Cloud infrastructure segmentation with the Check Point next-generation firewall

In this tutorial, we will deploy a secure network infrastructure based on the Check Point next-generation firewall. It will include three segments hosting resources grouped by function and isolated from other resources. We will host public-facing applications in the DMZ segment and cloud management resources in the mgmt segment. The segments will communicate through a Check Point next-generation firewall VM providing end-to-end protection and traffic management between the segments.

If you need to ensure the NGFW’s fault tolerance and the deployed applications’ high availability, use this recommended solution.

You can see the structure we described on the diagram below.

We will use the following folders:

• The public folder contains internet-facing resources.
• The mgmt folder is for cloud infrastructure management and internal resources. It includes VMs for infrastructure protection and network segmentation into security zones (fw), a VM of the centralized firewall management server (mgmt-server), and a WireGuard VPN VM for secure management segment access (jump-vm).
• The dmz folder enables you to publish open-access applications .

For more information, see the project repository.

To deploy a secure Check Point NGFW-based network infrastructure:

1. Get your cloud ready.
2. Set up your environment.
3. Deploy your resources.
4. Set up your firewall gateway.
5. Test the solution.
6. Requirements for production deployment.

If you no longer need the resources you created, delete them.

Next-Generation FirewallNext-Generation Firewall

Yandex Cloud Marketplace offers multiple NGFW solutions. This scenario uses Check Point CloudGuard IaaS. Its features include:

• Firewall, NAT, IPS, antivirus, and anti-bot protection.
• Application layer granular traffic management, session logging.
• Centralized Check Point security management.
• In our example, we will configure Check Point firewall with basic access control and NAT policies.

Yandex Cloud Marketplace offers PAYG and BYOL licensing for Check Point CloudGuard IaaS. We will use BYOL with a 15-day trial:

• VM for Check Point CloudGuard IaaS NGFW: Firewall & Threat Prevention BYOL.
• Management server VM for Check Point CloudGuard IaaS: Security Management BYOL, for NGFW management tasks.

For production deployment, we recommend to use the following options:

• NGFW Check Point CloudGuard IaaS - Firewall & Threat Prevention PAYG.
• Separate license for the Check Point CloudGuard IaaS - Security Management server. Alternatively, you can use your on-premise server.

Get your cloud readyGet your cloud ready

Sign up for Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or create a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can navigate to the cloud page to create or select a folder for your infrastructure.

Learn more about clouds and folders here.

Required paid resourcesRequired paid resources

The infrastructure support cost includes:

• Fee for continuously running VMs (see Yandex Compute Cloud pricing).
• Fee for public IP addresses and outgoing traffic (see Yandex Virtual Private Cloud pricing).

Required quotasRequired quotas

Make sure you have sufficient cloud quotas not used by other projects.

Set up your environmentSet up your environment

This tutorial uses Windows software and Windows Subsystem for Linux (WSL).
To deploy the infrastructure, we will use Terraform.

Configure WSLConfigure WSL

1. Check whether you have WSL installed on your PC. To do this, run this command in the CLI terminal:

   wsl -l
   

   If WSL is installed, the terminal will return a list of available distributions, such as the following:

   Windows Subsystem for Linux Distributions:
   docker-desktop (Default)
   docker-desktop-data
   Ubuntu
   

2. If WSL is not installed, install it and repeat the previous step.

3. Additionally, you can install your preferred Linux distribution, e.g., Ubuntu, on top of WSL.

4. To make it the default system, run this command:

   wsl --setdefault ubuntu
   

5. To switch your terminal to Linux, run this command:

   wsl ~
   

Create a cloud administrator service accountCreate a cloud administrator service account

Install the required toolsInstall the required tools

1. Install Git using the following command:

   sudo apt install git
   

2. Install Terraform:

   1. Navigate to the root directory:

      cd ~
      

   2. Create the terraform directory and open it:

      mkdir terraform
      cd terraform
      

   3. Run the following command to download the terraform_1.3.9_linux_amd64.zip archive from the official website:

      curl --location --remote-name https://hashicorp-releases.yandexcloud.net/terraform/1.3.9/terraform_1.3.9_linux_amd64.zip
      

   4. Install zip and unpack the ZIP archive:

      apt install zip
      unzip terraform_1.3.9_linux_amd64.zip
      

   5. Add the path to the directory with the executable to the PATH variable:

      export PATH=$PATH:~/terraform
      

   6. Make sure that Terraform is installed by running this command:

      terraform -help
      

3. Create a configuration file specifying the Terraform provider source:

   1. Create the .terraformrc file in nano:

      cd ~
      nano .terraformrc
      

   2. Add the following section to the file:

      provider_installation {
        network_mirror {
          url = "https://terraform-mirror.yandexcloud.net/"
          include = ["registry.terraform.io/*/*"]
        }
        direct {
          exclude = ["registry.terraform.io/*/*"]
        }
      }
      

      For more information about mirror settings, see the relevant Terraform guides.

