Skip to content

Commit 04827ff

Browse files
chkp-eddiekchkp-eddiek
committed
New master
0 parents  commit 04827ff

File tree

12 files changed

+1004
-0
lines changed

12 files changed

+1004
-0
lines changed

‎README.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
2+
3+
# Terraform Modules for CloudGuard Network Security (CGNS) — VMware (by Broadcom)
4+
5+
## Introduction
6+
This repository provides a structured set of Terraform modules for deploying Check Point CloudGuard Network Security in VMware vCenter.<br>
7+
These modules automate the creation of Security Gateways and Management servers.<br>
8+
The repository contains:
9+
* Terraform modules
10+
* Community-supported content
11+
12+
### Prerequisites
13+
* Terraform version v1.10.5 or later.
14+
* VMware vCenter Server v7.0 or later.
15+
* Check Point CloudGuard Network Security OVAs from [CloudGuard Network for Private Cloud images
16+
](https://support.checkpoint.com/results/sk/sk158292) R81.20 or later.
17+
18+
## Repository Structure
19+
`Submodules:` Contains modular, reusable, production-grade Terraform components, each with its own documentation.
20+
21+
<!-- `Examples:` Demonstrates how to use the modules. -->
22+
23+
**Submodules:**
24+
25+
* [`single_gateway`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/vmware/latest/submodules/single_gateway) - Deploys CloudGuard Single Gateway solution into an existing network.
26+
* [`management`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/vmware/latest/submodules/management) - Deploys CloudGuard Management Server solution into an existing network.
27+
28+
29+
30+
***
31+
32+
# Best Practices for Using CloudGuard Modules
33+
34+
## Step 1: Use the Required Module
35+
Add the required module in your Terraform configuration file to deploy resources. For example:
36+
37+
```hcl
38+
provider "vsphere" {}
39+
40+
module "example_module" {
41+
source = "CheckPointSW/cloudguard-network-security/vmware//modules/{module_name}"
42+
version = "{chosen_version}"
43+
# Add the required inputs
44+
}
45+
```
46+
---
47+
## Step 2: Open the Terminal
48+
Ensure you have [Terraform](https://developer.hashicorp.com/terraform/install) installed and navigate to the directory
49+
where your Terraform configuration file is located using the appropriate terminal:
50+
- **Linux**: **Terminal**.
51+
- **Windows**: **PowerShell** or **Command Prompt**.
52+
53+
---
54+
55+
## Step 3: Set Environment Variables
56+
Set the required environment variables.
57+
58+
59+
### Linux
60+
```bash
61+
export VSPHERE_USER="your_vsphere_username"
62+
export VSPHERE_PASSWORD="your_vsphere_password"
63+
export VSPHERE_SERVER="your_vsphere_server"
64+
export VSPHERE_ALLOW_UNVERIFIED_SSL="false" # Set to "true" if vCenter is using self-signed certificate
65+
```
66+
### PowerShell (Windows)
67+
```PowerShell
68+
$env:VSPHERE_USER="your_vsphere_username"
69+
$env:VSPHERE_PASSWORD="your_vsphere_password"
70+
$env:VSPHERE_SERVER"your_vsphere_server"
71+
$env:VSPHERE_ALLOW_UNVERIFIED_SSL = "false" # Set to "true" if vCenter is using self-signed certificate
72+
```
73+
### Command Prompt (Windows)
74+
```cmd
75+
set VSPHERE_SERVER=your_vsphere_server
76+
set VSPHERE_USER=your_vsphere_username
77+
set VSPHERE_PASSWORD=your_vsphere_password
78+
set VSPHERE_ALLOW_UNVERIFIED_SSL=false # Set to `true` if vCenter is using self-signed certificate
79+
```
80+
---
81+
82+
## Step 4: Deploy with Terraform
83+
Use Terraform commands to deploy resources securely.
84+
85+
### Initialize Terraform
86+
Prepare the working directory and download required provider plugins:
87+
```shell
88+
terraform init
89+
```
90+
91+
### Plan Deployment
92+
Preview the changes Terraform will make:
93+
```shell
94+
terraform plan
95+
```
96+
### Apply Deployment
97+
Apply the planned changes and deploy the resources:
98+
```shell
99+
terraform apply
100+
```
101+
Notes:
102+
1. Type `yes` when prompted to confirm the deployment.
103+
2. The deployment takes a few minutes to complete (depending on the deployment size, can take ~30 minutes).
104+
105+
## Related Products and Solutions
106+
* CloudGuard Network Security for [AWS](https://github.com/CheckPointSW/terraform-aws-cloudguard-network-security)
107+
* CloudGuard Network Security for [Azure](https://github.com/CheckPointSW/terraform-azure-cloudguard-network-security)
108+
109+
## References
110+
* For more information about Check Point CloudGuard for Public Cloud, see https://www.checkpoint.com/products/iaas-public-cloud-security/
111+
* CloudGuard documentation is available at https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132552&
112+
* CloudGuard Network CheckMates community is available at https://community.checkpoint.com/t5/CloudGuard-IaaS/bd-p/cloudguard-iaas

