CloudLabBox
Try the free demo

Check Point CCSE lab 4 of 10

Site-to-site VPN with a Cisco IOS peer

Connect a branch office whose router the management server will never manage. Describe it as an interoperable device, build a star community with IKEv2 and a pre-shared key, exempt the tunnel from hide NAT, make the gateway's identity routable, build the matching IOS side, and prove the tunnel from both ends.

Run this lab

It needs Standard: its 6 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then Check Point CCSE guided labs, then 04 - Site-to-site VPN with a Cisco IOS peer

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

Northgate has opened a branch office with a Cisco router. The management server will never manage it, so you need a tunnel between two different vendors, and each side must be configured to match the other.

SettingValue
HQ VPN domainHQ-LAN, 10.0.0.0/24
Branch VPN domain172.16.0.0/24 (Loopback0 on BRANCH, address 172.16.0.1)
GatewaysHQ-GW 67.83.0.111, BRANCH 198.51.100.2
Communitystar Northgate-Branches, HQ-GW at the centre, BRANCH-RTR as satellite
IKEIKEv2 only, AES-256, SHA-256, DH group 19
IPsecAES-256, SHA-256, PFS with group 19
Authenticationpre-shared key Northgate-Branch-VPN-26

HQ-LAN already hides behind 67.83.0.111 for internet access, and that will matter.

What you’ll practise

  • Create an interoperable device and define VPN domains
  • Build a star community with custom IKEv2 settings and a pre-shared key
  • Explain why the gateway's main IP is both its IKE identity and the source of its IKE traffic
  • Exempt VPN traffic from hide NAT
  • Mirror the Check Point settings in an IOS crypto map and IKEv2 profile
  • Verify the tunnel with vpn tu tlist, cpstat vpn, logs and the IOS show commands

The tasks

  1. Check the starting point
  2. The gateway's identity
  3. VPN domains and the interoperable device
  4. The community
  5. Policy and NAT
  6. The IOS side
  7. Bring it up and prove it

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Site-to-site VPN with a Cisco IOS peer6 nodes and 2 networks, 7 links. Every link is listed as text below the diagram.SMSHQ-GWISPBRANCHHQ-PCADMIN-PCHQ-LANInternetGi0/0eth0eth0eth1Gi0/1Gi0/0eth0eth0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-GW eth1 to Internet (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • ISP Gi0/1 to BRANCH Gi0/0
Nodes in Site-to-site VPN with a Cisco IOS peer, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
BRANCHCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSE guided labs.

  3. Open 04 - Site-to-site VPN with a Cisco IOS peer and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSE labs

All Check Point CCSE labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.