> Source: [sk184286](https://support.checkpoint.com/results/sk/sk184286) # sk184286 - Cloud Firewall for Red Hat OpenShift Virtualization | Property | Value | |----------|-------| | Solution ID | sk184286 | | Date Created | 2025-11-13 | | Last Modified | 2026-04-26 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R82.10, R81.20, R82 | ## Solution ### Overview This Secure Knowledge article highlights Check Point's Cloud Firewall (formerly CloudGuard Network Security) solutions for Red Hat OpenShift Virtualization, as well as general guidance, best practices, and solutions to field-identified issues. ***DISCLAIMER:** The guidance provided here is one of many ways to configure Red Hat OpenShift. Check Point highly recommends to test scenarios and architecture designs prior to production rollouts.* * **Supported Check Point Versions:**R81.20, R82, R82.10 * **Supported Red Hat OpenShift Versions:**4.18 and higher * **Supported Deployments:** * Security Management Server * Multi-Domain Management Server * Multi-Domain Log Server * Single Gateway * High Availability Cluster * **Licensing** * BYOL * For Security Gateways, the license quantity must match the total number of assigned cores across all Security Gateways * SKUs * CPSG-VSEC-VEN-BUN-NGTP-1Y * CPSG-VSEC-VEN-BUN-NGTX-1Y * For Security Management, standard licensing requirements apply. * **Network Interface driver support** * VIRTIO * SR-IOV * **Maximum physical interfaces supported** * 8 physical interfaces (Note: it is on the roadmap to increase this number) * **Prerequisites** * Proficient knowledge of Red Hat OpenShift Virtualization administration (GUI and CLI) and design * Including familiarity with **oc** and **virtctl** commands * [OpenShift Virtualization Operator](https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/virtualization/installing) * [Kubernetes NMState Operator](https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/kubernetes_nmstate/index) * [SR-IOV Network Operator](https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/networking_operators/sr-iov-operator) (only required if SR-IOV will be in use) * OpenShift Project created for use with Cloud Firewall deployment * Relevant Cloud Firewall qcow2 image(s) downloaded or available * See [SK158292 - Cloud Firewall for Private Cloud images](https://support.checkpoint.com/results/sk/sk158292 "SK158292 - CloudGuard Network Security for Private Cloud images")
### Security Management Server/Multi-Domain Server Basic Setup Steps 1. Create a Data Volume for VM to reference relevant qcow2 image * `apiVersion: cdi.kubevirt.io/v1beta1` `kind: DataVolume` `metadata:` ` name: chkp-mgmt-00-dv # Example name` `spec:` ` source:` ` http:` ` url: "https://replace-me.com/jaguar_opt_main-777-991001696_unsecured.qcow2"` ` pvc:` ` volumeMode: Block` ` storageClassName: gp3-csi # This value will be unique per environment` ` accessModes:` ` - ReadWriteOnce` ` resources:` ` requests:` ` storage: 256Gi # Adjust size as needed for your use case` 2. Create VM * `apiVersion: kubevirt.io/v1` `kind: VirtualMachine` `metadata:` ` name: chkp-mgmt-00` ` namespace: chkp-01` `spec:` ` runStrategy: Always` ` template:` ` metadata:` ` labels:` ` kubevirt.io/vm: chkp-mgmt-00 # Must match VM name` ` spec:` ` networks:` ` - name: default` ` pod: {}` ` domain:` ` cpu:` ` cores: 4 # Modify as needed to best suit your use case` ` memory:` ` guest: 16Gi # Modify as needed to best suit your use case` ` devices:` ` interfaces:` ` - name: default` ` masquerade: {}` ` disks:` ` - name: rootdisk` ` bootOrder: 1` ` disk:` ` bus: virtio` ` networkInterfaceMultiqueue: true` ` volumes:` ` - name: rootdisk` ` persistentVolumeClaim:` ` claimName: chkp-mgmt-00-dv # Must match Data Volume created previously` 3. Navigate to the VM Overview to discover the virt-launcher Pod * ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk184286/OSV-SK-001202511131302011.png) 4. Get the label from the virt-launcher pod. `kubevirt.io/vm={vm_name}` * ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk184286/OSV-SK-002202511131306251.png) 5. Create a new Service of type LoadBalancer and include the required ports needed for proper communication with the Security Management Server/Multi-Domain Server. * `apiVersion: v1` `kind: Service` `metadata:` ` name: chkp-mgmt-00-lb # Example name` ` namespace: chkp-01` `spec:` ` selector:` ` kubevirt.io/vm: chkp-mgmt-00 # Must match the VM name` ` type: LoadBalancer` ` ports:` ` - name: ssh` ` protocol: TCP` ` port: 22` ` targetPort: 22` ` nodePort: 31967` ` - name: https` ` protocol: TCP` ` port: 443` ` targetPort: 443` ` nodePort: 31564` ` - name: chkp-tcp18190` ` protocol: TCP` ` port: 18190` ` targetPort: 18190` ` nodePort: 32183` ` - name: chkp-tcp19009` ` protocol: TCP` ` port: 19009` ` targetPort: 19009` ` nodePort: 32429` ` - name: chkp-tcp257` ` protocol: TCP` ` port: 257` ` targetPort: 257` ` nodePort: 31478` ` - name: chkp-tcp18210` ` protocol: TCP` ` port: 18210` ` targetPort: 18210` ` nodePort: 31426` ` - name: chkp-tcp18264` ` protocol: TCP` ` port: 18264` ` targetPort: 18264` ` nodePort: 30808` ` - name: chkp-tcp18191` ` protocol: TCP` ` port: 18191` ` targetPort: 18191` ` nodePort: 30359` 6. Once the LoadBalancer service is up and running a DNS name will be generated to use to connect to the Security Management/Multi-Domain Server. * ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk184286/OSV-SK-003202511131452231.png) 7. Check partition sizes to ensure they match requirements. It may be required to connect in Maintenance mode to reconfigure partitions using lvm_manager.