‎modules/management/README.md‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# Management Module
2+
3+
This Terraform module deploys a Check-Point CloudGuard Network Security Management Server solution into a vSphere
4+
environment using an OVA template.
5+
6+
### Prerequisites
7+
8+
Check Point CloudGuard Network Security **"All deployment types" OVA**
9+
from [CloudGuard Network for Private Cloud images](https://support.checkpoint.com/results/sk/sk158292) R81.20 or later.
10+
11+
## Usage
12+
13+
Follow best practices for using CGNS modules
14+
on [main readme.md file](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/vmware/latest).
15+
16+
## Example Usage
17+
18+
```hcl
19+
provider "vsphere" {}
20+
21+
module "management" {
22+
source = "CheckPointSW/cloudguard-network-security/vmware//modules/management"
23+
24+
// VMware vCenter configuration
25+
datacenter_name = "datacenter"
26+
resource_pool = "my-pool"
27+
datastore = "datastore-1"
28+
esxi_host = "172.23.24.20"
29+
eth0_network_name = "external-network"
30+
local_ovf_path = "/home/file/jaguar_opt_main-777-991001696"
31+
hostname = "Management-Server-example"
32+
33+
// Management configuration
34+
eth0_ipaddress = "172.23.24.10"
35+
eth0_subnet_mask = 24
36+
eth0_gateway_address = "172.23.24.1"
37+
hostname = "Management-example"
38+
admin_password = "AdminPassword123!"
39+
mgmt_admin_passwd = "guiPassword123!"
40+
maintenance_hash = "maintenancePassword123!"
41+
ssh_key = ""
42+
}
43+
```
44+
45+
## Argument Reference
46+
47+
- `datacenter_name`: (**Required**) The name of the vSphere datacenter.
48+
- `resource_pool`: (**Required**) The resource pool in vCenter host name.
49+
- `datastore`: (**Required**) The datastore name.
50+
- `esxi_host`: (**Required**) The ESXi host name.
51+
- `eth0_network_name`: (**Required**) The external network name.
52+
- `local_ovf_path`: (**Required**) The local path to the OVF/OVA file.
53+
- `admin_password`: (**Required**) Admin password.
54+
- `hostname`: (**Required**) Management server hostname.
55+
- `mgmt_gui_passwd`: (**Required**) Management GUI Client Password.
56+
- `maintenance_hash`: (**Required**) Default maintenance password.
57+
- `display_name`: (Optional) The display name of the Management server (from vCenter view). Default is the same as the `hostname`.
58+
- `eth0_ipaddress`: (Optional) IP address for eth0. Leave blank for DHCP.
59+
- `eth0_subnet_mask`: (Optional) Subnet mask for eth0. default is `24`. Leave blank for DHCP.
60+
- `eth0_gateway_address`: (Optional) Gateway address for eth0. Leave blank for DHCP.
61+
- `num_cpus`: (Optional) Number of CPUs for the Security Management.
62+
- `num_cores_per_socket`: (Optional) Number of cores per socket for the Security Management.
63+
- `memory`: (Optional) Memory size for the Security Management in MB.
64+
- `provision`: (Optional) Provision type (thin, flat, thick).
65+
- `primary_dns`: (Optional) Primary DNS server.
66+
- `proxy_port`: (Optional) Port of the proxy server.
67+
- `proxy_address`: (Optional) Address of the proxy server.
68+
- `ntp_primary`: (Optional) Primary NTP server.
69+
