Skip to content

Commit 4d149d8

Browse files
chkp-nimrodgabchkp-noamerez
chkp-nimrodgab
authored and
chkp-noamerez
committed
feat(VSECPC-12074): Added support for AWS Local Zones
1 parent 2bd4085 commit 4d149d8

4 files changed

Lines changed: 101 additions & 25 deletions

File tree

‎aws/templates/cluster/cluster-master.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
AWSTemplateFormatVersion: 2010-09-09
33
Description: |
4-
Deploy a Check Point Cluster in a new VPC (20260302).
4+
Deploy a Check Point Cluster in a new VPC (20260407).
55
See CloudGuard Network for AWS Single Availability Zone Cluster Deployment guide for detailed deployment and configuration steps.
66
Metadata:
77
AWS::CloudFormation::Interface:

‎aws/templates/cluster/cluster.yaml‎

Lines changed: 96 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,68 @@
11
---
22
AWSTemplateFormatVersion: 2010-09-09
33
Description: |
4-
Deploys a Check Point Cluster into an existing VPC (20260302).
4+
Deploys a Check Point Cluster into an existing VPC (20260407).
55
See CloudGuard Network for AWS Single Availability Zone Cluster Deployment guide for detailed deployment and configuration steps.
6+
Mappings:
7+
# Maps Local Zone AZ names to their NetworkBorderGroup.
8+
# The NBG is the AZ name with the trailing AZ letter removed (e.g. ap-southeast-2-per-1a -> ap-southeast-2-per-1).
9+
# Add new Local Zone AZs here as needed.
10+
LocalZoneNetworkBorderGroups:
11+
# Australia
12+
ap-southeast-2-per-1a:
13+
NBG: ap-southeast-2-per-1
14+
# US East 1 Local Zones
15+
us-east-1-atl-1a:
16+
NBG: us-east-1-atl-1
17+
us-east-1-bos-1a:
18+
NBG: us-east-1-bos-1
19+
us-east-1-chi-1a:
20+
NBG: us-east-1-chi-1
21+
us-east-1-dfw-1a:
22+
NBG: us-east-1-dfw-1
23+
us-east-1-iah-1a:
24+
NBG: us-east-1-iah-1
25+
us-east-1-mci-1a:
26+
NBG: us-east-1-mci-1
27+
us-east-1-mia-1a:
28+
NBG: us-east-1-mia-1
29+
us-east-1-msp-1a:
30+
NBG: us-east-1-msp-1
31+
us-east-1-nyc-1a:
32+
NBG: us-east-1-nyc-1
33+
us-east-1-phl-1a:
34+
NBG: us-east-1-phl-1
35+
# US West 2 Local Zones
36+
us-west-2-den-1a:
37+
NBG: us-west-2-den-1
38+
us-west-2-las-1a:
39+
NBG: us-west-2-las-1
40+
us-west-2-lax-1a:
41+
NBG: us-west-2-lax-1
42+
us-west-2-lax-1b:
43+
NBG: us-west-2-lax-1
44+
us-west-2-phx-1a:
45+
NBG: us-west-2-phx-1
46+
us-west-2-sea-1a:
47+
NBG: us-west-2-sea-1
48+
# EU Local Zones
49+
eu-central-1-ham-1a:
50+
NBG: eu-central-1-ham-1
51+
eu-central-1-waw-1a:
52+
NBG: eu-central-1-waw-1
53+
eu-west-2-man-1a:
54+
NBG: eu-west-2-man-1
55+
# AP Local Zones
56+
ap-northeast-1-tpe-1a:
57+
NBG: ap-northeast-1-tpe-1
58+
ap-northeast-2-sel-1a:
59+
NBG: ap-northeast-2-sel-1
60+
ap-southeast-1-kul-1a:
61+
NBG: ap-southeast-1-kul-1
62+
ap-southeast-1-sin-1a:
63+
NBG: ap-southeast-1-sin-1
64+
ap-southeast-4-mel-1a:
65+
NBG: ap-southeast-4-mel-1
666
Metadata:
767
AWS::CloudFormation::Interface:
868
ParameterGroups:
@@ -643,15 +703,22 @@ Resources:
643703
- Key: x-chkp-member-ips
644704
Value: !Join
645705
- ':'
646-
- [!Join ['=', ['public-ip', !If [AllocateAddress, !Ref MemberAPublicAddress, '']]],
647-
!Join ['=', ['external-private-ip', !GetAtt MemberAExternalInterface.PrimaryPrivateIpAddress]],
648-
!Join ['=', ['internal-private-ip', !GetAtt MemberAInternalInterface.PrimaryPrivateIpAddress]]]
706+
- - !Join ['=', ['public-ip', !If [AllocateAddress, !If [IsLocalZone, !Ref MemberAPublicAddressLocalZone, !Ref MemberAPublicAddressRegional], '']]]
707+
- !Join ['=', ['external-private-ip', !GetAtt MemberAExternalInterface.PrimaryPrivateIpAddress]]
708+
- !Join ['=', ['internal-private-ip', !GetAtt MemberAInternalInterface.PrimaryPrivateIpAddress]]
649709
- Key: x-chkp-cluster-ips
650-
Value: !Join
651-
- ':'
652-
- [!Join ['=', ['cluster-ip', !Ref ClusterPublicAddress]],
653-
!Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]],
654-
!Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]]
710+
Value: !If
711+
- AllocateAddress
712+
- !Join
713+
- ':'
714+
- - !Join ['=', ['cluster-ip', !If [IsLocalZone, !Ref ClusterPublicAddressLocalZone, !Ref ClusterPublicAddressRegional]]]
715+
- !Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]]
716+
- !Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]
717+
- !Join
718+
- ':'
719+
- - !Join ['=', ['cluster-ip', '']]
720+
- !Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]]
721+
- !Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]
655722
MemberBInstance:
656723
Type: AWS::EC2::Instance
657724
Properties:
@@ -665,15 +732,22 @@ Resources:
665732
- Key: x-chkp-member-ips
666733
Value: !Join
667734
- ':'
668-
- [!Join ['=', ['public-ip', !If [AllocateAddress, !Ref MemberBPublicAddress, '']]],
669-
!Join ['=', ['external-private-ip', !GetAtt MemberBExternalInterface.PrimaryPrivateIpAddress]],
670-
!Join ['=', ['internal-private-ip', !GetAtt MemberBInternalInterface.PrimaryPrivateIpAddress]]]
735+
- - !Join ['=', ['public-ip', !If [AllocateAddress, !If [IsLocalZone, !Ref MemberBPublicAddressLocalZone, !Ref MemberBPublicAddressRegional], '']]]
