Check Point CloudGuard IaaS for VMware NSX | Solution Brief

CHECK POINT + VMware

Automated and Agile Threat Prevention
Security for Software-Defined Data
Centers

VMware NSX is an industry leading CHALLENGES OF SECURING MODERN DATA CENTERS

network virtualization platform that
delivers the same benefits to the Organizations today demand an agile data center environment to reduce IT
network that VMware delivered for costs, increase business agility and remain competitive. At the same time,
compute. Virtual networks can be integrated applications, increasing utilization of virtualization technology and
programmatically managed and dynamic environments have led to a dramatic increase in network traffic
created on demand. The result is going east-west, or laterally within the data center.
dramatically simplified network and
When it comes to security, the focus has mainly been on protecting the
security operations, fast provisioning
perimeter - or north-south traffic - going into and out of the data center.
of networking and security services -
from weeks to minutes, and There are few controls to secure east-west traffic inside the data center. This
fundamentally better data center presents a security risk where threats can traverse unimpeded once inside
security. With the recent the data center.
announcement of VMware Cloud on
Traditional security approaches to this problem are manual, operationally
AWS™, customers can now bring
complex and slow, and are unable to keep pace with dynamic virtual network
VMware’s enterprise-class Software-
changes and rapid virtual application provisioning.
Defined Data Center (SDDC)
software seamlessly to their AWS
cloud. AUTOMATED THREAT PREVENTION SECURITY FOR
SOFTWARE-DEFINED DATA CENTERS
Check Point CloudGuard IaaS for
VMware NSX delivers advanced VMware NSX native security capabilities, automation and extensibility
threat prevention security to VMware framework are leveraged by Check Point to dynamically insert, deploy and
NSX SDDC environments. Designed orchestrate advanced security services inside the Software-Defined Data
for the dynamic requirements of Center. Network isolation and segmentation inherent to the NSX platfor m
cloud-based data centers, enable feasible micro-segmentation, allowing the SDDC to deliver a
CloudGuard provides automated fundamentally more secure approach to data security. Policy is enforced at
security provisioning coupled with the virtual interface, and security policies follow workloads.
the most comprehensive protections.
Fully integrated security features The integration of Check Point CloudGuard IaaS with NSX brings consistent
include: Firewall, IPS, Application policy management and enforcement of advanced security protections
Control, IPsec VPN, Antivirus, Anti- automatically deployed and dynamically orchestrated into software-defined
Bot and award-winning SandBlast data center environments. CloudGuard provides industry-leading threat
sandboxing technology. prevention security to keep data centers protected from even the most
sophisticated threats. Fully integrated multi-layered security protections
Centrally managed across hybrid include:
infrastructures, CloudGuard provides  Stateful Firewall, Intrusion Prevention System (IPS), Antivirus and
consistent security policy Anti-Bot technology to protect data centers against lateral movement
enforcement, full threat visibility
 SandBlast Zero-Day Protection sandbox technology provides the
across physical data centers, SDDCs
most advanced protection against malware and zero-day attacks
and public cloud environments.
 Application Control to help prevent application layer Denial of Service
(DoS) attacks and by that protect the software defined data center
 Data Loss Prevention protects sensitive data from theft or
unintentional loss

© 2020 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content 1
March 2020
 Check Point CloudGuard IaaS for VMware NSX | Solution Brief

Automation and Orchestration

Check Point CloudGuard leverages NSX security
automation for dynamic distribution and orchestration
of CloudGuard for protecting east-west traffic. In the
data center environment, there is often a need to
integrate different systems that manage the security
workflow. Also, repetitive manual tasks must be
automated to streamline security operations. Check
Point’s security management API allows for granular
privilege controls, so that edit privileges can be
scoped down to a specific rule or object within the
policy, restricting what an automated task or
integration can access and change. This ability to
automatically provision trusted connectivity provides
security teams with the confidence to automate and
streamline the entire security workflow.

Ubiquitous Security Enforcement

Check Point CloudGuard integration with VMware NSX allows dynamic insertion of advanced security protection
between workloads enabling distributed enforcement at every virtual interface. The integration automates and
simplifies the provisioning of CloudGuard gateways into the NSX virtual fabric to protect east-west traffic from lateral
movement of threats enabling feasible micro-segmentation. NSX basic firewalling capability can be extended with
Check Point’s CloudGuard, whose layered security policy approach makes it easy to segment a policy, and provide
granular rule definitions specific to network segments.

