic inspection.
The terms "firewall" and "Security Gateway" will be used interchangeably in this document. Both refer to the Check Point Security Gateway product. |
Prerequisites
Before you start, make sure you understand:
-
Basic Check Point Architecture
-
Check Point Security Management
Aviatrix supports the following Check Point AMIs and software versions.
Supported AMI Name | Software Version |
---|---|
CloudGuard IaaS Single Gateway - BYOL |
R80.40, R80.30 |
CloudGuard IaaS Single Gateway Threat Prevention & SandBlast (NGTX) - PAYG |
R80.40, R80.30 |
CloudGuard IaaS Single Gateway with Thread Prevention (NGTP) - PAYG |
R80.40, R80.30 |
CloudGuard IaaS Standalone (Gateway + Management) - BYOL |
R80.40 |
Check Point Standalone does not require Security Management to manage polices.
Gateway NGTP and NGTX both require Security Management to configure Security Gateway Polices.
Check Point Reference Architecture
It is paramount at this stage to understand the basic Check Point architecture (reference diagram below) to configure Check Point Security Gateway properly.
![cp_arch_reference](_images/cp-arch-reference.png)
As per the reference shown above the following steps will be required to configure security polices successfully:
-
Launch Check Point Security Gateway - Configure Interfaces and Static Routes and other specific Security Gateway configuration.
-
Download, install, and configure Check Point Security Management (Optional).
-
Download, install, and configure Check Point Smart Console - Launch Smart Console using Security Manager IP, add/authenticate one or more security gateways, configure security rules/polices, and push it to security gateways.
Please follow the below steps to launch and configure Check Point Security Gateway in Azure.
If you are looking to deploy Check Point in an AWS environment, your starting point is here.
Launching Check Point Firewall from Aviatrix Controller
The Aviatrix Firewall Network (FireNet) workflow launches a Check Point Security Gateway instance at this step.
In the Aviatrix Controller navigate to Firewall Network > Setup > Step 2a. You can use the Security Gateway information in this example for your reference. Please adjust it depending on your requirements.
Example setting | Example value |
---|---|
Firewall Image |
Check Point CloudGuard IaaS Single Gateway R80.40 - PAYG (NGTP) |
Firewall Image Version |
8040.900294.0593 |
Firewall Instance Size |
Standard_D3_v2 |
Egress Interface Subnet |
Select the subnet whose name contains "Public-FW-ingress-egress". |
Username |
admin (no alternatives) |
Authentication Method |
Password |
Password |
Input a good password of your choice |
SIC Key |
Input a good SIC Key. |
Attach |
Check |
The SIC (Secure Inter-communication) Key needs to be noted somewhere and will be required to add the Security Gateway inside the Security Manager. |
Check Point Security Gateway instance has only 2 interfaces as described below. Additionally, firewall instance eth1 is on the same subnet as FireNet gateway eth2 interface. |
Check Point VM instance interfaces | Description | Inbound Security Group Rule |
---|---|---|
eth0 (on subnet -Public-FW-ingress-egress) |
Egress or Untrusted interface |
Allow ALL |
eth1 (on subnet -dmz-firewall-lan) |
LAN or Trusted interface |
Allow ALL (Do not change) |
After the launch is complete, Aviatrix Controller automatically initiates the Security Gateway on-boarding process, configures interfaces and programs RFC 1918 routes in the Check Point Security Gateway.
Logging in to the Check Point Firewall Gaia Portal
After launch is completed, in the Aviatrix Controller navigate to Firewall Network > List > Firewall and click on the Management UI as shown below (applies to AWS and Azure).
![v2_avx_management_UI](_images/avx-management-ui-aws.png)
The URL takes you to the Check Point Firewall Gaia Portal you just launched.
![v2_cp_login_UI](_images/cp-login-ui-aws.png)
Starting from release 5.4, launching Check Point firewall instances from the Aviatrix Controller automatically initiates its onboarding process For initial Check Point login information, go to Credentials for Check Point Initial Login. You must be registered to access the Aviatrix Customer Support website. If you are not already registered, you can sign-up at https://support.aviatrix.com. |
(Optional) Firewall Vendor Integration
Navigate to Aviatrix Controller > Firewall Network > Vendor Integration and complete the step as shown below:
![v2_vendor_integration_AWS](_images/vendor-integration-aws.png)
Click Save, Show and Sync respectively.
This automatically set up the non-RFC 1918 routes between the Aviatrix Gateway and the Vendor’s firewall instance (in this case, Check Point). This can also be done manually through the Cloud Portal and/or the Vendor’s Management tool.
