By Hezi Bahry, Cloud Network Security Product Manager, published August 1, 2022
Azure Virtual WAN, a Microsoft Network-as-a-Service, is already generating significant interest because of its operational improvements and advanced feature sets. Organizations using Azure Virtual WAN’s capabilities need to ensure that deployments are protected, which is where Check Point CloudGuard Network Security can enable multiple scenarios.
Check Point is excited to announce its Azure Virtual WAN security solution, with CloudGuard providing industry-leading threat prevention, zero trust segmentation and North-South and East-West cloud network security.
If you are:
- Migrating to Azure and need to secure your new cloud infrastructure,
- Implementing a new Azure Virtual WAN architecture and want the best threat prevention,
- Interested in unified and consistent security management of Azure, multi-cloud, and/or hybrid-cloud deployments together with your on-prem security,
- Improving the operational efficiency and automation of your cloud network security,
then CloudGuard can help you and your team.
“Protecting your cloud infrastructure must be automated and operationally efficient to meet today’s business needs”, said TJ Gonen, Check Point’s VP of Cloud Security, “The focus on improving the cloud team’s daily operations is at the center of Azure Virtual WAN, and Check Point is excited to partner with Microsoft to make cloud network security quick, easy and intuitive.”
“The partnership between Check Point and Microsoft Azure provides a best-in-class solution that can secure network traffic for cloud deployment. Check Point CloudGuard for Azure Virtual WAN delivers a fully integrated and automated solution allowing customers to seamlessly protect their applications and workloads,” said Reshmi Yandapalli, Principal Product Manager, Azure Core-Networking.
Click here to watch a demo video of CloudGuard for Azure Virtual WAN.
Background
To best serve today’s modernized IT requirements, many organizations choose a distributed environment strategy, which includes the use of different infrastructures serving different business needs. Global organizations may have a large on-premises data center, with tens or hundreds of branch offices around the world, and utilize Azure’s global presence to serve different business needs. Such a decentralized IT environment requires organizations to manage and maintain complex connectivity, and their security needs may vary between these different parts of its global IT environment.
Figure 1: Multiple physical and cloud-based data centers (source: Microsoft)
Maintaining and securing the peering configurations of multiple physical and cloud-based data centers creates operational and security challenges, especially when the different data centers have different requirements and use different security solutions. This complex connectivity and security posture may cause complex security issues and a resulting slowdown in business growth. Because of this added complexity, security teams often need to invest a significant part of their attention and effort on security operations rather than the actual security.
To address these operational and security challenges, Azure developed Azure Virtual WAN, which can be understood as a cloud-native version of the hub and spoke model, see figure 2 below. Connecting decentralized data centers, branch offices, and remote users to Azure’s Virtual WAN simplifies networking connectivity, while providing low latency streaming of traffic.
Figure 2: Azure Virtual WAN architecture (source: Microsoft)
Check Point’s solution for Azure Virtual WAN security
Check Point and Microsoft partnered to integrate CloudGuard Network Security with Azure Virtual WAN, in order to centralize and simplify the security and security operations for Azure and Check Point customers, see figure 3 below.
Figure 3: CloudGuard provides Azure Virtual WAN security
The tight integration of CloudGuard with Azure Virtual WAN has already generated high interest from a number of leading organizations in different industry verticals. The solution has been tested in numerous proof-of-concepts with early design partners, with feedback that the cloud-native security solution is able to meet the enterprise security requirements of highly-regulated, top-tier organizations.
CloudGuard Network Security for Azure Virtual WAN provides the following benefits for industry-leading security and improved security operations:
- Managed Application: CloudGuard is provided as an Azure Managed Application. This simplifies all the operational aspects of IaaS solutions, providing automated deployment and configuration, automated updates & upgrades, as well as health checks and monitoring of the solution. Most important, it moves the operational overhead from the customer to Check Point so the organization can be more efficient and focus more on security and less on operations.
- Cloud-Native Elasticity: CloudGuard is provided in a scalable active/active configuration, which allows it to share traffic loads and is thus fully adaptable to the dynamic nature of customer traffic elasticity.
- Cloud-Native Consumption Model: Adopting popular cloud-native business models, the CloudGuard solution is provided using a single dimension consumption model, based on the bandwidth of customer traffic inspected.
- Consumption through Azure Marketplace: Customers can easily consume and be billed for the managed application by subscribing on the Azure Managed Application Marketplace.
