## Overview

If you are deploying a CloudGuard WAF Gateway to protect an existing production website, we recommend you also read the [HOW-TO guide for this particular deployment](https://waf-doc.inext.checkpoint.com/how-to/protect-an-existing-production-site-with-cloudguard-wafs-gateway).

CloudGuard WAF can be deployed as either a single virtual machine or several virtual machines in VMware vSphere. It acts as a reverse proxy where before / after you can deploy load balancer.

## Installation

Follow these steps to deploy CloudGuard WAF in **VMware vSphere 6.5** and above:

**Minimal configuration for CloudGuard WAF VM is:** 2*vCPU, 4GB RAM, 50GB Disk

**Recommended configuration for CloudGuard WAF VM is:** 4*vCPU, 8GB RAM, 50GB Disk

#### Step 1: Download the CloudGuard WAF installation package for VMware

Download the software archive and extract the files from here:

[https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=128551](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=128551)

The file will be a zipped file with the prefix " **Check_Point_CloudGuard_Infinity_Next_Gateway_V**\*. Unzip it to extract the included 4 files (a **vmdk** file, an **ovf** file, an **mf** file and a **cert** file).

#### Step 2: Launch vSphere Web Client

Open a Web browser and enter the URL of your vCenter's vSphere Web Client e.g:
https://{vcenter_server_ip_address_or_fqdn}/vsphere-client

#### Step 3: Deploy OVF Template

- Go to either the **Hosts and Clusters** or **VMs and Templates** tab and right-click on the data center to deploy the VM in.

- Click Deploy OVF Template.
- Go to Local file and select the four extracted files.

#### Step 4: Complete the necessary details of the OVF deployment forms

- Click **Next** until you get to Review details where you can find details about the certificate, product version, and more. Click **Next** again once you have reviewed them.

- Select storage, network, and customize the template options as you wish.

- **Select storage** - allows changing the VM Storage Policy such as the virtual disk format (thin or thick provisioning) and selecting the exact storage volume to use.
    Make sure you have at least X free size of storage for CloudGuard WAF's Gateway.

- **Select networks** - The network chosen for the VM must include internet connectivity to Check Point's cloud network.

- **Customize template** - There are several required fields to fill before clicking "Next":

1. **Hostname** - a valid linux hostname (e.g. no spaces).
2. **Default Gateway Address**
3. **Admin password** - set the password used by the user 'admin' when connecting via terminal, ssh, or web portal.
4. **IP address & subnet** - A valid routable IP address and subnet of the main interface for this VM.
5. **Primary DNS** - The address of the DNS server to be used by the CloudGuard WAF Gateway.
6. **(Usually not required) Proxy Configuration** - This is for the less common case where internet access from the CloudGuard WAF VM can only go through a main proxy server.

1. **(Not required) NTP Server Configuration** - If you want the time configuration for this machine to use an NTP server such as ntp.checkpoint.com or an NTP server for your organization.
2. **Infinity Next Agent Token** - Required to be added twice. The token copied from the WAF Gateway profile.
3. The form allows an advanced administrator to add their own custom configuration commands to run automatically at the end of the deployment operation.

1. **(Not required) Additional Clish Commands** - The commands must be encoded in Base64. You can optionally add any additional configuration commands using the [Check Point Gaia Clish commands](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/Gaia-Clish-Commands.htm) if relevant to your network.

2. **(Not Required) Advanced Configuration Settings** - The commands must be encoded in Base64. You can optionally add any additional Linux bash configuration commands.

Make sure you obtain the <token> from the [Enforcement **Profile**](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point) page, **Authentication** section.

- Click **Next** and then **Finish**. The deployment starts.

- Power on the new VM that was created.

To access the Cloud, the Gateway requires access to DNS and to the Internet in port 443. If you wish to limit access to specific IPs or URL, a list of Check Point operated regional public Fogs can be found in the management portal, under **Support->FAQ**.

#### Step 5: Power on the newly created VM

Locate the newly created machine on the VCenter, right click the object and select " **Power On**".

After a few minutes, the CloudGuard WAF Gateway will connect to the CloudGuard WAF Management portal and you will be able to view its details on the **Policy->Agents** view.

It is recommended that Time Zone will be configured using the networking administration portal of the newly created CloudGuard WAF Gateway.

For advanced networking configurations as well as time zone configuration:

[Configure networking in VMware Deployments](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/gateway-virtual-machine/vmware/configure-networking-in-vmware-deployments)

#### Step 6 (optional): Store certificates

[Store Certificates on Gateway](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point/gateway-virtual-machine/azure/store-certificates-on-gateway)