CloudLabBox
Try the free demo

Check Point CCSE lab 3 of 10

Advanced NAT and policy layers

Go beyond automatic NAT: publish a service on another port, translate source and destination together for a partner, give one host its own hide address, then watch each translation happen at the gateway's inspection points with fw monitor. Finally, tidy the policy with an inline layer for the DMZ and an ordered layer for web control.

Run this lab

It needs Standard: its 6 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then Check Point CCSE guided labs, then 03 - Advanced NAT and policy layers

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 110 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

Northgate has automatic NAT and a simple rule base. Four requests have arrived from the business, and automatic NAT can't meet any of them:

RequestAddressWhat it needs
A test site on DMZ-WEB, on port 80, reachable from outside on 808067.83.0.121port forward
A partner portal on DMZ-WEB port 8081. The partner connects from 67.83.0.113, and the application must see requests from the gateway's DMZ address, 10.0.2.11167.83.0.122twice NAT
HQ-PC must reach the internet server from an address of its own, for the provider's allow list67.83.0.123dedicated hide address
The rule base is growing: move the DMZ rules into a layer of their own, and add web control as a separate stepinline and ordered layers

What you’ll practise

  • Write manual NAT rules: port forward, twice NAT and a dedicated hide address
  • Explain NAT rule order and why twice NAT needs a specific source
  • Publish manual NAT addresses with proxy ARP
  • Trace a translation through the i, I, o and O inspection points with fw monitor
  • Combine an inline layer and an ordered layer, and say which rule decides

The tasks

  1. Read the starting point
  2. A port forward
  3. Twice NAT for the partner
  4. A dedicated hide address
  5. Publish the addresses and install
  6. Watch the translation
  7. An inline layer for the DMZ
  8. An ordered layer for web control

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Advanced NAT and policy layers6 nodes and 2 networks, 7 links. Every link is listed as text below the diagram.SMSHQ-GWISPHQ-PCDMZ-WEBADMIN-PCHQ-LANInternetGi0/0eth0eth0eth1eth0eth0eth2eth0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-GW eth1 to Internet (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • HQ-GW eth2 to DMZ-WEB eth0
Nodes in Advanced NAT and policy layers, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
DMZ-WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSE guided labs.

  3. Open 03 - Advanced NAT and policy layers and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSE labs

All Check Point CCSE labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.