- `ntp_primary_version`: (Optional) Version of the primary NTP server. Default is `4`.
70+
- `mgmt_gui_clients_radio`: (Optional) Management GUI Clients Restriction. (any, range, network, this). `any` by default
71+
- `mgmt_gui_clients_first_value`: (Optional) Depends "mgmt_gui_clients_radio" value:<br>If "any": leave blank<br>If "
72+
range": First IP in range for GUI clients.<br>If "network": Network address for GUI clients.<br>If "this": In case of
73+
a single IP address.
74+
- `mgmt_gui_clients_second_value`: (Optional) Depends "mgmt_gui_clients_radio" value:<br>If "any": leave blank<br>If "
75+
range": Last IP in range for GUI clients.<br>If "network": Network mask for GUI clients.
76+
- `high_availability_configuration`: (Optional) High availability configuration (Primary, Secondary). `Primary` by
77+
default.
78+
- `ssh_key`: (Optional) SSH key.
79+
- `clish_commands`: (Optional) Additional Clish commands in **base64**.
80+
- `additional_configuration`: (Optional) Additional shell commands **in base64**.
81+
- `custom_attributes`: (Optional) Map of custom attribute ids to attribute value strings to set for virtual machine.
82+
Please refer to
83+
the [vsphere_custom_attributes](https://registry.terraform.io/providers/hashicorp/vsphere/latest/docs/resources/custom_attribute#using-custom-attributes-in-a-supported-resource)
84+
resource for more information on setting custom attributes.
85+
- `sic_for_secondary_mgmt`: (Optional) Secure Internal Communication key for secondary management.
86+
- `download_info`: (Optional) Automatically download and install Software Blade Contracts, security updates, and other
87+
important data (very recommended). See sk175504. `Yes` by default
88+
- `upload_info`: (Optional) Help Check Point improve the product by sending anonymous information. See sk175504. `Yes`
89+
by default.
90+
91+
## Outputs
92+
93+
- `ip_external`: External IP (eth0).
94+
- `hostname`: The name of the Security Management Server.
95+
- `managed_object_id`: The managed object ID of the Security Management Server.
96+
97+
```

‎modules/management/main.tf‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
data "vsphere_datacenter" "datacenter" {
2+
name = var.datacenter_name
3+
}
4+
5+
data "vsphere_datastore" "datastore" {
6+
name = var.datastore
7+
datacenter_id = data.vsphere_datacenter.datacenter.id
8+
}
9+
10+
data "vsphere_resource_pool" "pool" {
11+
name = var.resource_pool
12+
datacenter_id = data.vsphere_datacenter.datacenter.id
13+
}
14+
15+
data "vsphere_host" "host" {
16+
name = var.esxi_host
17+
datacenter_id = data.vsphere_datacenter.datacenter.id
18+
}
19+
20+
data "vsphere_network" "eth0_network" {
21+
name = var.eth0_network_name
22+
datacenter_id = data.vsphere_datacenter.datacenter.id
23+
}
24+
25+
data "vsphere_ovf_vm_template" "ovf" {
26+
name = "Management-OVA"
27+
disk_provisioning = var.provision
28+
resource_pool_id = data.vsphere_resource_pool.pool.id
29+
datastore_id = data.vsphere_datastore.datastore.id
30+
host_system_id = data.vsphere_host.host.id
31+
local_ovf_path = var.local_ovf_path
32+
}
33+
34+
resource "vsphere_virtual_machine" "vm" {
