VMware

Overview

If you are deploying a CloudGuard WAF AppSec Gateway to protect an existing production website, we recommend you also read the HOW-TO guide for this particular deployment.

CloudGuard WAF can be deployed as either a single virtual machine or several virtual machines in VMware vSphere. It acts as a reverse proxy where before / after you can deploy load balancer.

Installation

Follow these steps to deploy CloudGuard WAF in VMware vSphere 6.5 and above:

Minimal configuration for CloudGuard WAF VM is: 2*vCPU, 4GB RAM, 50GB Disk

Recommended configuration for CloudGuard WAF VM is: 4*vCPU, 8GB RAM, 50GB Disk

Step 1: Download the CloudGuard WAF installation package for VMware

Download the software archive and extract the files from here:

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=128551

The file will be a zipped file with the prefix "Check_Point_CloudGuard_Infinity_Next_Gateway_V*". Unzip it to extract the included 4 files (a vmdk file, an ovf file, an mf file and a cert file).

Step 2: Launch vSphere Web Client

Open a Web browser and enter the URL of your vCenter's vSphere Web Client e.g: https://{vcenter_server_ip_address_or_fqdn}/vsphere-client

Step 3: Deploy OVF Template

Go to either the Hosts and Clusters or VMs and Templates tab and right-click on the data center to deploy the VM in.

Click Deploy OVF Template.
Go to Local file and select the four extracted files.

Step 4: Complete the necessary details of the OVF deployment forms

Click Next until you get to Review details where you can find details about the certificate, product version, and more. Click Next again once you have reviewed them.

Select storage, network, and customize the template options as you wish.
- Select storage - allows changing the VM Storage Policy such as the virtual disk format (thin or thick provisioning) and selecting the exact storage volume to use. Make sure you have at least X free size of storage for CloudGuard WAF's AppSec Gateway.
- Select networks - The network chosen for the VM must include internet connectivity to Check Point's cloud network. If needed it will be possible later to create more than the single interface that is automatically configured.
- Customize template - There are several required fields to fill before clicking "Next":

Hostname - a valid linux hostname (e.g. no spaces).
Default Gateway Address
Admin password - set the password used by the user 'admin' when connecting via terminal, ssh, or web portal.
IP address & subnet - A valid routable IP address and subnet of the main interface for this VM.
Primary DNS - The address of the DNS server to be used by the CloudGuard WAF AppSec Gateway.
(Usually not required) Proxy Configuration - This is for the less common case where internet access from the CloudGuard WAF VM can only go through a main proxy server.

(Not required) NTP Server Configuration - If you want the time configuration for this machine to use an NTP server such as ntp.checkpoint.com or an NTP server for your organization.
Infinity Next Agent Token - Required to be added twice. The token copied from the profile.
The form allows an advanced administrator to add their own custom configuration commands to run automatically at the end of the deployment operation. Those commands can be Linux commands or Gaia Clish commands:
1. (Not required) Additional Clish Commands - The commands must be encoded in Base64. You can optionally add any additional configuration commands using the Check Point Gaia Clish commands if relevant to your network. The method to do it is as follows:
  1. Prepare a file in a Linux environment with the Clish command/s you wish to run. (If the file was originally created in Windows, copy it to Linux and run dos2unix on it before continuing to the next step)
  2. Run the following command: cat <filename> | base64 -w 0
  3. The output of this command should be copied and pasted into the "Additional Clish Commands" box in the "Customize Template" form.
2. (Not Required) Advanced Configuration Settings - The commands must be encoded in Base64. You can optionally add any additional Linux bash configuration commands. The method to do it is as follows (the same as with Clish commands):
  1. Prepare a file in a Linux environment with the Linux command/s you wish to run. (If the file was originally created in Windows, copy it to Linux and run dos2unix on it before continuing to the next step)
  2. Run the following command: cat <filename> | base64 -w 0
  3. The output of this command should be copied and pasted into the "Advanced Configuration Settings" box in the "Customize Template" form.

Make sure you obtain the <token> from the Enforcement Profile page, Authentication section.

Click Next and then Finish. The deployment starts.
Power on the new VM that was created.

To access the Cloud, the Gateway requires access to DNS and to the Internet in port 443. If you wish to limit access to specific IPs or URL, a list of Check Point operated regional public Fogs can be found in the management portal, under Support->FAQ

Step 5: Power on the newly created VM

Locate the newly created machine on the VCenter, right click the object and select "Power On".

After a few minutes, the CloudGuard WAF AppSec Gateway will connect to the CloudGuard WAF Management portal and you will be able to view its details on the Cloud->Agents view.

It is recommended that Time Zone will be configured using the networking administration portal of the newly created CloudGuard WAF AppSec Gateway.

For advanced networking configurations as well as time zone configuration:

pageConfigure networking in VMware Deployments