### Security Gateway Basic Setup Steps 1. Create Namespace for deployment * `apiVersion: v1` `kind: Namespace` `metadata:` ` name: chkp-v001` ` labels:` ` k8s.ovn.org/primary-user-defined-network: ""` 2. Create NetworkAttachmentDefinition * `apiVersion: k8s.cni.cncf.io/v1` `kind: NetworkAttachmentDefinition` `metadata:` ` name: br0-network` ` namespace: chkp-v001` `spec:` ` config: |` ` {` ` "cniVersion": "0.4.0",` ` "type": "ovn-k8s-cni-overlay",` ` "name": "br0-network",` ` "topology": "localnet",` ` "netAttachDefName": "chkp-v001/br0-network",` ` "parameters": {` ` "ovnNetworkName": "br0-network"` ` }` ` }` 3. Create NodeNetworkConfigurationPolicy * `apiVersion: nmstate.io/v1` `kind: NodeNetworkConfigurationPolicy` `metadata:` ` name: br0-network` `spec:` ` nodeSelector:` ` node-role.kubernetes.io/worker: ''` ` desiredState:` ` ovn:` ` bridge-mappings:` ` - localnet: br0-network` ` bridge: br0` ` state: present` 4. Create networking strategy based on your needs and apply accordingly. In general Check Point recommends the use of Cluster User Defined Networks(UDNs) and regular UDNs for greatest flexibility. Visit this link for more information and guidance: 5. Create DataVolume for baseline images for VMs to reference * `apiVersion: cdi.kubevirt.io/v1beta1` `kind: DataVolume` `metadata:` ` name: r82-gw-image-dv # Example name` ` namespace: openshift-cnv # Example namespace` `spec:` ` source:` ` upload: {}` ` pvc:` ` accessModes:` ` - ReadWriteOnce` ` resources:` ` requests:` ` storage: 60Gi` ` storageClassName: lvms-vg1-immediate # This will be unique per environment` 6. Upload baseline image to DataVolume from Step 5 * `virtctl image-upload dv r82-gw-image-dv --image-path=/path-to-qcow2-image --size=60Gi --storage-class=lvms-vg1-immediate --uploadproxy-url=https://cdi-uploadproxy-openshift-cnv.apps.will-be-unique.com --insecure --namespace=openshift-cnv` 7. Create DataVolume for VM to use at first boot * `apiVersion: cdi.kubevirt.io/v1beta1` `kind: DataVolume` `metadata:` ` name: chkp-fw-rootdisk` ` namespace: chkp` `spec:` ` source:` ` pvc:` ` namespace: openshift-cnv` ` name: r82-gw-image-dv # Must match DataVolume name from Step 5` ` pvc:` ` accessModes:` ` - ReadWriteOnce` ` resources:` ` requests:` ` storage: 128Gi # This is recommended minimum for Gaia OS` ` storageClassName: lvms-vg1-immediate # Will be unique per environment` 8. (OPTIONAL) Create DataVolume for VM to reference cloud-init ISO file for first boot configuration * `apiVersion: cdi.kubevirt.io/v1beta1` `kind: DataVolume` `metadata:` ` name: cloud-init-r82-gw-image-dv # Example name` `spec:` ` source:` ` upload: {}` ` pvc:` ` storageClassName: lvms-vg1 # This will be unique per environment` ` accessModes:` ` - ReadWriteOnce` ` resources:` ` requests:` ` storage: 300Mi # Adjust size as needed` 9. (OPTIONAL) Create and upload cloud-init user_data ISO to DataVolume created in previous step * Follow for instructions on how to create the cloud-init and ISO 10. Create VM * `apiVersion: kubevirt.io/v1` `kind: VirtualMachine` `metadata:` ` name: chkp-gw-00 # Example name` ` namespace: chkp-v001 # Replace with your namespace` `spec:` ` runStrategy: Always` ` template:` ` metadata:` ` labels:` ` kubevirt.io/vm: chkp-gw-00` ` spec:` ` networks:` ` - name: default` ` pod: {}` ` - name: external-lan` ` multus:` ` networkName: chkp/br0-network` ` domain:` ` cpu:` ` cores: 4 # Adjust as needed` ` memory:` ` guest: 16Gi # Adjust as needed` ` devices:` ` interfaces:` ` - name: default` ` model: virtio` ` masquerade: {}` ` - name: external-lan` ` model: virtio` ` bridge: {}` ` networkInterfaceMultiqueue: true` ` disks:` ` - name: rootdisk` ` bootOrder: 1` ` disk:` ` bus: virtio` ` - name: cloudinitdisk` ` cdrom:` ` bus: sata` ` volumes:` ` - name: rootdisk` ` persistentVolumeClaim:` ` claimName: chkp-fw-rootdisk # Must match rootdisk DataVolume created previously` ` - name: cloudinitdisk` ` dataVolume:` ` name: cloud-init-r82-gw-image-dv # Must match cloud-init DataVolume created previously` --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content