Deploying and Installing the Smart Console
Deploying and Installing Check Point Security Management
The Check Point Security Gateway launched in step 1 requires a management console (Check Point Security Manager) for managing one or more Security Gateways.
Deploy and install the Check Point Security Management from Azure Marketplace in Azure’s Console.
Check Point Security Management CloudGuard version should be R80.40. Check Point Security Manager deployment and installation steps are not part of this guide, and have to be done manually. |
Log in to the Check Point Security Manager and download the SmartConsole on Windows-based computer.
Option 1: Click Download Now! with the message Manage Software Blades using SmartConsole on the Overview page as below.
![cp_security_manager](_images/cp-security-manager.png)
Option 2: Download it by using this link R80.40.
Installing and Logging into the SmartConsole
The Check Point SmartConsole is a Windows-based application used to configure and manage polices. These policies can be applied to one or more Security Gateways.
-
Install the SmartConsole and log in with the Gaia Portal username, password and IP Address of the Check Point Gateway.
![smart_console_login_aws](_images/smart-console-login-aws.png)
![smartconsole_gateway_login_aws](_images/smartconsole-gateway-login-aws.png)
-
Execute the "Get Interfaces With Topology" function to sync up the settings that we have configured via the Gaia Portal.
-
Select Gateways & Servers on the left.
-
Double-click on the Check Point Firewall.
-
Select Network Management on the left.
-
Click Get Interfaces to expand options.
-
Click Get Interfaces With Topology.
-
Click Yes.
-
Review the Get Topology Results which should match to the settings that we have configured via Gaia Portal.
-
Click Accept.
![v2_CheckPoint_SmartConsole_syncup_01](_images/checkpoint-smartconsole-syncup-one.png)
![v2_CheckPoint_SmartConsole_syncup_02](_images/checkpoint-smartconsole-syncup-two.png)
-
Go to Security Policies > Access Control > Policy and click Install Policy and then Install to commit the settings.
![install_policy_aws](_images/install-policy-aws.png)
Configuring and Adding Check Point Gateway in SmartConsole
(Optional) Configure Security Gateway Secure Inter-Communication (SIC) Key
If you do not remember your SIC Key, or you want to generate a new one, you can follow these steps. You can skip these steps if you remember the SIC Key provided during the Security Gateway launch from Aviatrix Controller.
The Check Point Gateway needs to be configured with a one-time secure password to establish the secure communication with the Check Point Security Management Portal.
SSH into the Check Point Gateway to configure the One-time Secure Password.
%ssh admin@ip-address The authenticity of host 'ip-address' can't be established. ECDSA key fingerprint is SHA256:1S6wQF4xI6YtieM1te0lnI2wXoRDiDfa85ctsDHd1N4. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Failed to add the host to the list of known hosts (/Users/ahmednaail/.ssh/known_hosts). This system is for authorized use only. Password: You have logged into the system. By using this product you agree to the terms and conditions as specified in https://www.Check Point.com/download_agreement.html CLINFR0771 Config lock is owned by admin. Use the command 'lock database override' to acquire the lock. cp-firewall-sc-azure> lock database override cp-firewall-sc-azure> set expert-password Enter new expert password: Enter new expert password (again): cp-firewall-sc-azure> expert Enter expert password: Warning! All configurations should be done through clish You are in expert mode now. [Expert@cp-firewall-sc-azure:0]# cpconfig This program will let you re-configure your Check Point products configuration. Configuration Options: ---------------------- (1) Licenses and contracts (2) SNMP Extension (3) PKCS#11 Token (4) Random Pool (5) Secure Internal Communication (6) Enable cluster membership for this gateway (7) Check Point CoreXL (8) Automatic start of Check Point Products (9) Exit Enter your choice (1-9) :5 Configuring Secure Internal Communication... ============================================ The Secure Internal Communication is used for authentication between Check Point components Trust State: Initialized but Trust was not established SWould you like to change the Activation Key? (y/n) [n] ? y SThis operation will stop all Check Point Services (cpstop). Are you sure you want to continue? (y/n) [n] ? y Enter Activation Key: Retype Activation Key: initial_module: Compiled OK. initial_module: Compiled OK. Hardening OS Security: Initial policy will be applied until the first policy is installed The Secure Internal Communication was successfully initialized Configuration Options: ---------------------- (1) Licenses and contracts (2) SNMP Extension (3) PKCS#11 Token (4) Random Pool (5) Secure Internal Communication (6) Enable cluster membership for this gateway (7) Check Point CoreXL (8) Automatic start of Check Point Products (9) Exit Enter your choice (1-9) :9 Thank You...
Terminate the SSH session.
Adding Check Point Security Gateway in SmartConsole
At this point, we have a one-time secure password (SIC Key) which will be used to add a gateway inside Check Point Security Manager.
