CloudLabBox
Try the free demo

Check Point CCSA lab 10 of 14

HTTPS Inspection and Threat Prevention

Switch on IPS, Anti-Bot and Anti-Virus on HQ-GW, tune them for an offline gateway, stop a test virus and an IMAP directory-traversal attack, then inspect HTTPS with Northgate's own certificate authority while banking traffic stays private, and prove every step with real traffic, certificates and logs.

Run this lab

It needs Standard: its 6 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then Check Point CCSA guided labs, then 10 - HTTPS Inspection and Threat Prevention

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

Northgate's firewall has been doing access control only. Two decisions came out of this month's security review:

  1. Threat Prevention goes live on HQ-GW: IPS, Anti-Bot and Anti-Virus, with the recommended profile. The penetration testers will check it from HQ-PC against DMZ-WEB in two ways. They download a test virus from its web server, and they send a directory-traversal command (SELECT ../../../etc/passwd) to its old mail service. Both must be stopped and logged, while normal web pages and mail commands still work.
  2. HTTPS inspection for HQ users. Almost all web traffic is HTTPS, so the blades see only encrypted bytes. The board approved inspection with one rule from the privacy policy: banking traffic is never decrypted. Northgate's bank is 198.51.100.30.

Offline lab. These images have no internet access, so nothing here uses Check Point's ThreatCloud: no signature updates, no cloud reputation, no URL categories, no Threat Emulation sandbox and no Autonomous Threat Prevention. What you build here runs without the cloud: the blades, profiles and overrides, the two attacks you stop, and HTTPS inspection with your own CA. The concepts say what a connected gateway adds.

What you’ll practise

  • Enable the Threat Prevention blades and read the Threat Prevention policy, its profiles and the confidence, severity and performance settings
  • Explain resource classification (Hold or Background) and set it for a gateway without cloud access
  • Prove Anti-Virus stops a test file and logs it while normal web traffic still works
  • Read an IPS protection's severity, confidence, performance impact and prevalence, work out what a profile does with it, override it in one profile, and prove it blocks an attack and logs it
  • Explain outbound and inbound HTTPS inspection, why clients must trust the gateway's CA, and why a gateway signs a bad site's certificate with its Untrusted CA
  • Create the outbound inspection certificate, an Inspect rule and a Bypass rule, enable HTTPS inspection on the gateway and prove it from the client
  • State what needs Check Point's cloud: updates, reputation, indicators, categories, emulation and Autonomous Threat Prevention

The tasks

  1. Prove the gap, then switch on Threat Prevention
  2. Read the policy, the profile and the protections
  3. Stop the test virus
  4. Read an IPS protection, then stop the traversal
  5. The outbound CA certificate
  6. The HTTPS Inspection rules
  7. Enable inspection and test

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of HTTPS Inspection and Threat Prevention6 nodes and 2 networks, 7 links. Every link is listed as text below the diagram.SMSHQ-GWISPHQ-PCDMZ-WEBADMIN-PCHQ-LANInternetGi0/0eth0eth0eth1eth0eth0eth2eth0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-GW eth1 to Internet (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • HQ-GW eth2 to DMZ-WEB eth0
Nodes in HTTPS Inspection and Threat Prevention, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
DMZ-WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSA guided labs.

  3. Open 10 - HTTPS Inspection and Threat Prevention and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSA labs

All Check Point CCSA labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.