Deploy your resourcesDeploy your resources

1. Clone the GitHub repository and navigate to the yc-network-segmentation-with-checkpoint script directory:

   git clone https://github.com/yandex-cloud-examples/yc-network-segmentation-with-checkpoint.git
   cd yc-network-segmentation-with-checkpoint
   

2. Set up the CLI profile to run operations under the service account:

   CLI

   If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

   By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

   1. Create an authorized key for your service account and save it to the file:

      yc iam key create \
        --service-account-id <service_account_ID> \
        --folder-id <ID_of_folder_with_service_account> \
        --output key.json
      

      Where:

      • service-account-id: Service account ID.
      • folder-id: ID of the folder where you created the service account.
      • output: Authorized key file name.

      Result:

      id: aje8nn871qo4********
      service_account_id: ajehr0to1g8b********
      created_at: "2023-03-04T09:16:43.479156798Z"
      key_algorithm: RSA_2048
      

   2. Create a CLI profile to run operations under the service account:

      yc config profile create sa-terraform
      

      Result:

      Profile 'sa-terraform' created and activated
      

   3. Configure the profile:

      yc config set service-account-key key.json
      yc config set cloud-id <cloud_ID>
      yc config set folder-id <folder_ID>  
      

      Where:

      • service-account-key: Service account authorized key file.
      • cloud-id: Cloud ID.
      • folder-id: Folder ID.

   4. Add your credentials to the environment variables:

      export YC_TOKEN=$(yc iam create-token)
      export YC_CLOUD_ID=$(yc config get cloud-id)
      export YC_FOLDER_ID=$(yc config get folder-id)
      

3. Get your PC IP address:

   curl 2ip.ru
   

   Result:

   192.240.24.87
   

4. Open the terraform.tfvars file in nano and edit it as follows:

   1. Cloud ID line:

      cloud_id = "<cloud_ID>"
      

   2. The jump-vm allowed public IP addresses:

      trusted_ip_for_access_jump-vm = ["<PC_external_IP>/32"]
      

   terraform.tfvars variable description

   Parameter name	Change required	Description	Type	Example
   cloud_id	Yes	Your Yandex Cloud ID	string	b1g8dn6s3v2e********
   az_name	-	Your Yandex Cloud resourcesavailability zone	string	ru-central1-d
   security_segment_names	-	Segment names. The first segment is for management resources, the second, for internet-facing resources, and the third, for DMZ. If you need more segments, add them at the end of the list. When adding a segment, make sure to specify its subnet prefix in subnet_prefix_list.	list(string)	["mgmt", "public", "dmz"]
   subnet_prefix_list	-	Segment subnet prefixes. Specify one prefix for each segment from the security_segment_names list.	list(string)	["192.168.1.0/24", "172.16.1.0/24", "10.160.1.0/24"]
   public_app_port	-	DMZ application external TCP port	number	80
   internal_app_port	-	DMZ application internal TCP port receiving traffic from NGFW. Internal and external public_app_port TCP ports may be the same.	number	8080
   trusted_ip_for_access_jump-vm	Yes	List of public IPs or subnets trusted to access the jump VM. It is used in the incoming rule of the jump VM security group.	list(string)	["A.A.A.A/32", "B.B.B.0/24"]
   jump_vm_admin_username	-	Jump VM username for SSH connections.	string	admin
   wg_port	-	Jump VM WireGuard inbound UDP port.	number	51820

   Warning

   If you think you may need additinal segments later, add them now because you will not be able to add extra network interfaces to the NGFW VM once it is created.

5. Deploy your cloud resources with Terraform:

   1. Initialize Terraform:

      terraform init
      

   2. Check the Terraform file configuration:

      terraform validate
      

   3. Check the list of new cloud resources:

      terraform plan
      

   4. Create the resources:

      terraform apply
      

6. Once the process is completed, you will see the list of created resources. You can also display this list with the terraform output command:

