CloudLabBox
Try the free demo

Check Point CCSA lab 9 of 14

Identity Awareness: access roles and the Identity Web API

Make DMZ administration depend on who the user is, not which PC they sit at: enable Identity Awareness with the Identity Web API, build an access role, rewrite the rule around it, push an identity from an external system and watch the gateway's PDP and PEP apply it.

Run this lab

It needs Standard: its 5 nodes are set to 9 vCPU and 15,360 MB in total.

In your workspace: Shared, then Check Point CCSA guided labs, then 09 - Identity Awareness - access roles and the Identity Web API

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 9 vCPU and 15,360 MB together. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
9 vCPU, 15,360 MB
Smallest plan
Standard

The scenario

The rule DMZ administration allows SSH to DMZ-WEB from HQ-PC's address. But PCs are shared, and auditors want the rule to say who: only identified staff may administer the DMZ. Northgate's network access control system knows who is logged in where, and can tell the gateway through the Identity Web API. Today you configure the gateway side and push an identity by hand from the management server (an authorised client) to prove it.

ItemValue
Web API clientthe management server object CP-SMS-R81.20
Client secretNorthgate-IdentityApi-2026
Access roleIdentified-HQ-Users: network HQ-LAN, any identified user

What you’ll practise

  • Explain identity sources (AD Query, Identity Collector, browser-based authentication, Identity Agent, Web API)
  • Enable Identity Awareness with the Identity Web API and an authorised client
  • Create an access role and use it as a rule source
  • Add and remove identities with the Web API and check them with pdp monitor

The tasks

  1. Before
  2. Enable Identity Awareness
  3. The access role and the rule
  4. Push an identity
  5. Remove it

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Identity Awareness - access roles and the Identity Web API5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.SMSHQ-GWHQ-PCDMZ-WEBADMIN-PCHQ-LANeth0eth0eth0eth0eth2eth0
5 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • HQ-GW eth2 to DMZ-WEB eth0
Nodes in Identity Awareness: access roles and the Identity Web API, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
DMZ-WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSA guided labs.

  3. Open 09 - Identity Awareness - access roles and the Identity Web API and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSA labs

All Check Point CCSA labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.