CloudLabBox
Try the free demo

Check Point CCSE lab 8 of 10

Threat Prevention policy and exceptions

Move past the default profile: give the DMZ a stricter profile of its own, scope it with a Threat Prevention rule, turn one protection on with an override, watch it stop an attack, then write a narrow exception for a trusted scanner. All of it offline, with honest notes on what an isolated gateway can't do.

Run this lab

It needs Standard: its 6 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then Check Point CCSE guided labs, then 08 - Threat Prevention policy and exceptions

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

Northgate's servers in the DMZ deserve tighter protection than the office PCs. Today nothing is inspected at all. The security team has asked for this:

RequirementDetails
Everythingthe default Optimized profile
The DMZits own profile, Northgate-DMZ, stricter than Optimized
One known attackblock IMAP directory traversal against the DMZ, which Optimized leaves off
The vulnerability scannerHQ-PC runs authorised scans, so its traversal test must be logged, not blocked

What this lab can and can't show. This gateway has no internet access, so there's no ThreatCloud: no updates, no reputation lookups, no sandbox emulation, and no indicators from feeds. The image holds an old protection set, from 2015, that is mostly file-based. We tested common HTTP attacks (traversal, SQL injection, cross-site scripting and command injection) and they weren't stopped here. Two tests do work offline, and this lab uses them: the EICAR test file, stopped by Anti-Virus, and an IMAP traversal command, stopped by IPS. The logs will also show Anti-Bot lookup errors. That's the missing internet, not a fault.

What you’ll practise

  • Explain Threat Prevention profiles, rules, protected scope and exceptions
  • Create a custom threat profile and scope it to a network
  • Override a single IPS protection in a profile
  • Write an exception that changes the action for one source and one protection
  • Verify with ips stat, test traffic and IPS logs

The tasks

  1. Turn on the blades
  2. A profile of your own
  3. Scope it with a rule
  4. One protection, three profiles
  5. An exception for the scanner
  6. Read the logs

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Threat Prevention policy and exceptions6 nodes and 2 networks, 7 links. Every link is listed as text below the diagram.SMSHQ-GWISPHQ-PCDMZ-WEBADMIN-PCHQ-LANInternetGi0/0eth0eth0eth1eth0eth0eth2eth0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-GW eth1 to Internet (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • HQ-GW eth2 to DMZ-WEB eth0
Nodes in Threat Prevention policy and exceptions, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
DMZ-WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSE guided labs.

  3. Open 08 - Threat Prevention policy and exceptions and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSE labs

All Check Point CCSE labs

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.