Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion modules/autoscale/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ provider "google" {

module "example_module" {
source = "CheckPointSW/cloudguard-network-security/gcp//modules/autoscale"
version = "1.0.6"
version = "~> 1.0"

# --- Project Configuration ---
project_id = "your-gcp-project-id"
Expand Down Expand Up @@ -72,12 +72,15 @@ module "example_module" {
## VPC
For each network and subnet variable, you can choose whether to create a new network with a new subnet or to use an existing one.
- If you want to create a new network and subnet, please input a subnet CIDR block for the desired new network - In this case, the network name and subnetwork name will not be used:

```
external_network_name = "" # Leave empty when creating new network
external_subnetwork_name = "" # Leave empty when creating new network
external_network_cidr = "10.0.1.0/24"
```

- Otherwise, if you want to use existing network and subnet, please leave empty double quotes in the CIDR variable for the desired network:

```
external_network_name = "network name"
external_subnetwork_name = "subnetwork name"
Expand All @@ -86,17 +89,20 @@ For each network and subnet variable, you can choose whether to create a new net

## Multi-Project (Shared VPC) Support
To attach the autoscale gateways to networks that live in a different host project (Shared VPC), set:

```
project_id = "service-project-id" # provider context
external_network_project = "host-project-id"
internal_network_project = "host-project-id"
```

Leave the network project variable(s) empty when network(s) are in the same project.

**Note:** All networks must reside in projects within the same GCP organization. Cross-organization Shared VPC is not supported.

## Firewall Rules
To create Firewall and allow traffic for ICMP, TCP, UDP, SCTP or/and ESP - enter string of Source IP ranges seperated by comma:

```
external_network_icmp_source_ranges = ""123.123.0.0/24, 234.234.0.0/24""
external_network_tcp_source_ranges = "0.0.0.0/0"
Expand All @@ -110,12 +116,15 @@ Please leave empty `""` for a protocol if you want to disable traffic for it.
## Images
You can choose to either deploy with the latest image or with a custom image.
- If you want to deploy with the latest image leave the `source_image` empty or with `"latest"` keyword and specify the `os_version` and `license`:

```
source_image = ""
os_version = "R82"
license = "BYOL"
```

- Otherwise specify the `source_image` with the path to the image:

```
source_image = "check-point-r82-gw-byol-mig-777-991001866-v20250731"
os_version = "" # Leave empty when using specific image
Expand Down
12 changes: 11 additions & 1 deletion modules/cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ provider "google" {

module "example_module" {
source = "CheckPointSW/cloudguard-network-security/gcp//modules/cluster"
version = "1.0.6"
version = "~> 1.0"

project_id = "my-project-id"
prefix = "chkp-tf-ha"
Expand Down Expand Up @@ -80,12 +80,15 @@ module "example_module" {
## VPC
For each network and subnet variable, you can choose whether to create a new network with a new subnet or to use an existing one.
- If you want to create a new network and subnet, please input a subnet CIDR block for the desired new network - In this case, the network name and subnetwork name will not be used:

```
cluster_network_cidr = "10.0.1.0/24"
cluster_network_name = "" # Leave empty when creating new network
cluster_network_subnetwork_name = "" # Leave empty when creating new network
```

- Otherwise, if you want to use existing network and subnet, please leave empty double quotes in the CIDR variable for the desired network:

```
cluster_network_cidr = ""
cluster_network_name = "cluster-network"
Expand All @@ -94,14 +97,17 @@ For each network and subnet variable, you can choose whether to create a new net
## Firewall Rules
To create Firewall and allow traffic for ICMP, TCP, UDP, SCTP or/and ESP - enter list of Source IP ranges.
- For cluster:

```
cluster_network_icmp_source_ranges = "123.123.0.0/24, 234.234.0.0/24"
cluster_network_tcp_source_ranges = "0.0.0.0/0"
cluster_network_udp_source_ranges = ""
cluster_network_sctp_source_ranges = ""
cluster_network_esp_source_ranges = ""
```