736+
- !Join ['=', ['external-private-ip', !GetAtt MemberBExternalInterface.PrimaryPrivateIpAddress]]
737+
- !Join ['=', ['internal-private-ip', !GetAtt MemberBInternalInterface.PrimaryPrivateIpAddress]]
671738
- Key: x-chkp-cluster-ips
672-
Value: !Join
673-
- ':'
674-
- [!Join ['=', ['cluster-ip', !Ref ClusterPublicAddress]],
675-
!Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]],
676-
!Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]]
739+
Value: !If
740+
- AllocateAddress
741+
- !Join
742+
- ':'
743+
- - !Join ['=', ['cluster-ip', !If [IsLocalZone, !Ref ClusterPublicAddressLocalZone, !Ref ClusterPublicAddressRegional]]]
744+
- !Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]]
745+
- !Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]
746+
- !Join
747+
- ':'
748+
- - !Join ['=', ['cluster-ip', '']]
749+
- !Join ['=', ['cluster-eth0-private-ip', !Select [0, !GetAtt MemberAExternalInterface.SecondaryPrivateIpAddresses]]]
750+
- !Join ['=', ['cluster-eth1-private-ip', !Select [0, !GetAtt MemberAInternalInterface.SecondaryPrivateIpAddresses]]]
677751
MemberAGatewayLaunchTemplate:
678752
Type: AWS::EC2::LaunchTemplate
679753
Properties:
@@ -707,14 +781,15 @@ Resources:
707781
- ' - |'
708782
- ' set -e'
709783
- !Sub ' admin_shell=${Shell} ; allow_info=${AllowUploadDownload} ; cw=${CloudWatch} ; eic=${EnableInstanceConnect} ; ntp1=${NTPPrimary} ; ntp2=${NTPSecondary} ; tokenA=''${MemberAToken}'''
784+
# Removed wait_handle reference as ClusterReadyHandle resource is no longer present
710785
- !If [EmptyHostName, ' hostname=""', !Sub ' hostname=${GatewayHostname}-member-a']
711-
- !Join ['', [' eip="', !If [AllocateAddress, !Ref MemberAPublicAddress, ''], '"']]
786+
- !Join ['', [' eip="', !If [AllocateAddress, !If [IsLocalZone, !Ref MemberAPublicAddressLocalZone, !Ref MemberAPublicAddressRegional], ''], '"']]
712787
- !Join ['', [' sic="$(echo ', 'Fn::Base64': !Ref GatewaySICKey, ')"']]
713788
- !Join ['', [' pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayPasswordHash, ')"']]
714789
- !Join ['', [' maintenance_pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayMaintenancePasswordHash, ')"']]
715790
- !Join ['', [' bootstrap="$(echo ', 'Fn::Base64': !Ref GatewayBootstrapScript, ')"']]
716791
- !Sub [' version=${Version}', {Version: !Select [0, !Split ['-', !Ref GatewayVersion]]}]
717-
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${tokenA}\"" installationType=\"cluster\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260302\" templateName=\"cluster\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" elasticIp=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
792+
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${tokenA}\"" installationType=\"cluster\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260407\" templateName=\"cluster\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" elasticIp=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
718793
VersionDescription: Initial template version
719794
MemberBGatewayLaunchTemplate:
720795
Type: AWS::EC2::LaunchTemplate
@@ -750,13 +825,13 @@ Resources:
750825
- ' set -e'
751826
- !Sub ' admin_shell=${Shell} ; allow_info=${AllowUploadDownload} ; cw=${CloudWatch} ; eic=${EnableInstanceConnect} ; ntp1=${NTPPrimary} ; ntp2=${NTPSecondary} ; tokenB=''${MemberBToken}'''
752827
- !If [EmptyHostName, ' hostname=""', !Sub ' hostname=${GatewayHostname}-member-b']
753-
- !Join ['', [' eip="', !If [AllocateAddress, !Ref MemberBPublicAddress, ''], '"']]
828+
- !Join ['', [' eip="', !If [AllocateAddress, !If [IsLocalZone, !Ref MemberBPublicAddressLocalZone, !Ref MemberBPublicAddressRegional], ''], '"']]
754829
- !Join ['', [' sic="$(echo ', 'Fn::Base64': !Ref GatewaySICKey, ')"']]
755830
- !Join ['', [' pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayPasswordHash, ')"']]
756831
- !Join ['', [' maintenance_pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayMaintenancePasswordHash, ')"']]
757832
- !Join ['', [' bootstrap="$(echo ', 'Fn::Base64': !Ref GatewayBootstrapScript, ')"']]
758833
- !Sub [' version=${Version}', {Version: !Select [0, !Split ['-', !Ref GatewayVersion]]}]
759-
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${tokenB}\"" installationType=\"cluster\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260302\" templateName=\"cluster\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" elasticIp=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
834+
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${tokenB}\"" installationType=\"cluster\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260407\" templateName=\"cluster\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" elasticIp=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
760835
VersionDescription: Initial template version
761836
ClusterPublicAddressLocalZone:
762837
Type: AWS::EC2::EIP

