Overview

If you are deploying a CloudGuard WAF AppSec Gateway to protect an existing production website, we recommend you also read the HOW-TO guide for this particular deployment.

CloudGuard WAF can be deployed as either a single virtual machine or Auto-Scaling Group in AWS. It acts as a reverse proxy where before / after you can deploy AWS Load Balancers:

When deploying an auto-scaling group, the external load balancer is deployed automatically.

Installation

Follow these steps to deploy CloudGuard WAF in AWS using a supplied CloudFormation Template:

Step 1: AWS Console Log in

Log in to AWS Console and select the relevant region.

Step 2: Activate CloudGuard WAF through the AWS Marketplace (Once per Region)

Search for CloudGuard WAF in AWS Marketplace. During activation, a form with a field to select one of the AWS regions, is shown. Select the region in which you wish to deploy CloudGuard WAF's Gateway.

Step 3: Verify required permissions

Verify that you have the required IAM permissions:

• CloudFormation::DescribeStackEvents
• CloudFormation::DescribeStacks
• CloudFormation::ListStacks
• CloudFormation::ListStackResources
• CloudFormation::CreateStack
• elasticloadbalancing::DescribeLoadBalancers
• elasticloadbalancing::DescribeListeners
• elasticloadbalancing::DescribeTargetGroups
• elasticloadbalancing::CreateTargetGroup
• elasticloadbalancing::CreateListener
• elasticloadbalancing::CreateLoadBalancer
• elasticloadbalancing::ModifyTargetGroupAttributes
• elasticloadbalancing::ModifyLoadBalancerAttributes
• SNS::CreateTopic
• SNS::GetTopicAttributes
• SNS::Subscribe
• IAM::GetRolePolicy
• IAM::PutRolePolicy
• IAM::CreateInstanceProfile
• IAM::CreateRole
• IAM::AddRoleToInstanceProfile
• EC2::DescribeInternetGateways
• EC2::DescribeLaunchTemplates
• EC2::DescribeLaunchTemplateVersions
• EC2::DescribeKeyPairs
• EC2::DescribeSecurityGroups
• EC2::DescribeSubnets
• EC2::DescribeVpcs
• EC2::DescribeAccountAttributes
• EC2::CreateTags
• EC2::AuthorizeSecurityGroupIngress
• EC2::CreateLaunchTemplate
• EC2::CreateSecurityGroup
• EC2::RunInstances
• CloudWatch::PutMetricAlarm
• Health::DescribeEventAggregates

If you want AutoScaling setup:

• AutoScaling::UpdateAutoScalingGroup
• AutoScaling::CreateAutoScalingGroup
• AutoScaling::DescribeAutoScalingGroups
• AutoScaling::DescribeScalingActivities
• AutoScaling::PutScalingPolicy
• AutoScaling::PutNotificationConfiguration

If you want to store certificates in AWS:

• KMS::CreateGrant
• KMS::DescribeKey

Step 4: Deployment using CloudFormation

Choose one of three deployment options :

• Single Gateway into new VPC
• Single Gateway into existing VPC
• Auto-Scaling group into existing VPC

VPC Network Configuration

• Availability Zone
• VPC CIDR
• Public Subnet CIDR
• Private Subnet CIDR

EC2 Instance Configuration

• Gateway Name
• Gateway Instance type
• Key name
• Auto Assign Public IP
• Enable AWS Instance Connect

Check Point Settings

• Gateway’s Password hash
• Infinity Next Agent Token
• Fog Address (optional)

Advanced Settings

• Gateway Hostname (Optional)
• Bootstrap Script (Optional)

Auto Scaling Group Settings

• Type of the Load Balancer
• Scheme of the Load Balancer
• Initial number of gateways
• Maximum number of gateways
• Bootstrap script (Optional)
• Administrator email address (Optional)

Creating the stack in AWS takes about 6-8 minutes. When the CloudGuard WAF EC2 loads it will automatically connect to Check Point, register using the token you provided and fetch your policy. If successful, you will see a green notification bar in this portal with a message that your Agent/Gateway successfully connected.

Troubleshooting Tips

• After launching the CloudFormation, you can monitor AWS resources creation progress in AWS console under the 'Resources' tab of the deployed parent and nested stacks.
• Verify that you entered the correct Token taken from the profile page. Otherwise your AppSec Gateway will not be able to connect to Check Point cloud.