CloudLabBox
Try the free demo

Check Point CCSE lab 10 of 10

Capstone: take the HA pair live

Cutover day. The new cluster is running but isn't finished: head office has no internet, the branch tunnel hasn't been built on the cluster, one site fails with nothing in the logs, and something is wrong that no health check will show you. Build what's missing, find what's broken, and prove the office survives losing either member with the tunnel up.

Run this lab

It needs Professional: its 7 nodes are set to 12 vCPU and 19,968 MB in total.

In your workspace: Shared, then Check Point CCSE guided labs, then 10 - Capstone - take the HA pair live

Run it on Professional from £7.50 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 12 vCPU and 19,968 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 150 minutes
Nodes need
12 vCPU, 19,968 MB
Smallest plan
Professional

The scenario

Today Northgate moves to the new cluster. A colleague built it last week from the plan in lab 1, and left you this handover note:

The cluster's up and cphaprob is clean. Still to do: internet access for the office, and the branch tunnel. Someone also says 198.51.100.20 doesn't work, but it's probably their PC.

Your brief:

#RequirementHow you'll prove it
1HQ-LAN reaches the internet, hidden behind the cluster's virtual address 67.83.0.100. The provider has no route to 10.0.0.0/24the provider sees 67.83.0.100 as the source
2The branch tunnel runs on the cluster, to the design belowtraffic in both directions, with real addresses
3Every site that should work, worksHQ-PC reaches 198.51.100.10 and 198.51.100.20
4Either member can carry all of this alonea failover to each member, with the tunnel up

The tunnel's design is the one from lab 4, with the cluster in place of the single gateway:

SettingValue
VPN domainsHQ-LAN 10.0.0.0/24, Branch-LAN 172.16.0.0/24
PeersHQ-CLUSTER 67.83.0.100, BRANCH-RTR 198.51.100.2
Communitystar Northgate-Branches
IKE and IPsecIKEv2 only, AES-256, SHA-256, DH group 19, PFS group 19
Pre-shared keyNorthgate-Branch-VPN-26

Don't take the note's word for anything. There's less guidance here than in earlier labs: use the tools from the course, and open a hint when you need one.

What you’ll practise

  • Hide a network behind a cluster's virtual address
  • Build a site-to-site VPN on a cluster, with the virtual address as its identity
  • Find faults that cphaprob and the logs don't show
  • Prove a design by failing it, with traffic and a tunnel running

The tasks

  1. Survey
  2. Internet access
  3. The branch tunnel
  4. Every site works
  5. Fail it, both ways

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone - take the HA pair live7 nodes and 3 networks, 11 links. Every link is listed as text below the diagram.SMSGW1GW2ISPBRANCHHQ-PCADMIN-PCHQ-LANInternetSyncGi0/0eth0eth0eth2eth1eth0eth0Gi0/1Gi0/0eth2eth0eth1
7 nodes and 3 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • GW1 eth0 to HQ-LAN (network)
  • GW2 eth0 to HQ-LAN (network)
  • GW1 eth1 to Internet (network)
  • GW2 eth1 to Internet (network)
  • GW1 eth2 to Sync (network)
  • GW2 eth2 to Sync (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • ISP Gi0/1 to BRANCH Gi0/0
Nodes in Capstone: take the HA pair live, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
GW1Check Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
GW2Check Point Security Gateway (cpsg2 template)cpsg2-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
BRANCHCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSE guided labs.

  3. Open 10 - Capstone - take the HA pair live and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSE labs

All Check Point CCSE labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.