CloudLabBox
Try the free demo

Check Point CCSA practice labs

14 guided labs on real Check Point R81.20 management and gateway images: Gaia and the three-tier architecture, SIC, objects and policy, administrators, ordered and inline layers, NAT, Application Control and URL Filtering, Identity Awareness, HTTPS Inspection and Threat Prevention, logging, a site-to-site VPN, maintenance and a troubleshooting capstone.

Start this course

Professional for a month, £112.50, runs every lab here, with nothing extra to pay for the guided labs.

Guided labs
14
Follows
Check Point Certified Security Administrator (CCSA), exam 156-215.82
Runs every lab
Professional
Devices
Alpine Linux, Security Gateway VE, Security Management Server, EVE-NG Firefox browser, IOSv and Security Gateway

Who these labs are for

For administrators preparing for the CCSA exam, and engineers who run Check Point gateways and want hands-on practice with Gaia and the management API.

Every lab starts from factory images, so each one opens with a fast-forward block that builds the starting point for you. Allow 15 to 20 minutes from boot before the first task.

The 14 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

Check Point CCSA course 14 labs

Shared folderCheck Point CCSA guided labs

From Gaia and the first policy to layers, NAT, inspection, VPN and maintenance, then a troubleshooting capstone.

  1. 01Gaia and the three-tier architecture

    Meet the Check Point three-tier architecture on real R81.20 images: explore Gaia's clish and expert shells on the management server and the gateway, read licences and process state, open the management API to GUI clients, and reach the Gaia Portal and Web SmartConsole from an admin browser.

    1× Alpine Linux, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    8 vCPU, 14,848 MBFits Standard

  2. 02The gateway object SIC and the first policy installation

    Bring HQ-GW under management: reset its SIC activation key, create the gateway object with its topology and anti-spoofing, establish Secure Internal Communication, and install the first policy, in SmartConsole and with the management API.

    1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    7 vCPU, 14,336 MBFits Standard

  3. 03Objects rules sections sessions and policy installation

    Build Northgate's first real policy: network, host, group and service objects, a rulebase with sections, a management rule, a stealth rule and a logged cleanup rule; publish it from a session, install it on HQ-GW and prove each rule with real traffic.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  4. 04Administrators permission profiles and concurrent sessions

    Give Northgate's operations team, auditors and helpdesk the access they need and no more: built-in and custom permission profiles, administrator accounts, testing each role, working with concurrent sessions and locks, and reading the audit log.

    1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    7 vCPU, 14,336 MBFits Standard

  5. 05Ordered layers - an Application Control layer after the firewall layer

    Add a second, ordered policy layer for Application Control and URL Filtering after the Network layer, block a forbidden site with a custom Application/Site object, and learn why each ordered layer must explicitly accept the traffic it should not stop.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  6. 06Inline layers - a shared DMZ sub-policy

    Move every DMZ rule into a shared inline layer under one parent rule, so the DMZ team owns a self-contained sub-policy with its own cleanup rule, and reuse the same layer in a second policy package.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  7. 07NAT - automatic hide and static NAT manual rules and proxy ARP

    Take Northgate off the provider's private routes: hide the office and DMZ behind the gateway, publish the web server with automatic static NAT, add a manual port-forwarding rule with its proxy ARP entry, keep internal traffic untranslated, and prove every translation from the internet side.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  8. 08Application Control and URL Filtering in a unified policy

    Turn the Network layer into a unified policy: enable Application Control and URL Filtering on it, create custom Application/Site objects and an application group, block one site with a UserCheck message while approved sites stay open, and read the application fields in the logs.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  9. 09Identity Awareness - access roles and the Identity Web API

    Make DMZ administration depend on who the user is, not which PC they sit at: enable Identity Awareness with the Identity Web API, build an access role, rewrite the rule around it, push an identity from an external system and watch the gateway's PDP and PEP apply it.

