Technical Articles
F5 SMEs share good practice.
cancel
Showing results for 
Search instead for 
Did you mean: 
KevinGallaugher
F5 Employee
F5 Employee

Introduction

SSL Orchestrator centralizes & manages decryption of SSL/TLS traffic.  This enables security and monitoring tools to view the decrypted content and analyze it for threats and other anomalies.  SSL Orchestrator removes the burden of decrypting content from your security tools so they perform better and are more scalable.

An integrated F5 and CheckPoint Firewall solution eliminates the blind spots introduced by SSL/TLS encrypted content.

Versions Tested

This article assumes you have SSL Orchestrator configured with a Topology and Service Chain

F5 BIG-IP version 17.1

SSL Orchestrator version 11.0

CheckPoint Gaia R81.20

CheckPoint SmartConsole version 81.20.9700.641

CheckPoint Firewall will be configured in Bridging mode (L2)

Additional Help

If setting up SSL Orchestrator for the first time refer to the Deployment Guide available HERE

For information on SSL Certificate considerations and trust, click HERE

Demo video:

VMware ESX Configuration

Create the following 4 Port Groups:

Network-North

Network-South

New-Checkpoint-Egress

New-Checkpoint-Ingress

Attach them to a vSwitch, CheckPoint-Switch in this example:

Screen Shot 2023-06-16 at 3.18.32 PM.png

Configure the BIG-IP virtual settings as follows:

Screen Shot 2023-06-16 at 3.22.03 PM.png

NOTE:

VM Network is used for Management

Network-North is used for connectivity to the North side of the network

Network-South is used for connectivity to the South side of the network

New-Checkpoint-Egress is used for connections from BIG-IP to the CheckPoint Firewall

New-Checkpoint-Ingress is used for connections from the CheckPoint Firewall to the BIG-IP

Configure the CheckPoint Firewall virtual settings as follows:

Screen Shot 2023-06-16 at 3.25.53 PM.png

NOTE:

VM Network is used for Management

New-Checkpoint-Egress is used for connections from BIG-IP to the CheckPoint Firewall

New-Checkpoint-Ingress is used for connections from the CheckPoint Firewall to the BIG-IP

CheckPoint Firewall Configuration

Using a web browser connect to the GAIA Portal.  Under Network Management select Network Interfaces.

Screen Shot 2023-06-16 at 2.21.49 PM.png

Network interfaces cannot have an IP address when being added to a Bridge. In this example we’ll use eth1 and eth2.

Screen Shot 2023-06-16 at 2.25.26 PM.png

Click Add then select Bridge

Screen Shot 2023-06-16 at 2.28.04 PM.png

Set a Bridge Group number, 10 in this case.  Add eth1 and eth2 to Chosen Interfaces.  Click OK

Screen Shot 2023-06-16 at 2.29.53 PM.png

Launch the Smart Console and log in.  Double click on the firewall you want to configure, check-fw1 in this example.

Screen Shot 2023-06-16 at 2.35.04 PM.png

Select Network Management

Screen Shot 2023-06-16 at 2.36.26 PM.png

Select Get Interfaces then choose one of the options, Without Topology in this example.

Screen Shot 2023-06-16 at 2.39.05 PM.png

The Topology Results should look like the following.

Screen Shot 2023-06-16 at 2.41.04 PM.png

Click Accept then OK.  Click Publish at the top.

Screen Shot 2023-06-16 at 2.42.14 PM.png

Click Publish again

Screen Shot 2023-06-16 at 2.43.25 PM.png

Click Security Policies on the left

Screen Shot 2023-06-16 at 2.44.33 PM.png

Change the Action from Drop to Accept.

Screen Shot 2023-06-16 at 2.47.05 PM.png

Click Publish then Publish again

Screen Shot 2023-06-16 at 2.49.17 PM.png

When that completes click Install Policy

Screen Shot 2023-06-16 at 2.52.27 PM.png

Click Install

Screen Shot 2023-06-16 at 2.50.57 PM.png

NOTE: in this example the policy is installed on a single firewall.  Your setup may differ.

At this point the CheckPoint Firewall should be configured properly with a network Bridge and associated policy.

BIG-IP SSL Orchestrator Configuration

The BIG-IP VLAN settings should look like the following:

Screen Shot 2023-06-16 at 2.59.25 PM.png

Egress is the VLAN used for connections from BIG-IP to the CheckPoint Firewall

Ingress is the VLAN used for connections from the CheckPoint Firewall to the BIG-IP

Network_North is used for network connectivity from the BIG-IP to the North

Network_South is used for network connectivity from the BIG-IP to the South

Create the CheckPoint Firewall Service

This article assumes you have SSL Orchestrator configured with a Topology and Service Chain.

Navigate to SSL Orchestrator > Configuration.

Screen Shot 2023-06-20 at 9.00.47 AM.png

Under Services, click Add.

Screen Shot 2023-06-20 at 9.03.09 AM.png

In the Service Catalog select the Inline L2 tab then double click on Check Point Security Gateway Inline Layer 2

Screen Shot 2023-06-20 at 9.04.40 AM.png

Give it a name, CheckPoint in this example, then click Add.

Screen Shot 2023-06-20 at 9.06.42 AM.png

For the To Service VLAN select Egress

For the From Service VLAN select Ingress

Click Done

Screen Shot 2023-06-20 at 9.09.05 AM.png

Enable Port Remap.  Set the Remap Port to 80.  Click Save and Next.

Screen Shot 2023-06-20 at 9.11.20 AM.png

Click the name of the Service Chain.

Screen Shot 2023-06-20 at 9.13.13 AM.png

Select the CheckPoint Service from the left and click the arrow to move it to the right.  Click Save.

Screen Shot 2023-06-20 at 9.14.44 AM.png

Click OK

Screen Shot 2023-06-20 at 9.16.12 AM.png

Click Save & Next at the bottom.

Screen Shot 2023-06-20 at 9.17.06 AM.png

Click Deploy

Screen Shot 2023-06-20 at 9.17.58 AM.png

Click OK to the Success message.

Screen Shot 2023-03-21 at 10.13.43 AM.png

When done it should look like the following:

Screen Shot 2023-06-20 at 9.21.09 AM.png

From the Services screen if you expand the Pool Member Status you should see the CheckPoint Firewall

Screen Shot 2023-06-20 at 9.22.23 AM.png

Testing the Configuration

In this example there is a Windows client that connects through the SSL Orchestrator to a Windows server running the following web site:

https://192.168.0.5

Test this connection now and it should look like the following:

Screen Shot 2023-03-29 at 11.37.25 AM.png

We’ll use tcpdump on the BIG-IP to verify connectivity.

The capture from the Network_South vlan shows the encrypted HTTPS request

Screen Shot 2023-06-20 at 9.35.11 AM.png

The capture from the Egress vlan shows plain text HTTP content being sent to the CheckPoint Firewall for Inspection

Screen Shot 2023-06-20 at 9.35.57 AM.png

Conclusion

This completes configuration of BIG-IP SSL Orchestrator with CheckPoint Firewall. At this point traffic that flows through SSL Orchestrator will be decrypted and sent to the CheckPoint Service and inspected for malicious payloads or policy violations.

Version history
Last update:
‎13-Jul-2023 11:19
Updated by:
Contributors