VMware
If you are deploying an AppSec Gateway to protect an existing production website, we recommend you also read the HOW-TO guide for this particular deployment.
CloudGuard AppSec can be deployed as either a single virtual machine or several virtual machines in VMware vSphere. It acts as a reverse proxy where before / after you can deploy load balancer.
Follow these steps to deploy CloudGuard AppSec in VMware vSphere 6.5 and above:
Minimal configuration for CloudGuard AppSec VM is: 2*vCPU, 4GB RAM, 50GB Disk
Recommended configuration for CloudGuard AppSec VM is: 4*vCPU, 8GB RAM, 50GB Disk
Download the software archive and extract the files from here: https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=109168
The file will be a zipped file with the prefix "Check_Point_CloudGuard_Infinity_Next_Gateway_V*". Unzip it to extract the included 4 files (a vmdk file, an ovf file, an mf file and a cert file).
Open a Web browser and enter the URL of your vCenter's vSphere Web Client e.g:
https://{vcenter_server_ip_address_or_fqdn}/vsphere-client
- Go to either the Hosts and Clusters or VMs and Templates tab and right-click on the data center to deploy the VM in.
- Click Deploy OVF Template.
- Go to Local file and select the four extracted files.
- Click Next until you get to Review details where you can find details about the certificate, product version, and more. Click Next again once you have reviewed them.
- Select storage, network, and customize the template options as you wish.
- Select storage - allows changing the VM Storage Policy such as the virtual disk format (thin or thick provisioning) and selecting the exact storage volume to use. Make sure you have at least X free size of storage for CloudGuard AppSec Gateway.
- Select networks - The network chosen for the VM must include internet connectivity to Check Point's cloud network. If needed it will be possible later to create more than the single interface that is automatically configured.
- Customize template - There are several required fields to fill before clicking "Next":
- 1.Hostname - a valid linux hostname (e.g. no spaces).
- 2.Default Gateway Address
- 3.Admin password for the networking interface after deployment.
- 4.IP address & subnet - A valid routable IP address and subnet of the main interface for this VM.
- 5.Primary DNS - The address of the DNS server to be used by the AppSec Gateway.
- 6.(Usually not required) Proxy Configuration - This is for the less common case where internet access from the CloudGuard AppSec VM can only go through a main proxy server.
- 1.(Not required) NTP Server Configuration - If you want the time configuration for this machine to use an NTP server such as ntp.checkpoint.com or an NTP server for your organization.
- 2.Infinity Next Agent Token - Required to be added twice. The token copied from the profile.
- Click Next and then Finish. The deployment starts.
- Power on the new VM that was created.
To access the Cloud, the Gateway requires access to DNS and to the Internet in port 443. If you wish to limit access to specific IPs or URL, a list of Check Point operated regional public Fogs can be found in the management portal, under Support->FAQ
Locate the newly created machine on the VCenter, right click the object and select "Power On".
After a few minutes, the AppSec Gateway will connect to the CloudGuard AppSec Management portal and you will be able to view its details on the Cloud->Agents view.
It is recommended that Time Zone will be configured using the networking administration portal of the newly created AppSec Gateway.
For advanced networking configurations as well as time zone configuration:
Last modified 4mo ago