This article provides a reference architecture for the deployment of Check Point CloudGuard IaaS Security Gateways in Google Cloud Platform.

The article assumes that you have a basic expertise with:

• The Google Cloud Platform and specifically Google Compute Engine.

• Check Point CloudGuard IaaS Security Gateway and Security Management Server.

If deploying a Single Gateway solution doesn't fit your needs, Checkpoint offers additional cloud solutions in GCP including Managed Instance Group and High Availability.

This reference architecture illustrates how one can protect resources deployed in Google Cloud Platform using Check Point CloudGuard IaaS Security Gateway.

A common use case involves a web application environment deployed in a virtual network in Google Compute Engine.

The web application can consist of multiple tiers, such as a Web tier and an Application tier.

The traffic flows in this environment normally consist of:

• Traffic arriving from the Internet to the Web tier.

• Traffic between the Web tier and the Application tier.

• Traffic between the environment and an on-premises network for administration and backend services.

• Outgoing connections from the environment to the Internet for software updates and access to external web services.

• Roaming users' remote access connections to the environment.

From a security perspective, these traffic flows should all be inspected and governed by the same security policy enforced elsewhere by the organization.

These security controls should include:

• Access Control (Firewall).

• Logging.

• Application Control.

• Intrusion Prevention (IPS).

• Advanced Threat Prevention.

• Site-to-Site VPN (for communication with the on-premises network).

• Remote Access VPN (for communication with roaming users).

• Network Address Translation (for Internet bound traffic).

Check Point CloudGuard for Google Cloud Platform can be deployed in Google Compute Engine to provide all of the above services.

The Check Point CloudGuard IaaS Security Gateway can be managed in several ways, including:

• A standalone configuration, in which the CloudGuard IaaS Security Gateway acts as its own Security Management Server.

• Centrally managed, in which the Security Management Server is located on-premises.

• Centrally managed, in which the Security Management Server is located in the same virtual network.

Notes:

• The Check Point CloudGuard for Google Cloud Platform version R80.X can be managed by a Check Point Security Management Server running version R80.X or higher.
• The Check Point CloudGuard for Google Cloud Platform version R81.X can be managed by a Check Point Security Management Server running version R81.X or higher.

Google Compute Engine supports two modes for networking:

• Legacy (non-subnetwork) mode.

• Subnet mode.

  Subnet mode is further divided into two:

  • Automatic

    • In this mode, a subnet is automatically created in each region.
    • In this mode, some Google Compute Engine firewall rules are automatically created for the user.

  • Custom

    • In this mode, the customer can create 0, 1 or more subnets in each region.

Check Point CloudGuard IaaS Security Gateway can be deployed in both of these modes, but for simplicity we will assume that Subnet mode is being used.

For additional information, see https://cloud.google.com/vpc/docs/vpc.

For the rest of this document, we will assume that a Custom Subnet mode environment has already been created consisting of the following:

All of these subnets are assumed to be in the same region (e.g., us-central-1).

In addition, we will assume that an on-premises network (172.16.0.0/16) exists.

When deploying the Check Point solution, you have the option of selecting the Check Point CloudGuard IaaS installation type:

The installation type can be any of the following:

• Gateway and Management (Standalone)
• Gateway only
• Management only
• Manual configuration

A Gateway only instance can be centrally managed by a Security Management Server in your on-premises network or in the public cloud.

If your Security Management Server is on-premises, then you can manage the CloudGuard IaaS Security Gateway:

• Over the Internet using the CloudGuard IaaS Security Gateway's public IP address.

• Over a Cloud Router connection (https://cloud.google.com/compute/docs/cloudrouter) using the CloudGuard IaaS Security Gateway's private IP address.

To deploy, go to one of the following:

Example:

Deployment options:

Comments:

1. Once the instance starts, it will set itself up automatically based on the installation type you have selected.
   The use of the Manual configuration installation type is discouraged as it will require you to manually perform additional steps, such as:
   • Set up Google Compute Engine firewall rules.
   • Run the first time wizard manually.
   • Tag the instance.

