© 2023 Check Point Software Technologies Ltd. All rights reserved.

Securing Access to Google Cloud Platform

Provide secure, private network access to your public cloud resources and applications

With Harmony SASE, employees can quickly and securely access company resources from public cloud services whether they’re in the office or working remotely. Administrators, meanwhile, can easily audit team activity and enjoy full network visibility with our single-pane-of-glass management console.

Configuring GCP Access

Remote users

Internal web apps hosted on Google Cloud

Internal web apps hosted on other clouds

SaaS apps & private clouds

Internal apps hosted on-premises

Contractors Branch office

© 2023 Check Point Software Technologies Ltd. All rights reserved.

SECURING ACCESS TO GOOGLE CLOUD PLATFORM 2

Connecting a Google Cloud Platform environment to your Harmony SASE network is easy.

Step 1: Create and Configure a GCP VPN Gateway

Before creating a tunnel, you need a VPN gateway on the GCP side to receive the encrypted connection. This task is fairly straightforward, you can read about in more detail in our step-by-step guide.

Step 2: Create a tunnel in GCP

Next, you need to create an IPSec tunnel from the GCP side. This includes giving the tunnel a name, entering your Harmony SASE gateway IP address, opting for a route-based connection, and generating the IPSec pre-shared key. To ensure maximum availability of your cloud resources, Harmony SASE rec- ommends creating redundant tunnels to your GCP resources for high availability. By default, additional tunnels run in active-active mode where both tunnels are in use to optimize the VPN connection. In ad- dition, should one of the tunnels falter, employee connections will automatically fail over to the working tunnel(s). Harmony SASE does not limit the number of tunnels you can create, nor do we charge extra for additional tunnels–so define as many as necessary.

Step 3: Add Tunnel Configuration to Harmony SASE

On the Harmony SASE side, go to the network containing the gateway IP you shared with GCP during tunnel creation, and fill out the necessary information in the Add Tunnel wizard. This includes a name for the tunnel, shared secret, the IKE version, IKE and tunnel lifetime, detection delays and timeouts, as well as options for data encryption, authentication, and key exchange.

Once the technical details are filled out, you need to add a route that will include the subnets for the GCP regions you’re connecting to on the Harmony SASE side. Then you need to go to the GCP console and create the route there as well.

© 2023 Check Point Software Technologies Ltd. All rights reserved.

SECURING ACCESS TO GOOGLE CLOUD PLATFORM 3

Step 4: Set Harmony SASE ZTNA Rules

You should also set access rules within the Harmony SASE management console to enable Zero Trust access to your GCP resources. This way only the individuals and/or groups who actually need access to these resources will have it, while all other employees won’t.

Harmony SASE also supports the advanced WireGuard protocol to connect to GCP based on our easy-to- use proprietary connector. For more information about connecting to GCP resources see our help center for a detailed step-by-step guide.

Access Your GCP Resources Securely

With a secure, encrypted tunnel between your Harmony SASE gateway and GCP resources employees can connect securely. Harmony SASE also increases your organization’s security by hiding the public IP address of your GCP resources. Your Harmony SASE network assigns your GCP resources an internal IP address, thereby obscuring its public IP from the outside world. Internal IP addresses cannot be used outside the network, rendering your GCP resources invisible and inaccessible, and greatly reducing the attack surface.

___________________________________________________

“Any remote access is going to come over [Harmony SASE]. Our attack footprint doesn’t exist anymore.” - Brett A. Sudeck, NP Inc. __________________________________________________

Should you prefer direct connectivity, Harmony SASE’s gateways provide users with a static IP address to enable allowlisting. This isn’t as secure as implementing a secure tunnel using supported VPN proto- cols. But allowlisting means that only employees coming through your Harmony SASE private IP address will be able to access your GCP resources.

Harmony SASE also implements granular access on a per-user application basis, which ensures users only have access to the specific applications they need, and not the entire virtual private cloud (VPC).

© 2023 Check Point Software Technologies Ltd. All rights reserved.

SECURING ACCESS TO GOOGLE CLOUD PLATFORM 4

Harmony SASE Key Advantages

Faster Connections

Harmony SASE removes the need to route traffic to an on-prem VPN, allowing direct access to cloud re- sources. This means reduced latency, more responsive applications, and increased productivity for your employees.

Cover It All With FWaaS No need to pay extra for a virtual firewall. Reduce costs and complexity with a firewall as a service that works across all cloud instances.

Better Network Visibility

With all traffic to your cloud resources routing through Harmony SASE, you will have better visibility into network activity, and detailed logs for SIEM ingestion and investigating security events.

High Availability Tunnels, No Additional Cost

Harmony SASE does not limit the number of tunnels you can create, nor do we charge extra for addi- tional tunnels–so define as many as necessary.

Effortless Deployment In minutes, you can deploy a company network, and set up secure connections to cloud and on-premises resources.

Easy Zero Trust Network Access (ZTNA) IT professionals can easily enforce Zero Trust Network Access policies for individuals or groups quickly and easily. Enforce granular permissions that restrict access to sensitive on-prem and cloud applications.

Broad IdP Support

Harmony SASE supports custom identity management lists and integrates with many trusted and well- known IdP services such as G Suite, JumpCloud, Microsoft Azure AD, and Okta.

Secure Connections for Remote Workers

Administrators can enhance network security with IPSec or WireGuard tunnels between the Harmony SASE gateway and company resources.

© 2023 Check Point Software Technologies Ltd. All rights reserved.

SECURING ACCESS TO GOOGLE CLOUD PLATFORM 5

Worldwide Headquarters 5 Ha’Solelim Street, Tel Aviv 67897, Israel | Tel: 972-3-753-4555 | Fax: 972-3-624-1100 | Email: info@checkpoint.com

U.S. Headquarters 959 Skyway Road, Suite 300, San Carlos, CA 94070 | Tel: 800-429-4391; 650-628-2000 | Fax: 650-654-4233

www.checkpoint.com

About Harmony SASE

Harmony SASE is a robust, yet easy-to-use, converged networking and network security platform that connects all users, in the office or remote, to all resources, located on-prem or in the cloud. It is a cloud-delivered service that includes advanced capabilities such as Zero Trust Remote Access, Internet access control, and SD-WAN. It enables any business to build a secure corporate network over a pri- vate global backbone in less than an hour. The entire service is managed from a unified console and is backed by an award-winning global support team that has you covered 24/7.