-
Notifications
You must be signed in to change notification settings - Fork 207
/
Copy pathstandalone-master.yaml
447 lines (447 loc) · 13.8 KB
/
standalone-master.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
AWSTemplateFormatVersion: 2010-09-09
Description: Deploys either a manually configurable or a Check Point CloudGuard IaaS
Security Gateway & Management (Standalone) instance in a new VPC (20241027)
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: VPC Network Configuration
Parameters:
- AvailabilityZone
- VPCCIDR
- PublicSubnetCIDR
- PrivateSubnetCIDR
- Label:
default: EC2 Instance Configuration
Parameters:
- StandaloneName
- StandaloneInstanceType
- KeyName
- AllocatePublicAddress
- VolumeSize
- VolumeType
- VolumeEncryption
- EnableInstanceConnect
- TerminationProtection
- MetaDataToken
- Label:
default: Check Point Settings
Parameters:
- StandaloneVersion
- Shell
- StandalonePasswordHash
- StandaloneMaintenancePasswordHash
- Label:
default: Advanced Settings
Parameters:
- ResourcesTagName
- StandaloneHostname
- AllowUploadDownload
- CloudWatch
- StandaloneBootstrapScript
- NTPPrimary
- NTPSecondary
- AdminCIDR
- GatewaysAddresses
ParameterLabels:
AvailabilityZone:
default: Availability zone
VPCCIDR:
default: VPC CIDR
PublicSubnetCIDR:
default: Public subnet CIDR
PrivateSubnetCIDR:
default: Private subnet CIDR
StandaloneName:
default: Standalone Name
StandaloneInstanceType:
default: Instance type
KeyName:
default: Key name
AllocatePublicAddress:
default: Allocate an Elastic IP
VolumeSize:
default: Root volume size (GB)
VolumeType:
default: Volume Type
VolumeEncryption:
default: Volume encryption KMS key identifier
EnableInstanceConnect:
default: Enable AWS Instance Connect
TerminationProtection:
default: Termination Protection
MetaDataToken:
default: Metadata HTTP token
StandaloneVersion:
default: License
Shell:
default: Admin shell
StandalonePasswordHash:
default: Standalone Password hash
StandaloneMaintenancePasswordHash:
default: Gateway Maintenance Password hash
ResourcesTagName:
default: Resources prefix tag
StandaloneHostname:
default: Standalone Hostname
AllowUploadDownload:
default: Allow upload & download
CloudWatch:
default: CloudWatch metrics
StandaloneBootstrapScript:
default: Bootstrap Script
NTPPrimary:
default: Primary NTP server
NTPSecondary:
default: Secondary NTP server
AdminCIDR:
default: Administrator addresses
GatewaysAddresses:
default: Gateways addresses
Parameters:
AvailabilityZone:
Description: The availability zone in which to deploy the instance.
Type: AWS::EC2::AvailabilityZone::Name
MinLength: 1
VPCCIDR:
Description: The CIDR block of the VPC.
Type: String
Default: 10.0.0.0/16
AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$'
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28.
PublicSubnetCIDR:
Description: The public subnet of the Security Gateway.
Type: String
Default: 10.0.10.0/24
AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$'
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28.
PrivateSubnetCIDR:
Description: The private subnet of the Security Gateway.
Type: String
Default: 10.0.11.0/24
AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$'
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28.
StandaloneName:
Type: String
Default: Check-Point-Instance
KeyName:
Description: The EC2 Key Pair to allow SSH access to the instance.
Type: AWS::EC2::KeyPair::KeyName
MinLength: 1
ConstraintDescription: must be the name of an existing EC2 KeyPair.
AllocatePublicAddress:
Default: true
Type: String
AllowedValues:
- true
- false
VolumeSize:
Type: Number
MinValue: 100
Default: 100
VolumeType:
Description: General Purpose SSD Volume Type
Type: String
Default: gp3
AllowedValues:
- gp3
- gp2
VolumeEncryption:
Description: KMS or CMK key Identifier - Use key ID, alias or ARN. Key alias should be prefixed with 'alias/' (e.g. for KMS default alias 'aws/ebs' - insert 'alias/aws/ebs').
Type: String
Default: alias/aws/ebs
EnableInstanceConnect:
Description: Ec2 Instance Connect is not supported with versions prior to R80.40.
Default: false
Type: String
AllowedValues:
- true
- false
TerminationProtection:
Description: Prevents an instance from accidental termination.
Type: String
Default: false
AllowedValues:
- true
- false
MetaDataToken:
Description: Set true to deploy the instance with metadata v2 token required.
Type: String
Default: true
AllowedValues:
- true
- false
StandaloneVersion:
Description: Standalone Version & License.
Type: String
Default: R81.20-BYOL
AllowedValues:
- R81.10-PAYG-NGTP
- R81.10-BYOL
- R81.20-PAYG-NGTP
- R81.20-BYOL
- R82-PAYG-NGTP
- R82-BYOL
Shell:
Description: Change the admin shell to enable advanced command line configuration.
