Check Point Cloud Firewall (formerly CloudGuard Network Security)

Check Point Cloud Firewall (formerly CloudGuard Network Security) is the main manager that provides network security in different forms in my organization. The primary task that Check Point solves is serving as the main means of network security.

Check Point Cloud Firewall (formerly CloudGuard Network Security) has several classes of modules. The main modules include Firewall, Antivirus, Anti-Bot, URL Filtering, the IPS module, and Identity Awareness, which is tightly integrated into our organization and ensures connectivity of corporate users with the corporate network, allowing us to create dynamic sessions and policies.

In our practice, we use a single common profile for all gateways in Check Point Cloud Firewall (formerly CloudGuard Network Security), which allows us to unify all policies and, with the help of sections, display what accesses exist for particular services.

The Identity Awareness module helps our company by allowing us to have approximately fifty Active Directory controllers. We have deployed three Identity Awareness controllers, which are connected to all our security gateways. It works on the principle that when a user logs into their device, data about their current IP address and login is written to the Active Directory logs. The Identity Awareness controller integration reads them and sends them to the security gateway. Check Point Cloud Firewall (formerly CloudGuard Network Security) then queries the Active Directory controller, pulls in all the user's groups, and allows access for each user based on their Active Directory groups, which makes it possible to create dynamic policies and dynamic accesses.

Check Point Cloud Firewall (formerly CloudGuard Network Security) is also used to provide VPN access for engineers. At the moment, we are no longer using Check Point Cloud Firewall (formerly CloudGuard Network Security) together with other Check Point solutions. Previously, we had approximately five projects integrated with Check Point. We used their IA (Identity and Access) solutions, their analyzers, and also their endpoint client at the workstation level.

The main benefit and main advantage of using Check Point Cloud Firewall (formerly CloudGuard Network Security) is that we use unified security approaches both on on-premises segments and in the cloud. We have the same set of policies applied to different types of gateways—both physical and virtual. A unified approach greatly simplifies the administration of the entire network.

By default, most companies do not use separate firewalling solutions in the cloud at all. They use basic functions such as security groups, NACLs, target evaluation, and similar tools. This is sufficient for them. However, all these solutions do not allow the network to be protected from more advanced attacks above standard firewalling. Check Point Cloud Firewall (formerly CloudGuard Network Security) or any NGFW solution makes it possible to protect against a large number of attacks at the IPS, antivirus, and anti-bot level. If there is a sandbox—SandBlast—then the solution can also inspect what is inside the packets themselves to maximally protect the corporate network. By default, cloud-native solutions do not provide this capability.

The main limitations of Check Point Cloud Firewall (formerly CloudGuard Network Security) are not in Check Point itself but in the cloud platforms on which it is deployed. Because not all clouds have L2 infrastructure, you cannot build a unified clustering system everywhere. As a result, the problem usually is not with Check Point, but with the cloud.

The main problem with Check Point Cloud Firewall (formerly CloudGuard Network Security) is that it uses a separate thick client instead of a browser. A browser-based SmartConsole exists, but it still has a number of limitations, while the thick client, the so-called SmartConsole, often works unstably, freezes, and has to be restarted.

I do not recommend using Check Point Cloud Firewall (formerly CloudGuard Network Security) as a VPN hub for site-to-site VPN because it is inconvenient to monitor the state of its tunnels, especially visually. It does not have a convenient snap-in and everything can be checked only via the console, which is very inconvenient. Check Point is not the most universal solution as a device that provides routing and administration capabilities in addition to security. It is an excellent firewall, but it has a number of limitations in terms of routing and in creating VPN sessions, especially in terms of displaying their states.

I have been in my current position for more than seven years.

Regarding the firewall of Check Point Cloud Firewall (formerly CloudGuard Network Security), I would rate it an eight because of its not always stable operation. As a universal device that provides both security and some routing functions, I would rate it a seven.

Check Point Cloud Firewall (formerly CloudGuard Network Security) is an excellent central firewall. At the same time, it has some limitations in terms of optimization at the level of displaying VPN-tunnel operation. It also has a more complicated approach to building clusters. Unlike Fortinet, for example, it does not allow you to simply make an active-passive configuration using a shared config. Its clustering approach uses the presence of two IP addresses on each node and necessarily one shared virtual IP address using a VRRP-like architecture. I consider this inconvenient, especially when you need to swap nodes or when the role of each node changes.

I handled the entire technical part of Check Point Cloud Firewall (formerly CloudGuard Network Security); a separate manager was responsible for licensing and handled all licensing issues for all products, so that was not my area of responsibility.

