# Overview

If you are deploying a CloudGuard WAF AppSec Gateway to protect an existing production website, we recommend you also read the [HOW-TO guide for this particular deployment](https://waf-doc.inext.checkpoint.com/how-to/protect-an-existing-production-site-with-cloudguard-wafs-gateway).

CloudGuard WAF can be deployed as either a single virtual machine or Auto-Scaling Group in AWS. It acts as a reverse proxy where before / after you can deploy AWS Load Balancers:

When deploying an auto-scaling group, the external load balancer is deployed automatically.

## Installation

Follow these steps to deploy CloudGuard WAF in AWS using a supplied CloudFormation Template:

#### Step 1: AWS Console Log in  
Log in to **AWS Console** and select the relevant region.

#### Step 2: Activate CloudGuard WAF through the AWS Marketplace (Once per Region)  
Search for [CloudGuard WAF in AWS Marketplace](https://aws.amazon.com/marketplace/server/procurement?productId=d9ada83e-6d91-448f-8097-63a789504f5f). During activation, a form with a field to select one of the AWS regions, is shown. Select the region in which you wish to deploy CloudGuard WAF's Gateway.

#### Step 3: Verify required permissions  
Verify that you have the required **IAM permissions:**

- CloudFormation::DescribeStackEvents
- CloudFormation::DescribeStacks
- CloudFormation::ListStacks
- CloudFormation::ListStackResources
- CloudFormation::CreateStack
- elasticloadbalancing::DescribeLoadBalancers
- elasticloadbalancing::DescribeListeners
- elasticloadbalancing::DescribeTargetGroups
- elasticloadbalancing::CreateTargetGroup
- elasticloadbalancing::CreateListener
- elasticloadbalancing::CreateLoadBalancer
- elasticloadbalancing::ModifyTargetGroupAttributes
- elasticloadbalancing::ModifyLoadBalancerAttributes
- SNS::CreateTopic
- SNS::GetTopicAttributes
- SNS::Subscribe
- IAM::GetRolePolicy
- IAM::PutRolePolicy
- IAM::CreateInstanceProfile
- IAM::CreateRole
- IAM::AddRoleToInstanceProfile
- EC2::DescribeInternetGateways
- EC2::DescribeLaunchTemplates
- EC2::DescribeLaunchTemplateVersions
- EC2::DescribeKeyPairs
- EC2::DescribeSecurityGroups
- EC2::DescribeSubnets
- EC2::DescribeVpcs
- EC2::DescribeAccountAttributes
- EC2::CreateTags
- EC2::AuthorizeSecurityGroupIngress
- EC2::CreateLaunchTemplate
- EC2::CreateSecurityGroup
- EC2::RunInstances
- CloudWatch::PutMetricAlarm
- Health::DescribeEventAggregates

**If you want AutoScaling setup:**
- AutoScaling::UpdateAutoScalingGroup
- AutoScaling::CreateAutoScalingGroup
- AutoScaling::DescribeAutoScalingGroups
- AutoScaling::DescribeScalingActivities
- AutoScaling::PutScalingPolicy
- AutoScaling::PutNotificationConfiguration

**If you want to store certificates in AWS:**
- KMS::CreateGrant
- KMS::DescribeKey

#### Step 4: Deployment using CloudFormation  
Choose one of three deployment options :

- Single Gateway into new VPC
- Single Gateway into existing VPC
- Auto-Scaling group into existing VPC

#### VPC Network Configuration

- **Availability Zone** 
- **VPC CIDR** 
- **Public Subnet CIDR** 
- **Private Subnet CIDR**

**EC2 Instance Configuration**

- **Gateway Name** 
- **Gateway Instance type** 
- **Key name** 
- **Auto Assign Public IP** 
- **Enable AWS Instance Connect**

**Check Point Settings**

- **Gateway’s Password hash**  
- **Infinity Next Agent Token**  
- **Fog Address (optional)**

**Advanced Settings**

- **Gateway Hostname (Optional)**  
- **Bootstrap Script (Optional)**

**Auto Scaling Group Settings**

- **Type of the Load Balancer** 
- **Scheme of the Load Balancer** 
- **Initial number of gateways** 
- **Maximum number of gateways** 
- **Bootstrap script (Optional)** 
- **Administrator email address (Optional)**

Creating the stack in AWS takes about 6-8 minutes. When the CloudGuard WAF EC2 loads it will automatically connect to Check Point, register using the token you provided and fetch your policy. If successful, you will see a green notification bar in this portal with a message that your Agent/Gateway successfully connected.

**Troubleshooting Tips** 
- After launching the CloudFormation, you can monitor AWS resources creation progress in AWS console under the 'Resources' tab of the deployed parent and nested stacks.
- Verify that you entered the correct Token taken from the profile page. Otherwise your AppSec Gateway will not be able to connect to Check Point cloud.