Type: String
Default: /etc/cli.sh
AllowedValues:
- /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
StandalonePasswordHash:
Description: Admin user's password hash (use command "openssl passwd -6 PASSWORD"
to get the PASSWORD's hash). (optional)
Type: String
Default: ''
AllowedPattern: '[\$\./a-zA-Z0-9]*'
NoEcho: true
StandaloneMaintenancePasswordHash:
Description: Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. For R81.10 and below the Admin user's password is used also as maintenance-mode password. (To generate a password hash use the command "grub2-mkpasswd-pbkdf2" on Linux and paste it here). (optional)
Type: String
Default: ''
AllowedPattern: '[\$\./a-zA-Z0-9]*'
NoEcho: true
StandaloneInstanceType:
Description: The instance type of the Security Gateway & Management (Standalone) instance.
Type: String
Default: c5.xlarge
AllowedValues:
- c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
ConstraintDescription: Must be a valid EC2 instance type
ResourcesTagName:
Description: The name tag of the resources. (optional)
Type: String
Default: ''
StandaloneHostname:
Description: The name must not contain reserved words. For details, refer to sk40179 (optional).
Type: String
Default: ''
AllowedPattern: '^([A-Za-z]([-0-9A-Za-z]{0,61}[0-9A-Za-z])?|)$'
ConstraintDescription: A valid hostname label or an empty string.
AllowUploadDownload:
Description: Automatically download updates and share statistical data for product improvement purpose.
Type: String
Default: true
AllowedValues:
- true
- false
CloudWatch:
Description: Report Check Point specific CloudWatch metrics.
Type: String
Default: false
AllowedValues:
- true
- false
StandaloneBootstrapScript:
Description: An optional script with semicolon (;) separated commands to run on the initial boot. (optional)
Type: String
Default: ''
NoEcho: true
NTPPrimary:
Description: (optional)
Type: String
Default: 169.254.169.123
AllowedPattern: '^[\.a-zA-Z0-9\-]*$'
NTPSecondary:
Description: (optional)
Type: String
Default: 0.pool.ntp.org
AllowedPattern: '^[\.a-zA-Z0-9\-]*$'
AdminCIDR:
Description: Allow web, SSH, and graphical clients only from this network to communicate.
with the Management Server
Type: String
AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$'
GatewaysAddresses:
Description: Allow gateways only from this network to communicate with the Management.
Server. (optional)
Type: String
AllowedPattern: '^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2])))?$'
Conditions:
AllocateAddress: !Equals [!Ref AllocatePublicAddress, true]
ProvidedResourcesTag: !Not [!Equals [!Ref ResourcesTagName, '']]
Resources:
VPCStack:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: https://cgi-cfts.s3.amazonaws.com/utils/vpc.yaml
Parameters:
AvailabilityZones: !Ref AvailabilityZone
NumberOfAZs: 1
VPCCIDR: !Ref VPCCIDR
PublicSubnet1CIDR: !Ref PublicSubnetCIDR
CreatePrivateSubnets: true
PrivateSubnet1CIDR: !Ref PrivateSubnetCIDR
CreateAttachmentSubnets: false
InternalRoutingTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !GetAtt VPCStack.Outputs.VPCID
Tags:
- Key: Name
Value: !Join
- _
- - !If [ProvidedResourcesTag, !Ref ResourcesTagName, !Ref 'AWS::StackName']
- InternalRoutingTable
InternalNetworkRouteAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref InternalRoutingTable
SubnetId: !GetAtt VPCStack.Outputs.PrivateSubnet1ID
StandaloneStack:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: https://cgi-cfts.s3.amazonaws.com/gateway/standalone.yaml
Parameters:
VPC: !GetAtt VPCStack.Outputs.VPCID
PublicSubnet: !GetAtt VPCStack.Outputs.PublicSubnet1ID
PrivateSubnet: !GetAtt VPCStack.Outputs.PrivateSubnet1ID
InternalRouteTable: !Ref InternalRoutingTable
StandaloneName: !Ref StandaloneName
StandaloneInstanceType: !Ref StandaloneInstanceType
KeyName: !Ref KeyName
AllocatePublicAddress: !Ref AllocatePublicAddress
VolumeSize: !Ref VolumeSize
VolumeType: !Ref VolumeType
VolumeEncryption: !Ref VolumeEncryption
EnableInstanceConnect: !Ref EnableInstanceConnect
TerminationProtection: !Ref TerminationProtection
MetaDataToken: !Ref MetaDataToken
StandaloneVersion: !Ref StandaloneVersion
Shell: !Ref Shell
StandalonePasswordHash: !Ref StandalonePasswordHash
StandaloneMaintenancePasswordHash: !Ref StandaloneMaintenancePasswordHash
ResourcesTagName: !Ref ResourcesTagName
StandaloneHostname: !Ref StandaloneHostname
AllowUploadDownload: !Ref AllowUploadDownload
CloudWatch: !Ref CloudWatch
StandaloneBootstrapScript: !Ref StandaloneBootstrapScript
NTPPrimary: !Ref NTPPrimary
NTPSecondary: !Ref NTPSecondary
AdminCIDR: !Ref AdminCIDR
GatewaysAddresses: !Ref GatewaysAddresses
Outputs:
CheckPointInstancePublicAddress:
Condition: AllocateAddress
Description: The public address of the Check Point instance.
Value: !GetAtt StandaloneStack.Outputs.PublicAddress
CheckPointInstanceSSH:
Condition: AllocateAddress
Description: SSH command to the Check Point instance.
Value: !GetAtt StandaloneStack.Outputs.SSH
CheckPointInstanceURL:
Condition: AllocateAddress
Description: URL to the portal.
Value: !GetAtt StandaloneStack.Outputs.URL