> Source: [sk159333](https://support.checkpoint.com/results/sk/sk159333)

# sk159333 - Can Check Point CloudGuard IaaS secure access to Azure Service Endpoints?

| Property | Value |
|----------|-------|
| Solution ID | sk159333 |
| Date Created | 2019-07-29 |
| Last Modified | 2019-07-30 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |
| Platform | Azure |

## Solution

Azure Service Endpoints in CloudGuard HA, Cluster, and Virtual Machine Scale Sets (VMSS)
----------------------------------------------------------------------------------------

### **Background**

Azure Service Endpoints allow Azure customers to keep data private, even if it is hosted in Platform-as-a-Service (PaaS) like Cosmos, SQL, etc.

Service Endpoints are described [here](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview). They allow VMs in the customer VNet (private address space) to access supported Azure PaaS services without traversing the Internet.

Service Endpoints are usually enabled on the spoke VNets and subnets, close to the compute VMs. However, this means that the traffic does not pass through Check Point CloudGuard, which might be a requirement for compliance, regulations, visibility, inspection of traffic, or controlling access to specific PaaS services from specific VMs.

This can be achieved by deploying a Check Point CloudGuard IaaS solution in the environment, be it a single VNet, or a more complex hub and spoke topology.

If Service Endpoints are already in use by the VMs, they will need to be disabled in their current location during any cutover.

The procedure is almost entirely based around Azure. The only steps for Check Point are to add a rule accepting the traffic, and to verify that hide-NAT is configured.

### **Procedure**

1. Enable Service Endpoints on the external (public) subnet for the CloudGuard Gateways.

2. Verify that the backend resources have their IP's hide-NAT as they pass through the Gateways. (This should already be in place.)

3. Add a rule for the traffic and install the policy, for example:

![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk159333/2019-07-29 13_45_56-SmartConsole (521907290602.236.143.98).png)

This rule is fully dynamic. The CloudGuard Controller identifies the IP addresses of the VMs that have a tag defined as **PaaS-CosmosDB=true** and permits these as the source. Using [Updateable Objects](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk131852), the rulebase learns the IP ranges of the PaaS services, and allows access to Azure CosmosDB in North-Europe and West-Europe regions only.

4. On the PaaS configuration, enforce security in the "Firewall and virtual networks" blade to allow access from the new VNets or subnets through the Check Point Gateways.

5. For an existing user of Service Endpoints: Disable Service Endpoints on the existing VNets / subnets. Traffic should now flow through Check Point CloudGuard and you should see traffic being logged. Once this is working, disable access from the old VNets/subnets so that the only way to access Service Endpoints is through Check Point Gateways. **Step # 5 might cause a small amount of downtime as your PaaS / Service Endpoints configure themselves with their new settings**.

**Note**:

* For the moment, only NAT-hide works; it is not possible to use NAT-static on this traffic.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content