- For management:

```
mgmt_network_icmp_source_ranges = "123.123.0.0/24, 234.234.0.0/24"
mgmt_network_tcp_source_ranges = "0.0.0.0/0"
Expand All @@ -115,6 +121,7 @@ Please leave empty "" for a protocol if you want to disable traffic for it.
## Internal Networks
The cluster members will each have a network interface in each internal network and create high priority routes that will route all outgoing traffic to the cluster member that is currently active.
<br>Using internal networks depends on the variable num_internal_networks, by selecting a number in range 1 - 6 that represents the number of internal networks:

```
num_internal_networks = 3
internal_network1_cidr = ""
Expand All @@ -131,12 +138,15 @@ internal_network3_subnetwork_name = ""
## Images
You can choose to either deploy with the latest image or with a custom image.
- If you want to deploy with the latest image leave the `source_image` empty or with `"latest"` keyword and specify the `os_version` and `license`:

```
source_image = ""
os_version = "R82"
license = "BYOL"
```

- Otherwise specify the `source_image` with the path to the image:

```
source_image = "check-point-r82-gw-byol-cluster-777-991001869-v20250727"
os_version = "" # Leave empty when specifying an image
Expand Down
2 changes: 1 addition & 1 deletion modules/network-security-integration/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ provider "google" {

module "nsi-test" {
source = "CheckPointSW/cloudguard-network-security/gcp//modules/network-security-integration"
version = "1.0.6"
version = "~> 1.0"

# --- Google Provider ---
project = "project-id"
Expand Down
10 changes: 9 additions & 1 deletion modules/single/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ provider {

module "example_module" {
source = "CheckPointSW/cloudguard-network-security/gcp//modules/single"
version = "1.0.6"
version = "~> 1.0"

# --- Project Configuration ---
project_id = "your-gcp-project-id"
Expand Down Expand Up @@ -69,11 +69,13 @@ module "example_module" {
## VPC
For each network and subnet variable, you can choose whether to create a new network with a new subnet or to use an existing one.
- If you want to create a new network and subnet, please input a subnet CIDR block for the desired new network - In this case, the network name and subnetwork name will not be used:

```
network_cidr = "10.0.1.0/24"
network_name = "" # Leave empty when specifying a CIDR
subnetwork_name = "" # Leave empty when specifying a CIDR
```

- Otherwise, if you want to use existing network and subnet, please leave empty double quotes in the CIDR variable for the desired network:

```
Expand All @@ -84,19 +86,22 @@ For each network and subnet variable, you can choose whether to create a new net

## Multi-Project (Shared VPC) Support
To attach the management or single gateway to networks that live in a different host project (Shared VPC), set:

```
project_id = "service-project-id" # provider context
network_project = "host-project-id" # external network lives here
# For additional internal networks in single gateway deployments:
internal_network1_project = "host-project-id" # internal network lives here (when using additional networks)
```

Leave the network project variable(s) empty when network(s) are in the same project.
### Limitation
Shared VPC is not supported across organizations. The host project and service project must be in the same organization.


## Firewall Rules
To create Firewall and allow traffic for ICMP, TCP, UDP, SCTP or/and ESP - enter list of Source IP ranges.

```
ICMP_traffic = "123.123.0.0/24, 234.234.0.0/24"
TCP_traffic = "0.0.0.0/0"
Expand All @@ -110,13 +115,16 @@ Please leave empty "" for a protocol if you want to disable traffic for it.
## Images
You can choose to either deploy with the latest image or with a custom image.
- If you want to deploy with the latest image leave the `source_image` empty or with `"latest"` keyword and specify the `os_version`, `license`, and `installation_type`:

```
source_image = ""
os_version = "R82"
license = "BYOL"
installation_type = "Gateway only"
```

- Otherwise specify the `source_image` with the path to the image:

```
source_image = "check-point-r82-gw-byol-single-777-991001869-v20250727"
os_version = "" # Leave empty when specifying an image
Expand Down