- Best-of-breed security: CloudGuard is the first pure-security vendor for all traffic flows in Azure Virtual WAN (see figure 4 below), providing industry-leading security.
- Most secure threat prevention with industry-leading catch rate of malware, ransomware and other types of attacks: Highest security effectiveness score with 100% block rate, 100% malware prevention, 100% exploit resistance and 0% false positives.
- Recognized as a long-term leader by third-party analysts: 22 consecutive years as a Leader on the Gartner Magic Quadrant for Network Firewall, Recommended rating by NSS Labs, with over 28 years of security gateway intellectual property and cybersecurity technology innovation.
Figure 4: Traffic flows in Azure Virtual WAN (source: Microsoft)
- Single-pane-of-glass: Customers using Check Point Security Management can connect the newly deployed Virtual WAN security infrastructure with their existing Security Management server and control their vWAN security, public clouds, private clouds and on-prem security from a single-pane-of-glass (using the same comprehensive security management capabilities including the discovery engine, advanced data center objects, tag-based policy, etc.).
- Management as a Service: Customers not currently using Check Point Security Management can connect the newly deployed Virtual WAN security infrastructure with Check Point’s web-based Management-as-a-Service, in order to complete a full “as-a-Service” experience.
These benefits will help security engineers and managers to focus on security instead of the overhead of sizing, deployment, configuration and maintenance.
Supported Traffic Flows
The following traffic flows are supported, see also figure 4 above):
- Single hub
- East-West Branch to Branch
- East-West VNET to VNET
- North-South Branch to VNET
- North-South VNET to Branch
- North-South Branch to Internet
- North-South VNET to Internet
- Inter-hub (multiple hubs) and Hybrid Scenarios
- East-West Branch to Branch
- East-West VNET to VNET
- North-South Branch to VNET
- North-South VNET to Branch
- Azure ExpressRoute to VNET
Figure 5 below shows a single hub reference design.
Figure 5: Single hub reference design
Figure 6 below shows a reference design for an inter-hub in the same region.
Figure 6: Reference design for inter-hub in the same region
Supported Security Use Cases (Security Technologies)
- Firewall and IPS
- Anti-Virus, Anti-Bot and Anti-Malware
- Application Control and URL Filtering
- Sandblast adds Threat Emulation and Threat Extraction for zero-day attacks
- Secured site-to-site IPsec VPN
Next steps
For a demo of the new solution, please watch this video.
CloudGuard Network Security for Azure Virtual WAN is currently in Early Availability. The Early availability program provides a wide range of benefits including VIP support from a Check Point Cloud Security Architect. If you’d like to to join the program, please click here.
If you’d like to learn more about best practices for Azure Virtual WAN security, please register for one of the regional webinars:
- Americas: Thu Sept 8 9am PT/12pm ET
- EMEA: Thu Sept 8 4pm London/5pm CEST
- APAC: Thu Sept 8 12pm HK/SG/2pm Sydney/4pm Wellington
To receive a personalized demo of CloudGuard for Azure Virtual WAN, please click here.
If you’d like to discuss this in more detail with your Check Point account team or security engineer, or your Check Point channel partner, please click here.
Additional content for learning and reading
If you are migrating to the cloud and evaluating cloud network security solutions, download the Buyer’s Guide to Cloud Network Security to understand:
- The top 10 considerations when evaluating and choosing a cloud network security solution in more detail
- An overview of Check Point CloudGuard and how it answers these top 10 considerations
- The relative benefits of the solutions provided by leading cloud providers and third-party security vendors
Another fascinating document is the Forrester Total Economic Impact of CloudGuard Network Security:
Forrester Research interviewed a $10B+ US-based healthcare company who uses CloudGuard to secure their hybrid-cloud deployment and generated a 169% ROI. To read this document, click here.
Do you want to read more about cloud security?
Download the Check Point cloud security blueprint documents:
- Introduction to Cloud Security Blueprint introduces the cloud security blueprint and describes key architectural principles and cloud security concepts.
- Cloud Security Blueprint: Architecture and Solutions explains the blueprint architecture, describes how Check Point’s cloud security solutions enable you implement the blueprint, and how these address the cloud security challenges and architectural principles that were outlined in the first document.
- This document provides reference architectures for implementing the cloud security blueprint.
Follow and join the conversations about Check Point and CloudGuard on Twitter, Facebook, LinkedIn and Instagram.