Checkpoint Firewall prerequisites and architecture
Confirm your VPC has the capacity a Checkpoint Firewall needs before you provision, so the wizard does not fail halfway. This page lists the prerequisites and shows how the Master, Slave, SMS, and Jump roles fit together.
Prerequisites
Confirm all of the following in the target VPC before you open the wizard:
- At least one tenant (org) created in the FPT Cloud Console.
- At least 3 free isolate subnets in the VPC, used for the Management, HA-sync, and Data networks.
- Public IP capacity, if you want automatic public IP assignment:
- At least 1 free public IP without HA.
- At least 3 free public IPs with HA.
If the VPC is short on free isolate subnets or public IPs, the wizard cannot allocate the cluster. Free up capacity or add subnets first.
Components
Master
The active firewall gateway that enforces policy on live traffic. Every deployment has one Master.
Slave
A standby gateway that takes over if the Master fails. The wizard creates a Slave only when you enable High Availability (HA) in Basic Configuration. Without HA, there is no Slave.
SMS (Security Management Server)
The management plane. You define and push firewall policy from the SMS rather than on each gateway directly.
Jump
A jump host that ships with the management software image already installed. You connect through the Jump to reach SmartConsole and the other roles.
How High Availability changes the deployment
| Without HA | With HA | |
|---|---|---|
| Gateways | Master only | Master + Slave |
| Free isolate subnets | 3 | 3 |
| Free public IPs (auto) | 1 | 3 |
| Private IPs auto-assigned | 1 | 3 |