This Terraform module deploys Check Point CloudGuard IaaS High Availability solution into a new Vnet in Azure. As part of the deployment the following resources are created:

• Resource group
• Virtual network
• Network security group
• System assigned identity
• Availability Set - conditional creation

For additional information, please see the CloudGuard Network for Azure High Availability Cluster Deployment Guide

This solution uses the following modules:

• /terraform/azure/modules/common - used for creating a resource group and defining common variables.
• /terraform/azure/modules/vnet - used for creating new virtual network and subnets.
• /terraform/azure/modules/network-security-group - used for creating new network security groups and rules.

• Install and configure Terraform to provision Azure resources: Configure Terraform for Azure
• In order to use ssh connection to VMs, it is required to add a public key to the /terraform/azure/high-availability-new-vnet/azure_public_key file.

• Choose the preferred login method to Azure in order to deploy the solution:
  1. Using Service Principal:

  • Create a Service Principal (or use the existing one)

  • Grant the Service Principal at least "Managed Application Contributor", "Storage Account Contributor", "Network Contributor", "Virtual Machine Contributor", "User Access Administrator" permissions to the Azure subscription
    

  • The Service Principal credentials can be stored either in the terraform.tfvars or as Environment Variables
    

    In case the Environment Variables are used, perform modifications described below:
    

    a. The next lines in the main.tf file, in the provider azurerm resource, need to be deleted or commented:

          provider "azurerm" {
           
          //  subscription_id = var.subscription_id
          //  client_id = var.client_id
          //  client_secret = var.client_secret
          //  tenant_id = var.tenant_id
          
             features {}
          }
    

    b. In the terraform.tfvars file leave empty double quotes for client_secret, client_id , tenant_id and subscription_id variables:

          client_secret                   = ""
          client_id                       = ""
          tenant_id                       = ""
          subscription_id                 = "" 
    

  
  2. Using az commands from a command-line:

  • Run az login command

  • Sign in with your account credentials in the browser

  • Accept Azure Marketplace image terms by running:
    az vm image terms accept --urn publisher:offer:sku:version, where:

    • publisher = checkpoint;
    • offer = vm_os_offer (see accepted values in the table below);
    • sku = vm_os_sku (see accepted values in the table below);
    • version = latest
      
      Example:
      az vm image terms accept --urn checkpoint:check-point-cg-r8040:sg-byol:latest

  • In the terraform.tfvars file leave empty double quotes for client_secret, client_id and tenant_id variables.

• Fill all variables in the /terraform/azure/high-availability-new-vnet/terraform.tfvars file with proper values (see below for variables descriptions).

• From a command line initialize the Terraform configuration directory:

    terraform init
  

• Create an execution plan:

    terraform plan
  

• Create or modify the deployment:

    terraform apply
  

• To deploy the solution based on Azure Availability Set and create a new Availability Set for the virtual machines:

availability_type = "Availability Set"

Otherwise, to deploy the solution based on Azure Availability Zone:

availability_type = "Availability Zone"

• To enable CloudGuard metrics in order to send statuses and statistics collected from HA instances to the Azure Monitor service:

enable_custom_metrics = true

• To create new public IP prefix for the public IP:

  use_public_ip_prefix            = true
  create_public_ip_prefix         = true
  

• To use an exisiting public IP prefix for the public IP:

  use_public_ip_prefix            = true
  create_public_ip_prefix         = false
  existing_public_ip_prefix_id    = "public IP prefix resource id"
  

client_secret                   = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
client_id                       = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
tenant_id                       = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
subscription_id                 = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
source_image_vhd_uri            = "noCustomUri"
resource_group_name             = "checkpoint-ha-terraform"
cluster_name                    = "checkpoint-ha-terraform"
location                        = "eastus"
vnet_name                       = "checkpoint-ha-vnet"
address_space                   = "10.0.0.0/16"
subnet_prefixes                 = ["10.0.1.0/24","10.0.2.0/24"]
admin_password                  = "xxxxxxxxxxxx"
smart_1_cloud_token_a           = "xxxxxxxxxxxx"
smart_1_cloud_token_b           = "xxxxxxxxxxxx"
sic_key                         = "xxxxxxxxxxxx"
vm_size                         = "Standard_D3_v2"
disk_size                       = "110"
vm_os_sku                       = "sg-byol"
vm_os_offer                     = "check-point-cg-r8110"
os_version                      = "R8110"
bootstrap_script                = "touch /home/admin/bootstrap.txt; echo 'hello_world' > /home/admin/bootstrap.txt"
allow_upload_download           = true
authentication_type             = "Password"
availability_type               = "Availability Zone"
enable_custom_metrics           = true
enable_floating_ip              = false
use_public_ip_prefix            = false
create_public_ip_prefix         = false
existing_public_ip_prefix_id    = ""
admin_shell                     = "/etc/cli.sh"
serial_console_password_hash    = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
maintenance_mode_password_hash  = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

In order to check the template version refer to the sk116585

See the LICENSE file for details