2. The size of the disk. If a value larger than the default is supplied, then you will need to follow sk95566 - Managing partition sizes via LVM manager on Gaia OS.

3. If checked, a password would be automatically generated for the user 'admin'. These credentials could be used for:

   • Connecting to the Gaia Portal.
   • Connecting using a serial console (https://cloud.google.com/compute/docs/instances/interacting-with-serial-console).
   • When installing a Security Management Server, this password could be used to connect to the Security Management Server using SmartConsole GUI clients.
   • Note this password will not work over SSH, as SSH password authentication is disabled by default.

4. By default, the instance will trust all instance level and project level public keys as explained here:
   https://cloud.google.com/compute/docs/instances/connecting-to-instance.
   To lock down access to the instance even further, you can enter here a specific SSH public key.
   If one is given, only the owner of the corresponding private key would be able to connect over SSH to the instance.

5. The Secure Internal Communication (SIC) Activation key needed to establish trust between the CloudGuard IaaS Security Gateway and its Security Management Server. If not provided and needed, then a key will be automatically generated.

6. Only used in Gateway and Management (Standalone) and Management only installations. Access to the Security Management Server over SSH, HTTPS and SmartConsole GUI clients would only be allowed from this address range.

7. Only used in Management only installations. Communication from gateways to this Management Server will only be allowed from this address range.

8. You should select networks and sub-networks for all network interfaces even if they are not used. The unused network interfaces will be ignored and will not be deployed.
   Google Compute Engine supports instances with multiple network interfaces, for more information how to configure CloudGuard for GCP with multiple interfaces refer to: sk121637.

9. By default, every Check Point Security Gateway and Security Management Server's WebUI is accessible from the internet by browsing to http://<virtual-machine-public-ip>. Restricting access to the WebUI is possible by configuring a Firewall Rule, or by configuring the Check Point Gateway and Management Server settings.

Click Deploy to start the deployment process. The deployment time will depend on installation type and is expected to complete in less than 10 minutes.

If a public address was not allocated, then the deployment will complete once the instance has started. Note that in such a case, you should wait a few more minutes until the first time wizard completes.

If a public address was allocated, then the deployment will be pending until the first time wizard has completed running, and the product is ready for use.

Once completed, you should be presented with a page similar to this:

Note that some variations on the below are possible depending on the deployment options you have selected.

Example:

The page will contain the following items:

In addition to the Check Point instance, this template will perform the following:

• Allocate a public address and associate it with the instance (unless None was requested).

• Create the following Google Compute Engine firewall rules for each configured network interface:

  • For a Gateway only, or a Gateway and Management (Standalone) deployment:

    • A permissive Google Compute Engine firewall rule allowing all traffic.
      The rationale for this is that the instance already enforces a Check Point
      security policy, and there is no need for a second security mechanism.

  • For a Management only deployment:

    • A rule allowing connections from the Check Point CloudGuard IaaS Security Gateways to the Security Management Server.
    • A rule allowing connections over SSH / HTTPS, with SmartConsole GUI clients to the Security Management Server.

  • For a Manual configuration deployment, no firewall rules should be created.

• Tag the instance:

  • For a Gateway only installation type, the following tag would be added:

    • checkpoint-gateway

  • For a Management only installation type, the following tag would be added:

    • checkpoint-management

  • For a Gateway and Management (Standalone) installation type, the following tags would be added:

    • checkpoint-gateway
    • checkpoint-management

After deployment, you can connect to the instance using the following methods:

• SSH

  You can connect to the instance using SSH as explained in https://cloud.google.com/compute/docs/instances/connecting-to-instance.

  Notes:

  • The username to connect with is 'admin'.

  • SSH using passwords is disabled by default. Instead you should use SSH public keys.

