CloudLabBox
Try the free demo

Check Point CCSE practice labs

10 guided labs on Check Point R81.20 Gaia, the next step after CCSA. Build a ClusterXL pair and fix a broken member, work with advanced NAT and policy layers, run a site-to-site VPN to a Cisco IOS peer, troubleshoot VPNs with vpn tu and IKE debug, set up Identity Awareness over the Web API, HTTPS Inspection with a lab CA and Threat Prevention exceptions, read the monitoring tools, and take an HA pair live in a capstone.

Start this course

Professional for a month, £112.50, runs every lab here, with nothing extra to pay for the guided labs.

Guided labs
10
Follows
Check Point Certified Security Expert (CCSE), exam 156-315.82, the parts R81.20 can show
Runs every lab
Professional
Devices
Alpine Linux, IOSv, Security Gateway VE, Security Management Server, EVE-NG Firefox browser and Security Gateway

Who these labs are for

For Check Point administrators moving from CCSA to CCSE. You should already know Gaia, security policy and NAT; our Check Point CCSA course covers those.

The labs run on R81.20, so ElasticXL (R82 only) isn’t covered, and neither are Management High Availability, upgrades or migrations. Allow 15 to 25 minutes before the first task.

The 10 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

Check Point CCSE course 10 labs

Shared folderCheck Point CCSE guided labs

Clusters and failover, NAT, VPN, identity, inspection and Threat Prevention, then monitoring and a capstone that takes an HA pair live.

  1. 01ClusterXL high availability - build a two-gateway cluster

    Turn two stand-alone gateways into a ClusterXL High Availability pair: prepare matching interfaces and a sync network, enable cluster membership, create the cluster object with virtual addresses, install a policy, read the result with cphaprob, and fail over with traffic running.

    1× Alpine Linux, 1× IOSv, 1× Security Gateway, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    11 vCPU, 19,456 MBFits Professional

  2. 02Cluster states and failover - fix a broken member

    A change window has left the cluster unable to survive a failure, and the Active member is the only thing keeping the office online. Read cluster states, problem notifications and sync health, find three separate faults on GW2, fix them, and prove the repair with a failover that a TCP session survives.

    1× Alpine Linux, 1× IOSv, 1× Security Gateway, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    11 vCPU, 19,456 MBFits Professional

  3. 03Advanced NAT and policy layers

    Go beyond automatic NAT: publish a service on another port, translate source and destination together for a partner, give one host its own hide address, then watch each translation happen at the gateway's inspection points with fw monitor. Finally, tidy the policy with an inline layer for the DMZ and an ordered layer for web control.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  4. 04Site-to-site VPN with a Cisco IOS peer

    Connect a branch office whose router the management server will never manage. Describe it as an interoperable device, build a star community with IKEv2 and a pre-shared key, exempt the tunnel from hide NAT, make the gateway's identity routable, build the matching IOS side, and prove the tunnel from both ends.

    2× IOSv, 1× Alpine Linux, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  5. 05VPN troubleshooting - vpn tu and IKE debug

    The branch tunnel has never worked, and nobody knows why. Work up the stack with vpn tu, cpstat, SmartLog, the IKEv2 trace and IOS debugs. Each fix uncovers the next fault, and each fault leaves different evidence: authentication, phase 2, then traffic selectors twice over.

    2× IOSv, 1× Alpine Linux, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  6. 06Identity Awareness - Web API and access roles

    Make two DMZ services depend on who is using a PC, not which PC it is. Enable the Identity Web API, build two access roles, rewrite the rules around them, and push identities from an external system. Watch one user replace another on the same address, and check the result on the PDP, the PEP and the API.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  7. 07HTTPS Inspection with a lab CA

    See for yourself why inspection matters: the same test file is stopped over HTTP and passes untouched over HTTPS. Import a lab CA as the outbound CA, inspect outbound traffic with a bypass rule, then inspect the DMZ portal inbound with its own certificate. Prove it with blocked downloads, working clean pages and logs.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  8. 08Threat Prevention policy and exceptions

    Move past the default profile: give the DMZ a stricter profile of its own, scope it with a Threat Prevention rule, turn one protection on with an override, watch it stop an attack, then write a narrow exception for a trusted scanner. All of it offline, with honest notes on what an isolated gateway can't do.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  9. 09Monitoring and performance

    Learn to read a gateway quickly. Take a health snapshot with cpstat and cpview, see how CoreXL and SecureXL share the work, and query the logs. Then solve a real puzzle: a site that fails with nothing in the logs, because the rule that blocks it doesn't log. Find it with fw ctl zdebug and fix it.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  10. 10Capstone - take the HA pair live

    Cutover day. The new cluster is running but isn't finished: head office has no internet, the branch tunnel hasn't been built on the cluster, one site fails with nothing in the logs, and something is wrong that no health check will show you. Build what's missing, find what's broken, and prove the office survives losing either member with the tunnel up.

    2× IOSv, 1× Alpine Linux, 1× Security Gateway, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    12 vCPU, 19,968 MBFits Professional

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the Check Point CCSE practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB1015
Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB1013
Check Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB1010
Check Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB1010
EVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB1010
Check Point Security Gateway (cpsg2 template)cpsg2-R81.20-Licensed2 vCPU, 4,096 MB33

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSE guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the Check Point CCSE labs

Are these Check Point CCSE labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, which is too small for these labs, so use it to look around the workspace.

Which plan do I need for these labs?

Professional, with 18 vCPU and 32 GB, runs every lab here. Standard runs 7 of the 10. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Capstone - take the HA pair live”, needs 12 vCPU and 19,968 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Check Point?

No. CloudLabBox wrote them to follow the topics of Check Point’s Certified Security Expert (CCSE), exam 156-315.82 (R82), in the parts that R81.20 Gaia can show. They aren’t training material from Check Point, and CloudLabBox is independent of Check Point and Cisco.

Which plan do I need?

Seven of the labs fit Standard. Labs 01, 02 and 10 build a cluster and need Professional.

Do I need vendor licences for these labs?

No. The images carry their own evaluation licences, tied to fixed lab addresses, and each node’s clock starts at the end of 2022 to keep them valid, so certificates can look expired or not yet valid. Don’t configure NTP on these nodes. CloudLabBox doesn’t provide vendor licences or subscriptions.

Do the labs use SmartConsole?

Web SmartConsole is reachable from the lab’s ADMIN-PC browser, and the panes give its steps. Every solution and check in our testing used the management API and the command line, so those paths are the proven ones. We haven’t clicked through the browser steps in testing.

What can’t these images show?

There’s no ThreatCloud, so there are no updates, reputation lookups or emulation. Lab 08 uses EICAR and an IMAP traversal protection, and says why. HTTPS Inspection shows CN=Untrusted on outbound sites, because the lab’s only outside sites are self-signed.

Look around the workspace before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB. These labs need more than that, so use it to look around. No card and no email.

Start this courseTry the free demo

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Check Point and Cisco. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.