-
In the SmartConsole add a Gateway as shown below:
![smartconsole_add_gateway](_images/smartconsole-add-gateway.png)
-
Click on Wizard Mode.
![cp_gw_creation_wizard](_images/cp-gw-creation-wizard.png)
-
Provide the gateway information as shown in the table:
Field | Value |
---|---|
Gateway Name |
Configure any name |
Gateway Platform Gateway IP |
Select CloudGuard IaaS |
Static IP Address |
Provide Check Point Gateway IP address |
![gw_general_properties](_images/gw-general-properties.png)
-
Establish a secure communication with a Gateway.
Field | Value |
---|---|
Gateway' Name |
Provide you Gateway Name (Case-Sensitive) |
One-time Password |
Use same Password which you set during SSH session with Gateway |
Trust State |
Default Values |
If you see an error during communication establishment process that says, "Failed to connect to Security Gateway. SIC has not been established …", SSH to your gateway again and repeat the above process. |
![trusted_communication](_images/trusted-communication.png)
-
Click OK and Finish.
![get_topology](_images/get-topology.png)
![cp_wizard_summary](_images/cp-wizard-summary.png)
-
Review the Gateway Summary and click OK.
![cp_gw_summary](_images/cp-gw-summary.png)
At this point if all the steps are followed properly then you should see a Gateway under the Gateways & Servers tab.
![cp_gw_added](_images/cp-gw-added.png)
Configuring Basic traffic Policy to Allow Traffic VNet to VNet
In this step, you will configure a basic traffic security policy that allows traffic to pass through the Security Gateway.
Navigate to Security Policies > Access Control > Policy and configure a policy by either modifying the default Cleanup rule or adding a new rule above the default rule.
Field | Value |
---|---|
Name |
Configure any name for this policy (i.e. allow-all) |
Source |
Any |
Destination |
Any |
VPN |
Any |
Service & Applications |
Any |
Action |
Accept |
Track |
Log |
![basic_allowall_policy](_images/basic-allowall-policy.png)
Click Install Policy in Smart Console on top left corner, and then Install to commit the settings.
![install_allowall_policy](_images/install-allowall-policy.png)
![policy_installed](_images/policy-installed.png)
After validating that your traffic is being routed through your Security Gateway instances, you can customize the security policy to tailor to your requirements.
(Optional) Configuring the Basic Traffic Policy to Allow Traffic VPC to Internet
In this step, you will configure a basic traffic security policy that allows Internet traffic to pass through the firewall. Given that Aviatrix Gateways will only forward traffic from the TGW to the LAN port of the Firewall, we can simply set our policy condition to match any packet that is going in of LAN interface and going out of WAN interface.
Enable the Egress inspection feature on FireNet. |
-
In the Aviatrix Controller, navigate to Firewall Network > List > Firenet.
-
Select a Transit FireNet in the list and click Details.
-
Scroll down to Egress through Firewall and click Enable.
-
Verify the Egress status on the Firewall Network > List > Firenet page.
![cp_egress_inspection_aws](_images/cp-egress-inspection-aws.png)
In the Check Point Firewall SmartConsole, navigate to the "Gateways & Servers" page and then double-click on the gateway to enable NAT function as per the following screenshot.
-
Click NAT.
-
Select the Hide internal networks behind the Gateway’s external IP checkbox.
-
Click OK.
-
Click Install Policy.
![v2_CheckPoint_policy_vpc_to_internet_nat_enabled](_images/checkpoint-policy-nat-enabled.png)
The NAT function needs to be enabled on the Check Point FW interface eth0 for this VPC to Internet policy. Please refer to Check Point’s NAT instruction for details. |
-
(Optional) If you have default "Cleanup rule", then navigate to Security Policies > Access Control > Policy and inject a new rule for Internet Policy on top of the default Cleanup rule.
Field | Value |
---|---|
Name |
Configure any name for this policy (i.e. Internet-Policy) |
Source |
Any |
Destination |
Select the object with All_internet |
VPN |
Any |
Service & Applications |
Any |
Action |
Accept |
Track |
Log |
-
Click Install Policy and then Install to commit the settings.
![cp_policy_vpc_to_internet_aws](_images/cp-policy-internet-aws.png)
After validating that your traffic is being routed through your firewall instances, you can customize the security policy to tailor to your requirements.
Ready to Go
Now your Security Gateway instance is configured and ready to receive packets.
Next step is to validate your configurations and polices using FlightPath and Diagnostic Tools (ping, traceroute etc.).
Viewing Traffic Log
You can view if traffic is forwarded to the firewall instance by logging in to the Check Point Firewall SmartConsole. Go to the Logs & Monitor page.