35+
name = var.host_display_name != "" ? var.host_display_name : var.hostname
36+
datacenter_id = data.vsphere_datacenter.datacenter.id
37+
datastore_id = data.vsphere_datastore.datastore.id
38+
host_system_id = data.vsphere_host.host.id
39+
resource_pool_id = data.vsphere_resource_pool.pool.id
40+
41+
num_cpus = var.num_cpus != 0 ? var.num_cpus : data.vsphere_ovf_vm_template.ovf.num_cpus
42+
num_cores_per_socket = var.num_cores_per_socket != 0 ? var.num_cores_per_socket : data.vsphere_ovf_vm_template.ovf.num_cores_per_socket
43+
memory = var.memory != 0 ? var.memory : data.vsphere_ovf_vm_template.ovf.memory
44+
guest_id = data.vsphere_ovf_vm_template.ovf.guest_id
45+
annotation = data.vsphere_ovf_vm_template.ovf.annotation
46+
firmware = data.vsphere_ovf_vm_template.ovf.firmware
47+
nested_hv_enabled = data.vsphere_ovf_vm_template.ovf.nested_hv_enabled
48+
scsi_type = data.vsphere_ovf_vm_template.ovf.scsi_type
49+
custom_attributes = var.custom_attributes
50+
51+
network_interface {
52+
network_id = data.vsphere_network.eth0_network.id
53+
}
54+
55+
56+
ovf_deploy {
57+
allow_unverified_ssl_cert = true
58+
local_ovf_path = data.vsphere_ovf_vm_template.ovf.local_ovf_path
59+
disk_provisioning = var.provision
60+
ovf_network_map = data.vsphere_ovf_vm_template.ovf.ovf_network_map
61+
enable_hidden_properties = true // Dont Change!
62+
}
63+
64+
vapp {
65+
properties = {
66+
"hostname" = var.hostname,
67+
"run_ftw" = "Yes",
68+
"CheckPoint.adminHash" = var.admin_password
69+
"eth0.ipaddress" = var.eth0_ipaddress
70+
"eth0.subnetmask" = var.eth0_subnet_mask
71+
"eth0.gatewayaddress" = var.eth0_gateway_address
72+
73+
"primary" = var.primary_dns
74+
"proxy_port" = var.proxy_port
75+
"proxy_address" = var.proxy_address
76+
"ntp_primary" = var.ntp_primary
77+
"ntp_primary_version" = var.ntp_primary_version // default is 4
78+
"ssh_key" = var.ssh_key
79+
80+
// MGMT configuration
81+
"mgmt_admin_passwd" = var.mgmt_gui_password
82+
"mgmt_gui_clients_radio" = var.mgmt_gui_clients_radio
83+
"mgmt_gui_clients_first_value" = var.mgmt_gui_clients_first_value
84+
"mgmt_gui_clients_second_value" = var.mgmt_gui_clients_second_value
85+
"high_availability_configuration" = var.high_availability_configuration
86+
"CheckPoint.ftwSicKey" = var.sic_for_secondary_mgmt
87+
"maintenance_hash" = var.maintenance_hash
88+
89+
"clish_commands" = var.clish_commands
90+
"additional_configuration" = var.additional_configuration
91+
// DO NOT CHANGE "user_data"!
92+
"user_data" = var.user_data
93+
}
94+
}
95+
96+
wait_for_guest_net_routable = false
97+
wait_for_guest_net_timeout = 0
98+
lifecycle {
99+
ignore_changes = [
100+
num_cpus,
101+
num_cores_per_socket,
102+
memory,
103+
annotation,
104+
vapp[0].properties
105+
]
106+
}
107+
}

‎modules/management/outputs.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
output "ip_external" {
2+
value = vsphere_virtual_machine.vm.default_ip_address
3+
}
4+
5+
output "hostname" {
6+
value = vsphere_virtual_machine.vm.name
7+
}
8+
9+
output "managed_object_id" {
10+
value = vsphere_virtual_machine.vm.moid
11+
}

0 commit comments

Comments
 (0)