CloudLabBox
Try the free demo

Check Point CCSE lab 7 of 10

HTTPS Inspection with a lab CA

See for yourself why inspection matters: the same test file is stopped over HTTP and passes untouched over HTTPS. Import a lab CA as the outbound CA, inspect outbound traffic with a bypass rule, then inspect the DMZ portal inbound with its own certificate. Prove it with blocked downloads, working clean pages and logs.

Run this lab

It needs Standard: its 6 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then Check Point CCSE guided labs, then 07 - HTTPS Inspection with a lab CA

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 110 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

Northgate's security team has spotted that malware can walk straight through the gateway, as long as it's in HTTPS. You'll prove the gap, then close it in both directions:

DirectionSiteDecision
Outboundthe shop, 198.51.100.10inspect
Outboundthe bank, 198.51.100.30bypass: staff banking stays private
Inboundthe portal on DMZ-WEB, 10.0.2.20inspect, using the portal's own certificate

The internal team has given you two PKCS#12 bundles, and the SMS block saved them as /tmp/ca.b64 and /tmp/web.b64 in base64 form:

BundleContainsPassword
ca.b64Northgate Lab CA, certificate and private keyNorthgate-CA-26
web.b64portal.northgate.lab, certificate and private key, issued by the lab CANorthgate-P12-26

The test file is the industry-standard EICAR file: it's harmless, and anti-virus products detect it on purpose. The shop's site needs a login: web / Northgate-Web-26.

Limits in this lab. The gateway has no internet, so it has no ThreatCloud access or updates, and the logs show Update failed messages. Its clock is held at the end of 2022, so the logs also report the router's certificate as expired or not yet valid. Both are effects of the lab, not faults.

What you’ll practise

  • Explain why Threat Prevention can't see inside TLS without inspection
  • Import a CA for outbound inspection and explain how clients come to trust it
  • Write HTTPS rules: Inspect and Bypass, outbound and inbound
  • Explain how a gateway inspects inbound traffic with a server's own certificate and key
  • Read certificates with openssl and HTTPS Inspection logs with show-logs

The tasks

  1. Prove the gap
  2. The outbound CA
  3. Outbound rules
  4. Test outbound
  5. Inbound inspection
  6. Read the logs

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of HTTPS Inspection with a lab CA6 nodes and 2 networks, 7 links. Every link is listed as text below the diagram.SMSHQ-GWISPHQ-PCDMZ-WEBADMIN-PCHQ-LANInternetGi0/0eth0eth0eth1eth0eth0eth2eth0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-GW eth1 to Internet (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • HQ-GW eth2 to DMZ-WEB eth0
Nodes in HTTPS Inspection with a lab CA, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
DMZ-WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSE guided labs.

  3. Open 07 - HTTPS Inspection with a lab CA and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSE labs

All Check Point CCSE labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.