I85PREP
⌘ K
Check Point CCCS study materials
Check Point CCCS study resources

Check Point CCCS: Cloud Network Security Architecture and Traffic Inspection

Check Point CCCS · Work through your exam, one topic at a time.

All guide sections

Cloud Network Security Architecture and Traffic Inspection

Domain 3 is the architecture question: which traffic must cross a CloudGuard gateway, how you steer it there, and why the return path breaks when steering is wrong.

Two directions of traffic

  • North-south: in and out of the cloud - internet egress from spokes and inbound to published applications.
  • East-west: spoke to spoke, VNet to VNet, cluster to cluster. Higher volume, and the place where peering quietly bypasses inspection.

Steering patterns

  • AWS hub-and-spoke: a Transit Gateway with a dedicated inspection VPC. Spoke route tables send 0.0.0.0/0 and inter-spoke CIDRs to the TGW; the inspection VPC sends traffic to the firewall ENIs; the firewall's default route goes to a NAT gateway so return traffic is symmetric.
  • AWS Gateway Load Balancer: a VPC endpoint and GENEVE-encapsulated traffic give transparent, flow-sticky, horizontally scalable inspection without hand-managing a route table per appliance.
  • Azure: a hub VNet with user-defined routes on every spoke subnet pointing to the firewall private IP, or to an internal load balancer fronting an HA pair, with NSGs and floating IP for HA ports.
  • GCP: an internal TCP/UDP load balancer as next hop, driven by policy-based routes.

Why symmetry matters

Stateful inspection needs both directions on the same appliance. Enable Transit Gateway appliance mode, or rely on Gateway Load Balancer flow stickiness, so a flow is not hashed to a different AZ's gateway on the way back. Remember that VPC peering is non-transitive: a spoke peered to a hub cannot reach a sibling spoke through it, so route through the firewall or the TGW. Traffic to a gateway VPC endpoint for object storage leaves through the endpoint and never crosses the firewall - design for that instead of being surprised by it.

Worked example

Two spoke VPCs must reach the internet through a firewall in an inspection VPC. Attach all three VPCs to the TGW; in each spoke route table point 0.0.0.0/0 at the TGW; in the inspection VPC route table point 0.0.0.0/0 at the firewall ENI; on the gateway, the default route goes to a NAT gateway in a public subnet, which forwards to the internet gateway. Enable appliance mode on the TGW attachment. Egress SNAT at the NAT gateway keeps the return path identical, so the stateful inspection sees both halves of the connection.

Traps that cost marks

  • Forgetting appliance mode, producing asymmetric drops that look like random failures.
  • Assuming peering is transitive or that security groups filter TGW-routed traffic the way they filter ENI traffic.
  • Leaving a default route that bypasses the firewall for one subnet, silently uninspecting it.
  • Expecting to inspect HTTPS content without a TLS inspection policy.