   Expand to view the deployed resource details

   Name	Description	Value (example)
   dmz-web-server_ip_address	DMZ web server IP address. Used for testing the DMZ application and configuring destination NAT on the firewall.	10.160.1.100
   fw-mgmt-server_ip_address	Firewall management server IP address	192.168.1.100
   fw_gaia_portal_mgmt-server_password	Default password for the firewall management server HTTPS handshake	admin
   fw_mgmt_ip_address	Management network firewall IP address	192.168.1.10
   fw_public_ip_address	Public firewall IP address	D.D.D.D
   fw_sic-password	OTP for adding a firewall to the firewall management server	The terraform output command does not show this value. To see it, run terraform output fw_sic-password.
   fw_smartconsole_mgmt-server_password	Password for connecting to the firewall management server from the Check Point SmartConsole GUI	The terraform output command does not show this value. To see it, run terraform output fw_smartconsole_mgmt-server_password.
   jump-vm_path_for_WireGuard_client_config	WireGuard VPN jump VM connection configuration file	./jump-vm-wg.conf
   jump-vm_public_ip_address_jump-vm	Jump VM public IP	E.E.E.E
   path_for_private_ssh_key	SSH private key used to connect to the jump VM, firewall, management server, and DMZ web server	./pt_key.pem

Configure the firewall gatewayConfigure the firewall gateway

In this guide, you will configure a firewall with basic access control and NAT policies required for performance testing but insufficient for production use.

Learn more about Check Point features and configuration options with our free course, A Deep Dive into Network Security.

Connect to the management segment via a VPNConnect to the management segment via a VPN

After deploying the infrastructure, the mgmt folder will contain the jump-vm Ubuntu instance with the configured WireGuard VPN providing secure connection. Set up a VPN tunnel between your PC and jump-vm so you can access the mgmt, dmz, and public segment subnets.

To set up a VPN tunnel:

1. Get your Linux username:

   whoami
   

2. Install WireGuard on your PC.

3. Open WireGuard and click Add Tunnel.

4. In the dialog that opens, select the jump-vm-wg.conf file in the yc-network-segmentation-with-checkpoint directory.
   To find a Linux, e.g., Ubuntu, directory, type the file path in the dialog address bar:

   \\wsl$\Ubuntu\home\<Ubuntu_user_name>\yc-network-segmentation-with-checkpoint
   

   Where <Ubuntu_user_name> is your Linux username you got in the previous step.

5. Click Activate to activate the tunnel.

6. Check whether you can connect to the management server through the VPN tunnel by running this command in the terminal:

   ping 192.168.1.100
   

   Warning

   If ping fails, make sure the mgmt-jump-vm-sg security group inbound rules include your PC external IP address.

Run SmartConsoleRun SmartConsole

To set up and manage Check Point, install and run the SmartConsole GUI client:

1. Connect to the NGFW management server by opening https://192.168.1.100 in your browser.

2. Sign in using admin as both the username and password.

3. You will enter Gaia Portal where you can download the SmartConsole GUI client by clicking Manage Software Blades using SmartConsole. Download Now!.

4. Install SmartConsole on your PC.

5. Get the SmartConsole password:

   terraform output fw_smartconsole_mgmt-server_password
   

6. Open SmartConsole and sign in as admin with the password you got in the previous step, specifying, 192.168.1.100 as your management server IP address.

Add the firewall gatewayAdd the firewall gateway

Use the wizard to add the FW firewall gateway to the management server:

1. In the Objects top left drop-down list, select More object types → Network Object → Gateways and Servers → New Gateway....

2. Click Wizard Mode.

3. In the dialog that opens, specify the following settings:

   • Gateway name: FW
   • Gateway platform: CloudGuard IaaS
   • IPv4: 192.168.1.10

4. Click Next.

5. Get the firewall password:

   terraform output fw_sic-password
   

6. Enter the password in the One-time password field.

7. Click Next, and then Finish.

Configure the firewall gateway network interfacesConfigure the firewall gateway network interfaces

Configure the eth0 network interface:

1. In the Gateways & Servers tab, open the firewall gateway setup dialog. by double-clicking FW.
2. In the Network Management tab of the Topology table, select the eth0 interface, click Edit, and then click Modify... in the window that opens.
3. Under Security Zone, activate Specify Security Zone and select InternalZone.

In the same way, configure the eth1 and eth2 network interfaces:

1. For the eth1 interface, specify ExternalZone under Security Zone.
2. For the eth2 interface, select Override in the Leads To section and enable Interface leads to DMZ. Under Security Zone, specify DMZZone.

Create network objectsCreate network objects

1. In the Objects top left drop-down list, select New Network... and create mgmt, public, and dmz networks with the following settings:

   Name	Network address	Net mask
   mgmt	192.168.1.0	255.255.255.0
   public	172.16.1.0	255.255.255.0
   dmz	10.160.1.0	255.255.255.0

   For the DMZ network, configure Automatic Hide NAT rules to hide the addresses of DMZ-hosted internet-facing VMs behind the firewall public IP address. To do this:

   1. In the dmz network editing dialog, navigate to the NAT tab.
   2. Activate Add automatic address translation rules, select Hide from the drop-down list, and enable Hide behind the gateway.

