PoC: Firewalls in AWS ECF Dev are receiving threat policy updates from SecOps

[wrnu]

Describe the issue SecOps has a process to deploy firewall policy updates to their CP firewalls. We want to enable SecOps to deploy threat policy updates to our CP firewalls in AWS ECF Dev

Additional context

• SecOps creates hand-built custom threat policies. Michael V is the author, and he applies these across gov using a tool. The tool likely won't connect to our firewalls. We just want to try the threat policies and see how they behave. The connectivity can happen later.
• There are 2 kinds of policies relating to Check Point firewall appliances: network and threat. The SEA covers us for network at the moment, so we're only interested in the list of threats (we think this is a ban-list of IPs and websites)

Definition of done

• Meet with Micheal V from SecOps and provide connection info to our ECF Dev firewall so that he can provide latest threat policy update he wishes whenever he wishes. This will allow CPF to observe the stability and effect on the cloud environments over time, allowing us to understand how we could set up a pipeline with stability check automation eventually going from Dev -> Test -> Prod ECF Checkpoint Firewalls.
• If a direct linkage between Check Point products cannot happen due to network barriers, we may need to do an initial prototype that is something simple like a regular email from him to us, then we manually add it to our AWS Forge environment and observe if anything breaks
• SecOps is able to deploy CP firewall policy updates in AWS ECF Dev

[prabhukiran9999]

• Met with Michael V and had a chat about our current Network structure of the ECF and he would get back to us if they are allowed to push the policies directly or not.
• Meanwhile he asked us to create a network architecture diagram with the current checkpoint FW in place so that he and his team can get a good understanding of our ECF network components and structure.

[bruce-wh-li]

Both Firewalls can't connect to Firewall Manager. As a result, no policy can be pushed.

[lukegonis]

We will revisit this once we have direct connect in place

[bruce-wh-li]

As SECOPS (Chris C.) is taking up firewall support/update/migration, firewall ticket become irrelevant.