This Terraform module deploys Check Point CloudGuard IaaS VMSS solution and connects it to an existing management server deployed in Azure. It is assumed that the management server is already created and is deployed into its own Resource-Group / vNET. Further more, it is assumed that the management server is configured with a security policy and with the CME (Cloud Management Extension) service to automatically configure the VMSS when it shows up.

As part of the deployment the following resources are created:

• Resource group
• Virtual network
• Network security group
• vNET peering between VMSS new vNET and between existing management vNET
• VM Scalability Set of Check Point R80.40 gateways

See the Virtual Machine Scale Sets (VMSS) for Microsoft Azure R80.10 and above Administration Guide

This solution uses the following modules:

• /cgi-terraform/azure/modules/common - used for creating a resource group and defining common variables.
• /cgi-terraform/azure/modules/vnet - used for creating new virtual network and subnets.
• /cgi-terraform/azure/modules/network-security-group - used for creating new network security groups and rules.

• Install and configure Terraform to provision Azure resources: Configure Terraform for Azure This module assumes you authenticate using Service Principlan Name (SPN) For security best practices reasons, the SPN credentials were removed from the terraform.tfvars file It is advised you have the credentials as part of the environment variables of your shell.

One example is adding the below to the end of .bashrc on your host (replacing the "x" with the respective information

export ARM_CLIENT_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx"

export ARM_CLIENT_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

export ARM_SUBSCRIPTION_ID="xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

export ARM_TENANT_ID="xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

Another option, is to have a text file (e.g. app-env) with the above text in it and run the "source" command to inject environment variables every time before executing the terraform script (i.e. "source app-env")

• Create a Service Principal with the following permissions to the Azure subscription. This service principal will be used by Terraform in order to deploy the solution.

• Fill all variables in the /cgi-terraform/azure/vmss-new-vnet/terraform.tfvars file with proper values (see below for variables descriptions).

• From a command line initialize the Terraform configuration directory:

    terraform init
  

• Create an execution plan:

    terraform plan
  

• Create or modify the deployment:

    terraform apply
  

resource_group_name             = "checkpoint-vmss-terraform"
location                        = "eastus"
vmss_name                       = "checkpoint-vmss-terraform"
vnet_name                       = "checkpoint-vmss-vnet"
address_space                   = "10.0.0.0/16"
subnet_prefixes                 = ["10.0.1.0/24","10.0.2.0/24"]
backend_lb_IP_address           = 4
admin_password                  = "xxxxxxxxxxxx"
sic_key                         = "xxxxxxxxxxxx"
vm_size                         = "Standard_D3_v2"
disk_size                       = "110"
vm_os_sku                       = "sg-byol"
vm_os_offer                     = "check-point-cg-r8030"
os_version                      = "R80.30"
bootstrap_script                = "touch /home/admin/bootstrap.txt; echo 'hello_world' > /home/admin/bootstrap.txt"
allow_upload_download           = true
disable_password_authentication = true
availability_zones_num          = "1"
minimum_number_of_vm_instances  = 2
maximum_number_of_vm_instances  = 10
management_name                 = "mgmt"
management_IP                   = "1.2.3.4"
management_interface            = "eth0"
configuration_template_name     = "vmss_template"
notification_email              = ""
frontend_load_distribution      = "Default"
backend_load_distribution       = "Default"
mgmt_vnet_name                  = "mgmt_vnet"
mgmt_resource_group_name        = "management"

See the LICENSE file for details