VMware | Check Point WAF
Overview
If you are deploying a CloudGuard WAF Gateway to protect an existing production website, we recommend you also read the HOW-TO guide for this particular deployment.
CloudGuard WAF can be deployed as either a single virtual machine or several virtual machines in VMware vSphere. It acts as a reverse proxy where before / after you can deploy load balancer.
Installation
Follow these steps to deploy CloudGuard WAF in VMware vSphere 6.5 and above:
Minimal configuration for CloudGuard WAF VM is: 2*vCPU, 4GB RAM, 50GB Disk
Recommended configuration for CloudGuard WAF VM is: 4*vCPU, 8GB RAM, 50GB Disk
Step 1: Download the CloudGuard WAF installation package for VMware
Download the software archive and extract the files from here:
The file will be a zipped file with the prefix " Check_Point_CloudGuard_Infinity_Next_Gateway_V*. Unzip it to extract the included 4 files (a vmdk file, an ovf file, an mf file and a cert file).
Step 2: Launch vSphere Web Client
Open a Web browser and enter the URL of your vCenter's vSphere Web Client e.g: https://{vcenter_server_ip_address_or_fqdn}/vsphere-client
Step 3: Deploy OVF Template
Go to either the Hosts and Clusters or VMs and Templates tab and right-click on the data center to deploy the VM in.
Click Deploy OVF Template.
Go to Local file and select the four extracted files.
Step 4: Complete the necessary details of the OVF deployment forms
Click Next until you get to Review details where you can find details about the certificate, product version, and more. Click Next again once you have reviewed them.
Select storage, network, and customize the template options as you wish.
Select storage - allows changing the VM Storage Policy such as the virtual disk format (thin or thick provisioning) and selecting the exact storage volume to use. Make sure you have at least X free size of storage for CloudGuard WAF's Gateway.
Select networks - The network chosen for the VM must include internet connectivity to Check Point's cloud network.
Customize template - There are several required fields to fill before clicking "Next":
Hostname - a valid linux hostname (e.g. no spaces).
Default Gateway Address
Admin password - set the password used by the user 'admin' when connecting via terminal, ssh, or web portal.
IP address & subnet - A valid routable IP address and subnet of the main interface for this VM.
Primary DNS - The address of the DNS server to be used by the CloudGuard WAF Gateway.
(Usually not required) Proxy Configuration - This is for the less common case where internet access from the CloudGuard WAF VM can only go through a main proxy server.
(Not required) NTP Server Configuration - If you want the time configuration for this machine to use an NTP server such as ntp.checkpoint.com or an NTP server for your organization.
Infinity Next Agent Token - Required to be added twice. The token copied from the WAF Gateway profile.
The form allows an advanced administrator to add their own custom configuration commands to run automatically at the end of the deployment operation.
(Not required) Additional Clish Commands - The commands must be encoded in Base64. You can optionally add any additional configuration commands using the Check Point Gaia Clish commands if relevant to your network.
(Not Required) Advanced Configuration Settings - The commands must be encoded in Base64. You can optionally add any additional Linux bash configuration commands.
Make sure you obtain the
Click Next and then Finish. The deployment starts.
Power on the new VM that was created.
To access the Cloud, the Gateway requires access to DNS and to the Internet in port 443. If you wish to limit access to specific IPs or URL, a list of Check Point operated regional public Fogs can be found in the management portal, under Support->FAQ.
Step 5: Power on the newly created VM
Locate the newly created machine on the VCenter, right click the object and select " Power On".
After a few minutes, the CloudGuard WAF Gateway will connect to the CloudGuard WAF Management portal and you will be able to view its details on the Policy->Agents view.
It is recommended that Time Zone will be configured using the networking administration portal of the newly created CloudGuard WAF Gateway.
For advanced networking configurations as well as time zone configuration:
Configure networking in VMware Deployments