CloudLabBox
Try the free demo

Check Point CCSA lab 14 of 14

Troubleshooting capstone: SIC, routing, rule order and NAT

A contractor's half-finished rebuild has left Northgate with an untrusted gateway, no policy, no internet and an unreachable web site. Work like a support engineer: gather evidence with cp_conf, fw stat, routing, logs and fw ctl zdebug, fix four faults one at a time, and prove each fix.

Run this lab

It needs Standard: its 6 nodes are set to 10 vCPU and 15,872 MB in total.

In your workspace: Shared, then Check Point CCSA guided labs, then 14 - Troubleshooting capstone - SIC routing rule order and NAT

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 15,872 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
10 vCPU, 15,872 MB
Smallest plan
Standard

The scenario

A contractor rebuilt Northgate's head-office firewall over the weekend and left before finishing. The intended design is the one from labs 3 and 7: HQ-GW managed by SMS with SIC key Northgate-SIC-26, default route to the ISP at 67.83.0.113, the lab 3 rule set, hide NAT for the office and DMZ, and the web server published at 67.83.0.120. Monday's ticket: nobody can browse, and the web site is down.

Find and fix every fault. For each one, write down the symptom, the evidence that proved the cause, the fix, and the test that proves the fix. There are four faults.

What you’ll practise

  • Diagnose SIC failures and re-establish trust
  • Read installation errors and gateway policy state
  • Find a missing route on Gaia
  • Find drops with logs and fw ctl zdebug drop, and fix rule order
  • Find a NAT mistake by comparing the object, the ARP table and the traffic

The Lab Tasks pane has the scenario, the tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting capstone - SIC routing rule order and NAT6 nodes and 2 networks, 7 links. Every link is listed as text below the diagram.SMSHQ-GWISPHQ-PCDMZ-WEBADMIN-PCHQ-LANInternetGi0/0eth0eth0eth1eth0eth0eth2eth0
6 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-GW eth1 to Internet (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
  • HQ-GW eth2 to DMZ-WEB eth0
Nodes in Troubleshooting capstone: SIC, routing, rule order and NAT, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
DMZ-WEBAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSA guided labs.

  3. Open 14 - Troubleshooting capstone - SIC routing rule order and NAT and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSA labs

All Check Point CCSA labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.