> Source: [sk179850](https://support.checkpoint.com/results/sk/sk179850) # sk179850 - How to Connect and Secure your AWS VMware Cloud Software Defined Data Center | Property | Value | |----------|-------| | Solution ID | sk179850 | | Date Created | 2022-09-05 | | Last Modified | 2022-10-03 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R82.10, R81.20, R82 | | OS | Gaia | | Platform | AWS | ## Solution ### Overview This article provides the procedure to secure a VMware Cloud (VMC) Software Defined Data Center (SDDC) on the AWS Platform. The AWS architecture example is based on the Check Point best practices GWLB TGW design. It leverages a Transit Gateway to provide multi-VPC connectivity with inspection of traffic by Check Point Auto-scaling gateways, protecting Internet ingress traffic as well as Internet bound VPC sourced traffic, VPC to SDDC, SDDC to VPC and SDDC Internet egress traffic. ### Prerequisites * If you work with an existing Transit Gateway (TGW) configuration or plan to work with a second TGW, you must deploy the AWS before the VMC. * SDDCs must be at v1.11 or higher to connect to a TGW. * Members of SDDC groups and VPCs must be in the same region. * One end of each flow must be a SDDC. * Using a route-based VPN as backup for Direct Connect is not supported if you use VMware Transit Connect, and it must be disabled. * TGW can be managed under Resource Access Manager in customer AWS console, and logged in user should have administrator access to AWS services and resources to complete these tasks: * Access the AWS console and accept the shared resources. * Create VPC(s) attachments on the AWS console. * Additionally, accept VPC attachment in the VMware Cloud Service Platform (CSP). * The organization that owns the SDDC Group must own an SDDC. ### Reference Architecture #### AWS Initial Deployment: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk179850/CHKP-CGNS-GWLB-WorkshopArchitecture-VMC-cent-outbound-9-21202209210948161.drawio.png) This architecture leverages the following recommended GWLB TGW configuration: [https://github.com/CheckPointSW-Community/CloudGuard-NS-AWS-GWLB.](https://github.com/CheckPointSW-Community/CloudGuard-NS-AWS-GWLB) The gateway version is R80.40 BYOL and the Management is R81.10 BYOL. These are the steps, and they are detailed thereafter: 1. In VMC Create SDDC and Peer connect to the VPC 2. SDDC Add AWS External TGW Attachment * Configure Routing to Spokes 3. AWS Ingress via TGW to VMC Instance 4. Two TGW Architecture Several considerations to take into account: * If Internet Sourced traffic needs to be inspected and logged with the Original Source IP, place the SDDC in the Shared Services VPN - Subnets Sub01Spoke02 - 10.100.4.0/24 or Sub02Spoke02 - 10.100.5.0/24. This is a more expensive option and in a DDOS Scenario could be very expensive. * If Internet Sourced Traffic can be anonymous (Original SourceIP not logged), and a more affordable design is required, place the SDDC in the Database VPN - Subnets Sub01Spoke01 - 10.100.0.0/24 or Sub02Spoke01 - 10.100.1.0/24. * Set up a Jumpbox in the Database VPC: Add listener to 'NLB First' LoadBalancer on port 33690 for example. Then add Targets to New Listener pointing to Jumpbox port 3369. * Gateways are initialized automatically. To enable additional features through the CME run: autoprov-cfg set template -tn gwlb-ASG-configuration -appi -ia -uf -ips -ab -av * Create an Access control policy for the Environment. #### 1. Create SDDC and Peer Connect to VPC This design allows peer interface connectivity and is limited to networking within the VPC and SDDC. 1. Create Software Defined Data Center: ![Create Software-Defined Data Center](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_2202208231417082.png) ![Create SDDC - AWS Account](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_1202208231415281.png) ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_3202208221427582.png) ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_4202208221430573.png) 2. Add management Firewall rule: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_5202208221431134.png) 3. Create User Defined Networking: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_6202208221432545.png) ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_7202208221433096.png) 4. Add system defined groups: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_8202208221433277.png) 5. Set the Service and publish: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_9202208221436048.png) 6. Add Compute Gateway Rule to allow communications between SDDC \& VPC ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_10202208221436209.png) 7. Enable Managed Prefix List Mode: This creates an ENI in your linked VPC Subnet and promotes routing to the subnets default route. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_11202208221452411.png) 8. Change the Subnets default security Group rule to any any any instead of any any restricted to members of the security group. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_12202208221452582.png) 9. Delete the existing rule and recreate it: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_13202208221453153.png) 10. The database vpc subnets default routes should look similar to this: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_14202208221458134.png) #### 2. SDDC Add AWS External TGW Attachment In VMC dashboard add an account association: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_15202208221541163.png) Then Connect to the TGW: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_16202208221541334.png) In AWS -\> Go to VPC -\> Transit Gateway Attachments and Highlight the new attachment Go to actions -\> Accept New Attachment **2(a). Configure routing to different spokes:** 1. Create a route table association: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_17202208221541525.png) 2. Create TGW Static Route: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_18202208221542226.png) 3. To route traffic to the internet / through the TGW GWLBs : 1. Set up a group 2. Add your SDCC to the group 3. In External VPC -\> Add your AWS Account (provide the Account ID 4. Accept in AWS -\> Resource Access Manager - \> the Resource Shared there. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_19202208221542537.png) ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_20202208221543078.png) 4. Create a TGW Attachment between the New Transit Gateway and the Security VPC - (CIDR 10.0.0.0/16) ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_21202208221502431.png) 5. When the VPC Attachment appears in the VMC SDDC -\> Group -\> External VPC -\> Account - Accept ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_22202208221502592.png) 6. If you want to configure specific Routes to be directed through the Check Point GWLB Gateways - do that in the Add Routes field of the attachment row. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_23202208221540361.png) Now traffic can egress through the GWLB GWs: #### 3. AWS Ingress via TGW to VMC Instance ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_24202208221540522.png) **Prerequisite** - Host is deployed in VMC - running / serving on port 80/443 ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_25202208221543259.png) 1. Create a Target Group for NLB 2. Create External VPC 3. Accept External TGW in RAM 4. Accept Attachment in VMC SDDC Group External VPC: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_262022082215434110.png) ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_272022082215440011.png) #### 4. Two TGW Architecture Set up External VPC in SDDC Group 1. In External VPC -\> Add your AWS Account (provide the Account ID) 2. Accept attachment ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_282022082215441912.png) ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_292022082215443413.png) ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_302022082215445114.png) 3. Edit Route tables for related Subnets and add static routing: For GLWBE Routes add Static to the VMC SDDC TGW: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_312022082215451215.png) ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_322022082215452716.png) AND the TGW Attachment Tables: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_332022082215454317.png) For NAT Subnets direct to the same GWLBe (vpce) as existing Routes - for GW inspection: ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk179850/vmc_sddc_342022082215455618.png)
**Related VMware Links:** * [VMware Cloud on AWS: SDDC Network Architecture](https://vmc.techzone.vmware.com/vmc-arch/docs/network/vmc-aws-sddc-network-architecture) * [VMware Cloud on AWS: SDDC Design](https://vmc.techzone.vmware.com/vmc-solutions/docs/arch/vmc-aws-sddc-design) * [Designlet: VMware Cloud on AWS Static Routing on Multiple CGWs (T1s)](https://vmc.techzone.vmware.com/resource/designlet-vmware-cloud-aws-static-routing-multiple-cgws-t1s) * [A Brief Primer on VMware Transit Gateway Deployments](https://vmc.techzone.vmware.com/resource/brief-primer-vmware-transit-gateway-deployments) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content