Check Point Cloud Firewall (formerly CloudGuard Network Security) still has many additional tools that are not fully integrated into SmartConsole. To get to some specific Check Point functions, you have to open additional consoles, which is very inconvenient. The thick client, SmartConsole, is not maximally stable. It often freezes and requires a lot of resources.

I do consider Check Point Cloud Firewall (formerly CloudGuard Network Security) to be a stable solution, but I also believe that Check Point requires constant monitoring and timely reaction to possible failures.

Check Point has two solutions: cluster and Maestro. ClusterXL is initially intended for a certain volume of traffic. Maestro technology allows you to scale out the firewall group and expand the capabilities of the logical group.

The work of Check Point's customer support for Check Point Cloud Firewall (formerly CloudGuard Network Security) varies. We had a large number of cases with Check Point. There were cases that were solved fairly quickly. There were very long ones. There are still cases that we have not closed, but we are no longer actively dealing with them—we have found workarounds to temporarily close certain problems.

In my practice, I have also used Fortinet's solution, which is also very stable. Fortinet uses the same approaches as Check Point; it has one and the same operating system across its devices. Unlike Check Point, Fortinet has a number of advantages and a number of limitations. The main advantage is its versatility: it acts as both a firewall and a router, works perfectly with VPN, but in terms of security class, it has limitations. Check Point Cloud Firewall (formerly CloudGuard Network Security), as a firewall, has a number of advantages. If you analyze the datasheets provided by Check Point and Fortinet, Fortinet greatly inflates its performance figures.

I have also used solutions from Fortinet and Cisco ASA before moving to Check Point Cloud Firewall (formerly CloudGuard Network Security) because it provides more capabilities in terms of security and deeper analysis, as well as more detailed troubleshooting options. At the same time, it has some limitations in terms of performance and stability, which I have already mentioned.

We have had all possible options for deploying Check Point Cloud Firewall (formerly CloudGuard Network Security). Approximately sixty percent are solutions represented as Quantum (CloudGuard) in configurations like VSX and standalone. We had solutions integrated with VMware NSX, but we have already abandoned them because VMware no longer supports such architectures. Forty percent of our current firewalls are firewalls deployed in public clouds—Azure and AWS.

We initially purchased Check Point Cloud Firewall (formerly CloudGuard Network Security) with licenses from AWS, and later we switched to purchasing licenses from an integrator and changed the licensing approach from pure cloud to external licensing.

The main investment effect and everything I can say is that for all the time of my personal work at companies, our services have never been hacked with Check Point Cloud Firewall (formerly CloudGuard Network Security). There were many attempts, they were all logged, but there were no successful hacks. This is the main benefit we gained from working with this product.

Since we use a unified standard for using policies and modules in Check Point Cloud Firewall (formerly CloudGuard Network Security), we can clearly plan which modules we need to activate on a particular gateway for its maximum effective use and cost savings. It does not make sense to activate all blades on all gateways. In our architecture, we have two types of gateways: external and corporate. The corporate ones are more heavily loaded, so they have slightly weaker protection. The external ones are less loaded; therefore, they are maximally protected, and almost all possible Check Point blades are activated for them.

By default, most companies do not use separate firewalling solutions in the cloud at all. They use basic functions such as security groups, NACLs, target evaluation, and similar tools. This is sufficient for them. However, all these solutions do not allow the network to be protected from more advanced attacks above standard firewalling. Check Point Cloud Firewall (formerly CloudGuard Network Security) or any NGFW solution makes it possible to protect against a large number of attacks at the IPS, antivirus, and anti-bot level. If there is a sandbox—SandBlast—then the solution can also inspect what is inside the packets themselves to maximally protect the corporate network. By default, cloud-native solutions do not provide this capability.

My advice to other professionals who are considering using Check Point Cloud Firewall (formerly CloudGuard Network Security) is to treat it exactly as a firewall. It is an excellent fit for some central nodes, data centers, and core levels. As a universal device, especially a small universal device, I would not recommend it because of the complex cluster configuration and also, in some cases, more complex troubleshooting. In particular, it has issues with role changes at the cluster level when older Check Point versions, the so-called R80.x and earlier, are used.

I really hope that in the future, Check Point Cloud Firewall (formerly CloudGuard Network Security) will abandon the thick client and be able to fully switch to working only via the web interface, and also improve the operation of site-to-site VPN in terms of displaying tunnel states. This is the main problem I have encountered. At the same time, the logging system is excellent, and the troubleshooting system is also very good, but the client's operation definitely has room for improvement. I would rate this review an eight overall.