  • If you use the web based SSH client provided by Google, then make sure to set the username in the client to 'admin' as explained here:
    https://cloud.google.com/compute/docs/ssh-in-browser#login_username.

• Gaia Portal

  You can connect to the Gaia Portal over HTTPS using a web browser.

  Notes:

  • The username is 'admin'.

  • If you have selected Automatically generate an administrator password, then use the Admin password (Temporary) shown at the end of the deployment.

  • If you have not selected Automatically generate an administrator password, then first you will need to connect over SSH to the machine and set the user 'admin' password.

  • When you connect to the Gaia Portal, you will be presented with an SSL warning similar to the following:

    Your connection is not private
NET::CERT_AUTHORITY_INVALID

    Example:

    

    This is due to the fact that the certificate presented by the Gaia Portal is self-signed.

    You can validate the certificate by comparing its fingerprint to the fingerprint of the certificate found on the CloudGuard IaaS Gateway.
    To retrieve the CloudGuard IaaS Gateway's certificate fingerprint, connect to the CloudGuard IaaS Gateway over SSH and run the following command:
    [Expert@HostName:0]# cpopenssl x509 -in /web/conf/server.crt -fingerprint

    Alternatively, you can install your own SSL certificate. Refer to the following articles:

    • sk97648 - How to create and set certificate for Gaia Portal
    • sk108252 - How to change Gaia Portal's certificate from SHA-1 to SHA-256
    • sk109593 - How to configure Gaia Portal to use a 3rd party CA-issued Wildcard certificate
    • sk103129 - Not able to connect to Gaia Portal due to issues with SSL certificate

• Serial Console

  Follow the instructions in https://cloud.google.com/compute/docs/instances/interacting-with-serial-console.

  Notes:

  • The username is 'admin'.

  • If you have selected Automatically generate an administrator password, then use the Admin password (Temporary) shown at the end of the deployment.

  • If you have not selected Automatically generate an administrator password, then first you will need to connect over SSH to the machine and set the user 'admin' password using the clish CLI command "set user admin password".

• SmartConsole GUI clients (when the instance acts as Security Management Server)

  If the instance acts as a Security Management Server, then you can connect to it using the SmartConsole GUI clients.

  You can download and install these clients from either the Gaia Portal, or the Check Point Download Center.

  Notes:

  • The username is 'admin'.

  • If you have selected Automatically generate an administrator password, then use the Admin password (Temporary) shown at the end of the deployment.

  • If you have not selected Automatically generate an administrator password, then first you will need to connect over SSH to the machine and set the Security Management password (run the 'cpconfig' command and select the relevant option).

If you are deploying a centrally managed Security Gateway, then you will need to define the CloudGuard IaaS Security Gateway on the Security Management Server.

Follow the steps described in the:

• R80.30 versions Security Management Server Administration Guide - chapter "Managing Gateways".
• R80.40 Security Management Administration Guide - chapter "Managing Gateways".
• R81 Security Management Administration Guide - chapter "Managing Gateways".

Follow the instructions in this section, if you want to set up a VPN tunnel between the Check Point CloudGuard IaaS Security Gateway in Google Compute Engine and an on-premises Security Gateway.

In this section, we will setup the encryption domain of the CloudGuard IaaS Security Gateway. The encryption domain will consist of the Web and Application subnets.

Traffic from these subnets to the on-premises network will be routed to the CloudGuard IaaS Security Gateway using the Google Compute Engine route we have set up in the "Inspecting Internet bound traffic" section above.

For more information about defining VPN tunnels with Security Gateways on different sites and different servers, see the VPN Administration Guide:

• R80.30:
  • Site-to-Site
• R80.40:
  • Site-to-Site
  • Remote access
• R81:
  • Site-to-Site
  • Remote access

In this deployment, the company's on-premises Security Management Server centrally manages the CloudGuard IaaS Security Gateway at the company's local site and the CloudGuard IaaS Security Gateway protecting the company's private subnets in Google Compute Engine.

