CloudLabBox
Try the free demo

Check Point CCSA lab 7 of 14

NAT: automatic hide and static NAT, manual rules and proxy ARP

Take Northgate off the provider's private routes: hide the office and DMZ behind the gateway, publish the web server with automatic static NAT, add a manual port-forwarding rule with its proxy ARP entry, keep internal traffic untranslated, and prove every translation from the internet side.

Run this lab

It needs Standard: its 6 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then Check Point CCSA guided labs, then 07 - NAT - automatic hide and static NAT manual rules and proxy ARP

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

The provider has removed its temporary routes to Northgate's private ranges: from today, only 67.83.0.0/24 is routed to HQ-GW. Make everything work again with NAT:

RequirementTranslation
Office (HQ-LAN) and DMZ reach the internethide behind HQ-GW (67.83.0.111)
Public web siteDMZ-WEB 10.0.2.20 = 67.83.0.120, both directions
Supplier's monitoring tool67.83.0.121 TCP 8080 to DMZ-WEB TCP 80 (port forward)
Office to DMZno translation

What you’ll practise

  • Configure automatic hide NAT and automatic static NAT on network and host objects
  • Write manual NAT rules for port forwarding and for no-NAT exceptions
  • Explain NAT rule order: manual rules, then automatic static, then automatic hide
  • Add Gaia proxy ARP for a manual NAT address
  • Write access rules that match the original (pre-NAT) packet

The tasks

  1. Confirm the problem
  2. Automatic hide NAT
  3. Automatic static NAT for the web server
  4. Port forwarding with a manual rule
  5. No NAT between internal networks
  6. Read the NAT rule base

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of NAT - automatic hide and static NAT manual rules and proxy ARP6 nodes and 2 networks, 7 links. Every link is listed as text below the diagram.SMSHQ-GWISPHQ-PCDMZ-WEBADMIN-PCHQ-LANInternetGi0/0eth0eth0eth1eth0eth0eth2eth0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-GW eth1 to Internet (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • HQ-GW eth2 to DMZ-WEB eth0
Nodes in NAT: automatic hide and static NAT, manual rules and proxy ARP, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
DMZ-WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSA guided labs.

  3. Open 07 - NAT - automatic hide and static NAT manual rules and proxy ARP and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSA labs

All Check Point CCSA labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.