CloudLabBox
Try the free demo

Check Point CCSA lab 2 of 14

The gateway object, SIC and the first policy installation

Bring HQ-GW under management: reset its SIC activation key, create the gateway object with its topology and anti-spoofing, establish Secure Internal Communication, and install the first policy, in SmartConsole and with the management API.

Run this lab

It needs Standard: its 3 nodes are set to 7 vCPU and 14,336 MB in total.

In your workspace: Shared, then Check Point CCSA guided labs, then 02 - The gateway object SIC and the first policy installation

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 7 vCPU and 14,336 MB together. Every lab plan includes every guided lab.

Level
Beginner
Time
About 60 minutes
Nodes need
7 vCPU, 14,336 MB
Smallest plan
Standard

The scenario

HQ-GW's first-time wizard was run by an installer who set a one-time SIC key and did not write it down. The management server has never seen the gateway. Your job: give the gateway a new activation key, add it to the management server, establish trust, describe its interfaces correctly, and install the first policy.

InterfaceAddressLeads toTopology
eth010.0.0.111/24HQ-LAN (users, SMS)Internal, network defined by IP and mask
eth167.83.0.111/24InternetExternal
eth210.0.2.111/24DMZInternal, network defined by IP and mask, leads to DMZ

SIC activation key: Northgate-SIC-26.

What you’ll practise

  • Explain SIC, the internal certificate authority and the one-time activation key
  • Reset SIC on a gateway with cp_conf and check its state
  • Create a gateway object, establish trust and define the interface topology with anti-spoofing
  • Install a policy package and confirm it on the gateway

The tasks

  1. Reset SIC on the gateway
  2. Create the gateway object and establish trust
  3. Topology and anti-spoofing
  4. Install the first policy
  5. What did the policy change?

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of The gateway object SIC and the first policy installation3 nodes and 1 network, 3 links. Every link is listed as text below the diagram.SMSHQ-GWADMIN-PCHQ-LANeth0eth0eth0
3 nodes and 1 network, with the interface names each link uses.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
Nodes in The gateway object, SIC and the first policy installation, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSA guided labs.

  3. Open 02 - The gateway object SIC and the first policy installation and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSA labs

All Check Point CCSA labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.