You can encrypt the data going between the company's on-premises and the company's private subnets in Google Compute Engine by creating a VPN tunnel.

Follow these steps to configure the VPN:

Using this setup, it is possible to have the same set of Check Point CloudGuard IaaS Security Gateways inspect traffic belonging to multiple web applications.

• We will assume a second web application named web2.

• There is already a deployed external load balancer in the environment. (For instructions on adding a load balancer to your environment go to "Setting up a load balancer")

To achieve this, you need to assign an additional IP address to the load balancer.

Procedure:

1. While in your load balancer resource page in GCP, click on Edit.

2. Click on Frontend configuration section.

3. Click on ADD FRONTEND IP AND PORT.

4. Fill in the required information relevant to your environment.

5. Click DONE.

6. Click UPDATE.

1. Create a Host object to represent the external load balancer:

   • Show / Hide instructions for SmartConsole
     

     1. On the right pane, click on the Objects tab.

     2. Right-click on the Network Objects - click on the Host...:

        

     3. On the General pane:

        1. Enter a representative name (e.g., web2-external-lb).

        2. In the IPv4 Address field, enter the new IP address of the external load balancer.

        3. Click on OK to apply the settings and close the New Host window.

        Example:
        

2. Add the relevant Access / Firewall rule:

   • Show / Hide instructions for SmartConsole
     

     1. On SmartConsole Navigation Toolbar, click on the SECURITY POLICIES app.

     2. In the upper middle section Access Control, click on the Policy.

     3. Add the following access rule above the Cleanup rule:

        Source	Destination	VPN	Services & Applications	Action	Track	Install On
        * Any	web2-external-lb	* Any	Original	Accept	Log	* Policy Targets

        Where:

        Column	Value	Comment
        Source	Any
        Destination	web2-external-lb
        VPN	* Any	This is the default
        Service	Original	If there is a need to only allow specific services or protocols, these can be added instead
        Action	accept
        Track	Select the desired tracking option	e.g. Log

3. Add the relevant NAT rule:

   • Show / Hide instructions for SmartConsole
     

     1. On SmartConsole Navigation Toolbar, click on the SECURITY POLICIES app.

     2. In the upper middle section Access Control, click on the NAT.

     3. Add the following NAT rule:

        No.	Original Source	Original Destination	Original Services	Translated Source	Translated Destination	Translated Services	Install On	Comment
        1	All_Internet	web2-external-lb	Original	H web2-external-lb	S web2-application	Original	* Policy Targets

        Where:

        Column	Value	Comment
        Original Source	All_Internet	Do not use "* Any"
        Original Destination	web2-external-lb
        Original Service	Original	If there is a need to only allow specific services or protocols, these can be added instead
        Translated Source	web2-external-lb	Select "Hide" as the translation method
        Translated Destination	web2-application	web2-application is a host object representing the new application. An object representing an internal load balancer can be added instead
        Translated Service	Original	If there is a need to only allow specific services or protocols, these can be added instead

4. Install the Access / Network Security policy on your CloudGuard IaaS Security Gateways.

When deploying a CloudGuard IaaS Security Gateway, it can be licensed using either:

• Bring-Your-Own-License (BYOL) using the CloudGuard IaaS license.

• Pay-As-You-Go (PAYG) - the Gateway is pre-licensed.

When deploying a Security Management Server, you will need to acquire an open server license.

Important: This article provides reference architecture only for the deployment of Check Point CloudGuard Security Gateways version R80.40 and higher. For information regarding deployment of Check Point CloudGuard Security Gateways using previous versions, contact Check Point Support.

• QoS blade is not supported.

• VSX mode is not supported.

• For supported versions of Jumbo Hotfix Accumulator refer to sk109141. 

• The R77.30 Jumbo Hotfix Accumulator (all its Takes) is not supported on CloudGuard for Google Cloud Platform.

For a list of additional limitations in other related solutions visit the "Known Limitations" section in GCP HA Admin Guide and GCP MIG Admin Guide.