Context-Aware Security Policies

The integration with VMware NSX controller and vCenter shares context
with the Check Point CloudGuard controller allowing security groups and
VM identities to be imported and reused within Check Point security
policies. This reduces security policy creation time from minutes to
seconds. Real-time context sharing of security groups is maintained so
that any changes or additions to the infrastructure are automatically
tracked without the need for administrator intervention. Security protections are dynamically applied to newly created
applications regardless of where they are hosted.

Auto-Quarantine of Infected Hosts

`Hosts identified by CloudGuard as infected can be automatically isolated
and quarantined. This is accomplished by CloudGuard tagging the infected
hosts and sharing this information with the NSX controller. Additionally,
automated remediation services can be triggered by an or chestration
platform. Threats are quickly contained and the appropriate remediation
service can be applied to the infected VM.

Centralized Security Management

Security management becomes dramatically simplified with centralized configuration and monitoring of CloudGuard.
Traffic is logged and can be easily viewed within common dashboard. Security reports can be generated to track
security compliance across both the data center and hybrid network. A layered approach to policy management
allows administrators to segment a single policy into sub-policies for customized protections and delegation of duties
per application or segment. With all aspects of security management such as policy management, loggin g,
monitoring, event analysis and reporting centralized via a single dashboard, security administrators get a holistic
view of the security posture across their entire organization – from legacy premises to SDDC to hybrid cloud.

© 2020 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content 2
March 2020
 Check Point CloudGuard IaaS for VMware NSX | Solution Brief

KEY FEATURES AND BENEFITS

 Dynamic insertion and orchestration of Check Point’s advanced threat prevention security
 Operationally feasible secure micro-segmentation for east-west traffic protection
 Fine-grained access control policies tied to NSX defined objects, security groups and virtual machines
 Unified security management and visibility across physical networks, SDDCs and hybrid cloud environments
 Security services provisioned in minutes for fast application deployments
 Shared security context to enable better alignment across security controls
 Isolation and auto-remediation of infected virtual machines
 Improved day-to-day operational efficiencies by automating routine tasks and integrating security into workflow
and change management processes
 Advanced security services seamlessly provisioned and orchestrated at the speed of DevOps processes

SOLUTION COMPONENTS
Check Point CloudGuard gateway
The CloudGuard gateway provides industry-leading advanced threat prevention security and is deployed into the
NSX fabric as well as on customer AWS virtual private clouds (VPCs) to prevent malware and other sophisticated
threats from affecting customer cloud environments.
Check Point Smart Center with CloudGuard controller
The Check Point CloudGuard controller integrates with NSX Manager, vCenter and AWS. It supports the import of
NSX, vCenter and AWS objects, dynamically tracks object changes an d allows using security groups in the Check
Point security policies, reports and logs.
VMware NSX fabric and controller
The VMware NSX fabric provides a high performance network virtualization platform for the software -defined data
center. The NSX controller provides centralized configuration and management of the NSX fabric. It allows for
advanced network security service insertion (L4-L7) and automation.

ABOUT CHECK POINT ABOUT VMWARE

Check Point Software Technologies Ltd. VMware is a leader in cloud infrastructure and
(www.checkpoint.com) is a leading provider of cyber business mobility. Build on VMware’s industry-leading
security solutions to governments and corporate virtualization technology, our solutions deliver a brave
enterprises globally. Its solutions protect customers new model of IT that is fluid, instant and more secure.
from cyber-attacks with an industry leading catch rate Customers can innovate faster by rapidly developing,
of malware, ransomware and other types of attacks. automatically delivering and more safely consuming
Check Point offers a multilevel security architecture any application. VMware has more than 500,000
that defends enterprises’ cloud, network and mobile customers and 75,000 partners. The company is
device held information, plus the most comprehensive head-quartered in Silicon Valley with offices
and intuitive one point of control security management throughout the world and can be found online at
system. Check Point protects over 100,000 www.vmware.com
organizations of all sizes.

Worldwide Headquarters | 5 Ha’Solelim Street, Tel Aviv 67897, Israel | Tel: 972-3-753-4555 | Fax: 972-3-624-1100 | Email: [email protected]
CONTACT US
U.S. Headquarters | 959 Skyway Road, Suite 300, San Carlos, CA 94070 | Tel: 800-429-4391; 650-628-2000 | Fax: 650-654-4233 | www.checkpoint.com

© 2020 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content 3
March 2020