CloudLabBox
Try the free demo

Check Point CCSA lab 3 of 14

Objects, rules, sections, sessions and policy installation

Build Northgate's first real policy: network, host, group and service objects, a rulebase with sections, a management rule, a stealth rule and a logged cleanup rule; publish it from a session, install it on HQ-GW and prove each rule with real traffic.

Run this lab

It needs Standard: its 6 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then Check Point CCSA guided labs, then 03 - Objects rules sections sessions and policy installation

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Beginner
Time
About 75 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

HQ-GW is managed but its policy drops everything. Northgate's security officer has approved this first rule set:

#SectionRuleSourceDestinationServiceActionTrack
1ManagementAdmin access to gatewayADMIN-PCHQ-GWhttps, sshAcceptLog
2ManagementStealth ruleAnyHQ-GWAnyDropLog
3OutboundInternal to internetNorthgate-Internalnot Northgate-Internal (negated)http, https, domain-udp (DNS), echo-request (ping)AcceptLog
4DMZPublic webAnyDMZ-WEBhttpAcceptLog
5DMZDMZ administrationHQ-PCDMZ-WEBsshAcceptLog
6CleanupCleanup ruleAnyAnyAnyDropLog

What you’ll practise

  • Create network, host, group and service objects
  • Design a rulebase with sections, a management rule, a stealth rule and an explicit cleanup rule
  • Match "anywhere outside" with a negated group, and know when the Internet object is allowed
  • Work in sessions: publish, discard and see locks
  • Install the policy and test every rule with traffic

The tasks

  1. Objects
  2. Sessions and locks
  3. The rulebase
  4. Install and test
  5. Find the rule that decided

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Objects rules sections sessions and policy installation6 nodes and 2 networks, 7 links. Every link is listed as text below the diagram.SMSHQ-GWISPHQ-PCDMZ-WEBADMIN-PCHQ-LANInternetGi0/0eth0eth0eth1eth0eth0eth2eth0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-GW eth1 to Internet (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • HQ-GW eth2 to DMZ-WEB eth0
Nodes in Objects, rules, sections, sessions and policy installation, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
DMZ-WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSA guided labs.

  3. Open 03 - Objects rules sections sessions and policy installation and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSA labs

All Check Point CCSA labs

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.