    2× Alpine Linux, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    9 vCPU, 15,360 MBFits Standard

  10. 10HTTPS Inspection and Threat Prevention

    Switch on IPS, Anti-Bot and Anti-Virus on HQ-GW, tune them for an offline gateway, stop a test virus and an IMAP directory-traversal attack, then inspect HTTPS with Northgate's own certificate authority while banking traffic stays private, and prove every step with real traffic, certificates and logs.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  11. 11Logs monitoring and system state

    Become fluent with the evidence: generate known traffic, find it in Logs & Monitor and with the API's log queries, manage log files on the log server, and read the gateway's health with cpstat, cpview, connection tables and the watchdog.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

  12. 12Site-to-site VPN between two locally managed gateways

    Connect the new branch office: bring Branch-GW under management, enable the IPsec VPN blade on both gateways, define their VPN domains, build a meshed community with IKEv2 using certificates from the internal CA, allow the traffic in the policy, and prove the tunnel with traffic, vpn tu and logs.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    12 vCPU, 19,968 MBFits Professional

  13. 13Maintenance - backups snapshots saved configurations licences and upgrades

    Look after the platform: read central and local licences and contracts, take a Gaia backup and save the clish configuration of the gateway, understand snapshots and management database exports, and know how CPUSE delivers hotfixes and upgrades.

    1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    7 vCPU, 14,336 MBFits Standard

  14. 14Troubleshooting capstone - SIC routing rule order and NAT

    A contractor's half-finished rebuild has left Northgate with an untrusted gateway, no policy, no internet and an unreachable web site. Work like a support engineer: gather evidence with cp_conf, fw stat, routing, logs and fw ctl zdebug, fix four faults one at a time, and prove each fix.

    2× Alpine Linux, 1× IOSv, 1× Security Gateway VE, 1× Security Management Server, 1× EVE-NG Firefox browser

    10 vCPU, 15,872 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the Check Point CCSA practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB1121
Check Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB1414
Check Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB1414
EVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB1414
Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB99
Check Point Security Gateway (cpsg2 template)cpsg2-R81.20-Licensed2 vCPU, 4,096 MB11

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSA guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the Check Point CCSA labs

Are these Check Point CCSA labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, which is too small for these labs, so use it to look around the workspace.

Which plan do I need for these labs?

Professional, with 18 vCPU and 32 GB, runs every lab here. Standard runs 13 of the 14. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Site-to-site VPN between two locally managed gateways”, needs 12 vCPU and 19,968 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Check Point?

No. CloudLabBox wrote them to follow the topics of Check Point’s Certified Security Administrator (CCSA), exam 156-215.82 (R82). The labs run on R81.20 Gaia, whose features and workflows the R82 course builds on. They aren’t training material from Check Point, and CloudLabBox is independent of Check Point and Cisco.

Do I need vendor licences for these labs?

No. The images carry their own evaluation licences, tied to fixed lab addresses, and each node’s clock starts at the end of 2022 to keep them valid. Don’t configure NTP on these nodes. CloudLabBox doesn’t provide vendor licences or subscriptions.

Is this the R82 exam version?

The labs follow the R82 exam’s objectives but run on R81.20 images, which are the ones we host. The features and workflows they teach are the ones the R82 course builds on.

Do the labs use SmartConsole?

Web SmartConsole is reachable from the lab’s ADMIN-PC browser, and the panes give its steps. Every solution and check in our testing used the management API and the command line, so those paths are the proven ones. We haven’t clicked through the browser steps in testing.

What can’t these images show?

There’s no ThreatCloud, so there are no updates, reputation lookups, URL categories or Threat Emulation. IPS is shown with a protection that fires on these images, and HTTP attacks aren’t stopped here, as lab 10 says. Its HTTPS Inspection lab shows the Untrusted CA, because the lab’s only HTTPS sites are self-signed.

Which plan do I need?

13 of the 14 labs need Standard. Lab 12, the site-to-site VPN, needs Professional, because it runs two gateways and a management server.

Look around the workspace before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB. These labs need more than that, so use it to look around. No card and no email.

Start this courseTry the free demo

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Check Point and Cisco. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.