Check Point CloudGuard Network Security Deployment in Public Clouds
Domain 2 tests deployment mechanics: which image, which management model, how many interfaces, how the gateway learns cloud objects, and how high availability survives an Availability Zone failure.
Management models
- Externally managed: the gateway is managed from a Security Management Server (a SmartConsole you run, or Smart-1 Cloud). This is the normal choice for multi-gateway and HA designs.
- Locally managed (standalone): management and gateway share one instance. Fine for a lab or a single small VPC; not for a cluster.
- CloudGuard Controller: connects to the cloud API with a read-only credential (cross-account IAM role with an external ID in AWS, an app registration/service principal in Azure, a service account in GCP) and imports VPCs/VNets, subnets and tags as Data Center objects that policy rules can reference directly.
Delivery paths
- Marketplace images (AWS AMI, Azure offer, GCP image) for manual or scripted deployment.
- Infrastructure as code for repeatable builds: the Check Point Terraform provider and published cloud modules, plus CloudFormation and ARM templates.
- Bootstrap through instance user-data / custom-data or the Cloud Management Extension (cme), so a rebuilt gateway returns to the same configuration instead of being hand-configured.
Interfaces and HA
- Give the management interface its own subnet so policy installs and licensing survive a data-plane incident.
- Data interfaces sit in untrusted and trusted subnets; cluster members belong in different Availability Zones and must reach each other for state synchronisation.
- Size instances from the published throughput table, not from vCPU count, and remember that BYOL and marketplace hourly licensing differ in what is bundled.
Worked example
A team needs an HA pair fronting two spoke VPCs. They deploy two gateways, one per AZ, each with a management interface in a management subnet, an external interface in the TGW-attachment subnet, and an internal interface in the protected subnet. ClusterXL pairs them, the cluster address is what route tables point at, and an Elastic IP is reassigned on failover for inbound access. If scale-out rather than pair-failover is required, an AWS Auto Scaling group with the vendor's autoscaling templates is used, and the CloudGuard Controller keeps Data Center objects current as instances appear and disappear.
Traps that cost marks
- Placing both cluster members in one AZ; one AZ event removes the pair.
- Managing a gateway from an SMS with no routed path to the management interface.
- Hard-coding cloud IPs in rules instead of importing objects, so policy goes stale after a redeploy.
- Assuming marketplace hourly licensing is equivalent to a full BYOL blade set.