‎aws/templates/single-gw/gateway-master.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
AWSTemplateFormatVersion: 2010-09-09
33
Description: |
4-
Deploys a Check Point Security Gateway into a new VPC (20260302)
4+
Deploys a Check Point Security Gateway into a new VPC (20260407)
55
See sk175207 for Gateway administration guide deployment and configuration steps.
66
Metadata:
77
AWS::CloudFormation::Interface:

‎aws/templates/single-gw/gateway.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
AWSTemplateFormatVersion: 2010-09-09
33
Description: |
4-
Deploys a Check Point Security Gateway into an existing VPC (20260216)
4+
Deploys a Check Point Security Gateway into an existing VPC (20260407)
55
See sk175207 for Gateway administration guide deployment and configuration steps.
66
Mappings:
77
# Maps Local Zone AZ names to their NetworkBorderGroup.
@@ -786,12 +786,13 @@ Resources:
786786
- IsIPv6Enabled
787787
- !If [IsIPv4Enabled, " template_name=\"gateway_dual_stack\"", " template_name=\"gateway_ipv6\""]
788788
- " template_name=\"gateway\""
789+
- !Sub ' eip=${AllocatePublicAddress}'
789790
- !Join ['', [' sic="$(echo ', 'Fn::Base64': !Ref GatewaySICKey, ')"']]
790791
- !Join ['', [' pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayPasswordHash, ')"']]
791792
- !Join ['', [' maintenance_pwd_hash="$(echo ', 'Fn::Base64': !Ref GatewayMaintenancePasswordHash, ')"']]
792793
- !Join ['', [' bootstrap="$(echo ', 'Fn::Base64': !Ref GatewayBootstrapScript, ')"']]
793794
- !Sub [' version=${Version}', {Version: !Select [0, !Split ['-', !Ref GatewayVersion]]}]
794-
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${token}\"" installationType=\"gateway\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260302\" templateName=\"${template_name}\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" allocatePublicAddress=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
795+
- ' python3 /etc/cloud_config.py enableCloudWatch=\"${cw}\" sicKey=\"${sic}\" "smart1CloudToken=\"${token}\"" installationType=\"gateway\" osVersion=\"${version}\" allowUploadDownload=\"${allow_info}\" templateVersion=\"20260407\" templateName=\"${template_name}\" shell=\"${admin_shell}\" enableInstanceConnect=\"${eic}\" hostName=\"${hostname}\" ntpPrimary=\"${ntp1}\" ntpSecondary=\"${ntp2}\" passwordHash=\"${pwd_hash}\" MaintenanceModePassword=\"${maintenance_pwd_hash}\" allocatePublicAddress=\"${eip}\" bootstrapScript64=\"${bootstrap}\"'
795796
VersionDescription: Initial template version
796797
PublicAddressLocalZone:
797798
Type: AWS::EC2::EIP

0 commit comments

Comments
 (0)