Cloud and Virtualization Security
Cloud and Virtualization Security
This domain tests Check Point gateways in public clouds and virtualized data centers: CloudGuard Network Security, VSX, and management of virtual systems. The exam focuses on where policy is enforced, how traffic is routed, and how cloud constructs interact with Check Point objects.
Core rules
- In AWS, Azure, and GCP, the Check Point gateway is an instance with multiple interfaces; cloud route tables and security groups determine whether traffic reaches it. A security group allowing traffic is not the same as a Check Point rule allowing it.
- CloudGuard auto-provisioning can create gateways and management objects from templates; the result is still a normal gateway object with a policy installed.
- VSX partitions a physical gateway into Virtual Systems and a Virtual Switch. Each VS has its own policy and interfaces; the Virtual Switch routes between VSs and external interfaces.
- In virtual environments, promiscuous mode, MAC learning, and spoofing settings on vSwitches can silently drop or misdirect traffic.
- HA in the cloud requires explicit cluster configuration and route-table failover; the cluster VIP must be reachable in the VPC.
- Management can be a management server, MDS, or cloud-hosted management; SIC must be established before policy installation.
Worked example
A gateway is deployed in an AWS VPC with eth0 on the public subnet and eth1 on the private subnet. Instances in the private subnet use the gateway as their default route. The Check Point policy permits 10.0.0.0/16 to 0.0.0.0/0 on port 443. Users still fail. The reason is that the private subnet's route table points 0.0.0.0/0 to the internet gateway, not to the gateway's eth1. The packet never reaches Check Point, so no rule is evaluated. Fix the route table to send 0.0.0.0/0 to the gateway's ENI, then verify with fw monitor.
Traps
- Treating cloud security groups as the security policy.
- Forgetting return-path routes in asymmetric cloud subnets.
- Assuming VSX Virtual Systems share one policy; each VS has its own.
- Overlooking vSwitch security settings that block promiscuous or forged traffic.
- Expecting cluster failover to update cloud routes automatically without configuration.