2. In the Objects top left drop-down list, select New Host... and create dmz-web-server and FW-public-IP hosts with the following settings:

   Name	IPv4 address
   dmz-web-server	10.160.1.100
   FW-public-IP	172.16.1.10

3. Select More object types → Service → New TCP... and create a TCP service named TCP_8080 at port 8080 for the DMZ-hosted application.

Define security policy rulesDefine security policy rules

To add a security rule:

1. In the Security policies tab, under Access Control, select Policy.
2. Right-click the rule table area and, in the context menu that opens, select Above or Below next to the New Rule.
3. In the new line that appears:
   • In the Name column, specify Web-server port forwarding on FW.
   • In the Destination column, select FW-public-IP.
   • In the Services & Applications column, select http.
   • In the Action column, select Accept.
   • In the Track column, select Log.

In the same way using the table below, add other rules allowing you to test firewall policies, run NLB health checks, publish a DMZ-hosted test application, and test its fault tolerance.

Create a static NAT tableCreate a static NAT table

The destination NAT will route internet user requests to the DMZ-hosted web server.

It will translate packet headers, replacing the destination IP address and port number with the web server IP address and TCP port 8080, respectively.

To set up the firewall gateway NAT table:

1. Navigate to the NAT section under Access Control.

2. In the rule table menu, select Add rule to top.

3. In the new line that appears:

   • In the Original Destination column, select FW-public-IP.
   • In the Original Services column, select http.
   • In the Translated Destination column, select dmz-web-server.
   • In the Translated Services column, select TCP_8080.

   The new rule will appear in the NAT rule table:

   No	Original Source	Original Destination	Original Services	Translated Source	Translated Destination	Translated Services	Install On
   1	Any	FW-public-IP	http	Original	dmz-web-server	TCP_8080	Policy Targets (All gateways)

Apply the security policy rulesApply the security policy rules

1. Click Install Policy at the top left of the screen.
2. In the dialog that opens, click Publish & Install.
3. In the next dialog, click Install and wait for the process to complete.

Test the solutionTest the solution

1. To get the firewall public IP address, run this command in the terminal:

   terraform output fw_public_ip_address
   

2. Make sure you can access your network infrastructure from the internet by opening the following address in your browser:

   http://<FW_public_IP_address>
   

   If your system is accessible from the internet, you will see the Welcome to nginx! page.

3. Make sure the firewall rules allowing traffic are active by navigating to the yc-network-segmentation-with-checkpoint directory on your PC and connecting to the DMZ-hosted VM over SSH:

   cd ~/yc-network-segmentation-with-checkpoint
   ssh -i pt_key.pem admin@<internal_IP_address_of_VM_in_DMZ_segment>
   

4. To check whether the DMZ-hosted VM has internet access, run this command:

   ping ya.ru
   

   The ping from dmz to internet rule should allow the command to run.

5. Make sure the firewall traffic-blocking rules are active.
   To check that the jump VM in the mgmt segment is not accessible from DMZ, run this command:

   ping 192.168.1.101
   

   The Cleanup rule should block the command.

6. In SmartConsole, navigate to the Logs tab of the LOGS & MONITOR section, find the entries made while you tested the firewall rules, and see which rules were applied.

Production deployment requirementsProduction deployment requirements

• To ensure NGFW fault tolerance and applicatoin high availability, use this recommended solution.
• Make sure to change the passwords transferred through the metadata service in check-init...yaml files:
  • SIC password for connecting the firewall and the firewall management server.
  • Check Point SmartConsole password.
  • Firewall management server admin password. You can change this password in Gaia Portal.
• Save the pt_key.pem private SSH key to a secure location or recreate it without using Terraform.
• If you do not plan on using the jump VM further, delete its public IP address.
• If you plan to connect to the mgmt segment through the jump VM WireGuard VPN, change the WireGuard keys on the jump VM and your remote PC, e.g., admin workstation.
• Set up access control and NAT policies for your Check Point NGFW configuration.
• Set up security group rules for applications deployed in different segments.
• Do not assign public IP addresses to the VMs in the segments protected by the Check Point NGFW rules and routing, with the exception of the mgmt segment where routing tables do not use the 0.0.0.0/0 default route.
• Select your preferred Check Point CloudGuard IaaS license and image (see Next-Generation Firewall).

How to delete the resources you createdHow to delete the resources you created

To stop paying for the resources you created, run this command:

terraform destroy

Terraform will permanently delete all resources you created, including networks, subnets, VMs, folders, etc.

You can delete your resources faster by deleting all folders in Yandex Cloud console and then deleting the terraform.tfstate file from the yc-network-segmentation-with-checkpoint folder on your PC.