Check Point CCSA lab 12 of 14
Site-to-site VPN between two locally managed gateways
Connect the new branch office: bring Branch-GW under management, enable the IPsec VPN blade on both gateways, define their VPN domains, build a meshed community with IKEv2 using certificates from the internal CA, allow the traffic in the policy, and prove the tunnel with traffic, vpn tu and logs.
Run this lab
It needs Professional: its 7 nodes are set to 12 vCPU and 19,968 MB in total.
In your workspace: Shared, then Check Point CCSA guided labs, then 12 - Site-to-site VPN between two locally managed gateways
- Level
- Advanced
- Time
- About 90 minutes
- Nodes need
- 12 vCPU, 19,968 MB
- Smallest plan
- Professional
The scenario
Northgate has opened a branch with its own gateway, Branch-GW, on the same provider network (67.83.0.112). The fast-forward has already brought it under management. Now connect the branch LAN (172.16.0.0/24) to HQ-LAN (10.0.0.0/24) through an encrypted tunnel:
| Setting | Value |
|---|---|
| Community | meshed, Northgate-Sites, members HQ-GW and Branch-GW |
| Encryption | IKEv2 only; phase 1 AES-256, SHA-256, DH group 19; phase 2 AES-256, SHA-256 |
| Authentication | certificates from the internal CA (the default for gateways managed by the same server) |
| VPN domains | HQ-GW: HQ-LAN; Branch-GW: Branch-LAN (172.16.0.0/24) |
| Policy | any service between HQ-LAN and Branch-LAN through the community, logged |
What you’ll practise
- Explain VPN domains, communities and certificate authentication with the ICA
- Enable IPsec VPN on gateways and define their encryption domains
- Create a meshed community with IKEv2 encryption settings
- Write access rules that match VPN traffic, and exempt it from NAT
- Verify tunnels with vpn tu tlist, cpstat vpn and logs
The tasks
- Check the starting point
- VPN blade and domains
- The community
- Policy and NAT
- Bring it up and prove it
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- SMS
eth0to HQ-LAN (network) - HQ-GW
eth0to HQ-LAN (network) - HQ-GW
eth1to Internet (network) - HQ-PC
eth0to HQ-LAN (network) - ADMIN-PC
eth0to HQ-LAN (network) - ISP
Gi0/0to Internet (network) - Branch-GW
eth0to Internet (network) - Branch-GW
eth1to Branch-PCeth0
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| SMS | Check Point Security Management Server | cpsms-R81.20-Licensed | 4 vCPU, 8,192 MB |
| HQ-GW | Check Point Security Gateway VE (cpsg template) | cpsg-R81.20-Licensed | 2 vCPU, 4,096 MB |
| ISP | Cisco IOSv | vios-adventerprisek9-m.SPA.159-3.M6 | 1 vCPU, 512 MB |
| HQ-PC | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
| Branch-GW | Check Point Security Gateway (cpsg2 template) | cpsg2-R81.20-Licensed | 2 vCPU, 4,096 MB |
| Branch-PC | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
| ADMIN-PC | EVE-NG Firefox browser (Docker) | eve-firefox:latest | 1 vCPU, 2,048 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
Check Point CCSA guided labs.Open
12 - Site-to-site VPN between two locally managed gatewaysand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More Check Point CCSA labs
Related labs in other courses
CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.