CloudLabBox
Try the free demo

Check Point CCSE lab 6 of 10

Identity Awareness: Web API and access roles

Make two DMZ services depend on who is using a PC, not which PC it is. Enable the Identity Web API, build two access roles, rewrite the rules around them, and push identities from an external system. Watch one user replace another on the same address, and check the result on the PDP, the PEP and the API.

Run this lab

It needs Standard: its 6 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then Check Point CCSE guided labs, then 06 - Identity Awareness - Web API and access roles

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

HQ-PC is shared. Today the rule DMZ administration lets anyone at that PC use SSH on DMZ-WEB, because the rule names the PC. Auditors want the rules to name people:

WhoRoleMay use
aliceDMZ-AdminsSSH to DMZ-WEB
bobWeb-Readersthe staff site, TCP 8080 on DMZ-WEB
nobody identifiednoneneither

Northgate's network access system already knows who signs in where, and it can call a web API. So the gateway will learn identities from that, through the Identity Web API. In this lab, the SMS plays that system.

This lab has no directory server. The requests therefore name the role themselves. With a directory, the gateway would work out the role from the user's groups.

What you’ll practise

  • Explain the PDP and PEP, and where an identity lives
  • Enable the Identity Web API and authorise a client
  • Build access roles and use them as rule sources
  • Add, show and delete identities with the Web API
  • Verify identities with pdp monitor, pep show and show-identity

The tasks

  1. Check the starting point
  2. Enable the Identity Web API
  3. Access roles and rules
  4. Alice signs in
  5. Bob takes over
  6. Look inside the PDP and PEP

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Identity Awareness - Web API and access roles6 nodes and 2 networks, 7 links. Every link is listed as text below the diagram.SMSHQ-GWISPHQ-PCDMZ-WEBADMIN-PCHQ-LANInternetGi0/0eth0eth0eth1eth0eth0eth2eth0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-GW eth1 to Internet (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • HQ-GW eth2 to DMZ-WEB eth0
Nodes in Identity Awareness: Web API and access roles, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
DMZ-WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSE guided labs.

  3. Open 06 - Identity Awareness - Web API and access roles and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSE labs

All Check Point CCSE labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.