> Source: [sk184335](https://support.checkpoint.com/results/sk/sk184335) # sk184335 - Deploying and securing Azure Extended Zones with CloudGuard Network Security | Property | Value | |----------|-------| | Solution ID | sk184335 | | Date Created | 2025-11-17 | | Last Modified | 2026-03-13 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R82.10 | | OS | Gaia | | Platform | Azure | ## Solution **Table of Contents:** * Introduction * What are Azure Extended Zones? * Benefits * Architecture * Why secure Azure Extended Zones? * Securing Azure Extended Zones with CloudGuard Security Network Gateways * What Check Point can deploy in Azure Extended Zones * Supported CloudGuard Network Security deployments * Important deployment considerations for Extended Zones * Example deployment * Azure reference documentation
Click Here to Show the Entire Article
Introduction {#TARGET_ID_1} --------------------------- Show / Hide this section > Organizations are moving latency-sensitive applications closer to end users. **Azure Extended Zones** extend the Azure global infrastructure to meet this need. Extended Zones run compute, storage, and select Azure services in metro-area sites. This design helps you meet ultra-low-latency requirements while maintaining the consistency, scalability, and operational simplicity of the Azure platform. > > For more information on Azure Extended Zones, see the [Official Azure Extended Zones Documentation](https://learn.microsoft.com/en-us/azure/extended-zones/). What are Azure Extended Zones? {#TARGET_ID_2} --------------------------------------------- Show / Hide this section > Azure Extended Zones are **small-footprint Azure sites** deployed in metropolitan or industry-specific locations. Each Extended Zone is an extension of a parent Azure region and is managed using the same Azure tools, APIs, and governance models. ### Benefits {#TARGET_ID_3} Show / Hide this section > * **Ultra-low latency** for edge workloads. > * **Local data processing** to meet data-residency requirements. > * **Improved user experience** for real-time and interactive applications. ### Architecture {#TARGET_ID_4} Show / Hide this section > Extended Zones run the **data plane** locally. This includes: > > * Virtual machines (VMs) > * Disks > * Network paths > > The **control plane** remains in the parent region. This includes: > > * Azure Resource Manager (ARM) > * Role-Based Access Control (RBAC) > * Identity management > * Policies > > This architecture provides local performance with full regional manageability. Why secure Azure Extended Zones? {#TARGET_ID_5} ----------------------------------------------- Show / Hide this section > You must secure Azure Extended Zones for these reasons: > > * **Increased attack surface** - Distributed edge workloads expand the security perimeter. > * **Latency constraints** - Sending traffic back to the region for inspection can cause unacceptable delays. > * **Compliance requirements** - Some jurisdictions require local inspection, logging, or data residency. > > To address these risks, deploy security directly inside the Extended Zone where the workload runs. Securing Azure Extended Zones with CloudGuard Security Network Gateways {#TARGET_ID_7} -------------------------------------------------------------------------------------- Show / Hide this section > 1. Dynamic Extended Zone deployment and enforcement: > > * Deploy CloudGuard Network Security Gateways directly **in the Extended Zone location**. > 2. Inline Threat Prevention at the edge: > > * Inspect local traffic with minimal latency. > * Apply IPS, Application Control, URL Filtering, and Identity Awareness. > * Implement zero-trust segmentation and zero-day threat protection. > 3. Unified visibility and management: > > * Manage centrally with **Smart-1 Cloud** or on-premises Security Management Server. > * Monitor policies in real time, with logging and compliance auditing. > * Use one unified policy domain for the core region and the Extended Zone Security Gateways. What Check Point can deploy in Azure Extended Zones {#TARGET_ID_8} ------------------------------------------------------------------ Show / Hide this section > Check Point supports deploying **CloudGuard Network Security Gateways** directly into Azure Extended Zones. This provides low-latency inspection and unified security control. > > Deployment Options: > > * **Single Gateway** - Full NGTP inspection at the local edge. > * **Single-Zone Cluster** - High availability within the same Extended Zone. > * **Custom multi-gateway deployments** - Use your repository templates. > * **Supporting infrastructure** - VNets, subnets, UDRs, NSGs, route tables. > * **Extended-Zone-compatible SKUs** - Standard_DS4_v4 with PremiumSSD_LRS disks. Supported CloudGuard Network Deployments {#TARGET_ID_9} ------------------------------------------------------- Show / Hide this section > The following CloudGuard Network Security deployments are supported in Azure Extended Zones (R81.20 and higher): > > * **Single Gateway** > * **Single-Zone Cluster** > >
> Important deployment considerations for Extended Zones {#TARGET_ID_10} ---------------------------------------------------------------------- Show / Hide this section > 1. Register for the Extended Zone. > > az account set --subscription "" > az edge-zones extended-zone register --extended-zone-name "losangeles" > > See for more information. > 2. Validate VM size and disk support. > > Extended Zones support a **subset** of VM SKUs and disk types. For example: > * VM Size: **Standard_DS4_v4** > * Disk: **Premium** **SSD_LRS** > > **Note:** Using unsupported SKUs can cause the deployment to fail. ### Example deployment {#TARGET_ID_11} Show / Hide this section > 1. Log in and set the subscription. > > `az login > az account set --subscription "" > ` > 2. Register the Extended Zone. > > `az edge-zones extended-zone register --extended-zone-name perth > ` > 3. Deploy CloudGuard from the Azure Marketplace and chose the High-Availability or Single gateway solution > 4. Select the Region of the Extended Zone and the Extended Zone you wish to deploy in. > * Example: > * Region: West US > * Extended Zone: losangeles > > **Important:**Select supported VM size and disk types for the Extended Zone. > > Azure Extended Zones support only a subset of VM sizes and disk SKUs. When deploying CloudGuard Network Security Gateways using the templates above, you **must** select a supported combination for the specific Extended Zone region. > > **Example: Perth Extended Zone** > > * **VM Size:** Standard_DS4_v4 > * **Disk Type:** Premium_SSD > > Selecting an unsupported VM size or disk type can cause the deployment to fail during validation or provisioning. Always check the Azure Extended Zone SKU availability for your target region. > > Reference Matrix: [Azure Extended Zone VM \& Disk Support](https://learn.microsoft.com/en-us/azure/extended-zones/overview#service-offerings-for-azure-extended-zones). Azure reference documentation {#TARGET_ID_14} --------------------------------------------- Show / Hide this section > * [Azure Extended Zones Overview](https://learn.microsoft.com/en-us/azure/extended-zones/overview) > * [Extended Zones Request Access](https://learn.microsoft.com/en-us/azure/extended-zones/request-access) > * [Extended Zone VM SKU Support Matrix](https://learn.microsoft.com/en-us/azure/extended-zones/overview#service-offerings-for-azure-extended-zones) > * [Azure Networking in Extended Zones](https://learn.microsoft.com/en-us/azure/extended-zones/deploy-vm-portal) > * [Azure Updates for Extended Zones](https://azure.microsoft.com/en-us/updates?id=535363) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content