Thank you, I will

Thank you , that motivates me to keep sharing

Thank you for the motivating words ,much appreciated

@@tendaimusonza9547 He's right :) You do a great job!

Dear Tendai , One more question is if we have VM bastions in the Public subnet area, how can we let them go outside or inside the private subnet by passing through the check point firewall. Is there any way we can do that?

Glad it was helpful!

Glad to hear , thank you for the feedback.

Hello ,do you have the route back towards VGW in AWS for VPN traffic ,also did you add the static route on the actual vpn tunnel back to checkpoint , also take note if the server you are testing with is windows only test with RDP since windows firewall drops the other protocols . you can also add flow logs to confirm traffic in AWS and let me know what you see . you can also test traffic in the opposite direction and see if there any decrypts as another of verifying route back to checkpoint form AWS

@@tendaimusonza9547 Hi, we dont have access to AWS site, AWS is build by 3rd party. From checkpoint we have static route towards Azure routed via tunnel interface. I can ask if they see traffic in AWS, not sure if I can do something more on checkpoint. Just wanted to by 100% sure that traffic is leaving checkpoint FW, all I see is logs that traffic towards Azure is hitting VPN community with description Encrypted in community AWS-xxxxx. We testing only HTTPS traffic.

Hello ,Thanks for reaching out to me . Please note that the AWS Network Firewall is powered by the AWS Gateway loadBalancer behind the scene and its not you who set this endpoints up but AWS process does it for you since this is a managed service. after you create the AWS Network firewall you go search under endpoints and should see a gateway loadbalancer endpoints whose ID's you can use as next hop for your routing .adding the next hop use using the ENI or endpoint ID has the same effect .You do not need to create an endpoints as you mentioned ,all you do is to provision the firewall and that will do endpoints for you.

its only a pleasure , you are welcome Robson

Hi Yoominbi ,thanks for reaching out ,my suggestion is that if you do not have available subnet ranges for these extra ones required you can extend your VPC with a secondary CIDR rather than destroying your setup , checkout this link aws.amazon.com/about-aws/whats-new/2017/08/amazon-virtual-private-cloud-vpc-now-allows-customers-to-expand-their-existing-vpcs/ . hope you will find this handy.

​​@@tendaimusonza9547 Thanks for the prompt reply! So if I have available subnets that can be used (as current VPC only using 10.x.x.x subnet), I do not need to destroy my current setup? Then how do you suggest I proceed - Create a new Firewall subnet, change the RTB to point existing IGW to Firewall Subnet, etc. ? (ie. play around with RTB)

@@yoominbi exactly that should work

I provided the TGW as the next hop for both Spoke CIDRS since it is the TGW which knows route back for both spokes in this centralized config ,thank you for your comment , hope i managed to answer your question

i can assist if you have a specific questions , Kindly note that i only share info here and there voluntarily and not a full time youtuber. its just to help people for free and not for a fee . feedback much appreciated

Hello Bernard ,unfortunately there is no other way that i am aware of except recreating new CRT and key , hopefully you still have your CA server intact

will owner the request ,thank you for the support . glad you liked the material

Hi Lee ,Thanks for reaching out. Plz note that VPN config download for sharing with remote site is only an AWS feature ,as for Cloudguard to other VPN device you will need to agree and share common parameters .Let me know if I have answered your question

Thank you for the kind words ,I am encouraged if the content is helpful ,as for creating multiple resources with terraform you may use functions like for_each .I saw some good material on this link and hopefully it can be of help: developer.hashicorp.com/terraform/tutorials/configuration-language/for-each

thanks, much appreciated

Thank you for the feedback ,that will help me in balancing content on my future videos .you may also open an aws free tier account for learning however exercise caution on usage since not everythung is free however aws documentation clearly states how you can stay within free tier

Glad to hear ,Thanks

Hi Zeeshan ,that's a valid point ,to get updates you have to change the routing ,instead of using default route to geneve use specific routes for VPCs cidrs and then default traffic to a different port with route to internet .i used 0.0.0.0/0 just for quick demo

it's a pleasure, thanks