CloudLabBox
Try the free demo

Firewalls and VPNs lab 6 of 16

Check Point to IOS with an interoperable device

Connect a Cisco IOS branch router to a Check Point gateway. Describe the router to the management server as an interoperable device, give each side its VPN domain, build a star community with IKEv2 and a pre-shared key, allow the traffic in the policy, then mirror it all in an IOS crypto map and prove the tunnel on both vendors' own commands.

Run this lab

It needs Standard: its 5 nodes are set to 9 vCPU and 13,824 MB in total.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 06 - Check Point to IOS with an interoperable device

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 9 vCPU and 13,824 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
9 vCPU, 13,824 MB
Smallest plan
Standard

The scenario

Aldwick Foods runs a Check Point gateway at head office, managed from its own server. The new branch has a Cisco router, which the Check Point server will never manage. Connect the branch LAN (172.16.0.0/24) to HQ-LAN (10.0.0.0/24) through an encrypted tunnel to this standard:

SettingValue
CommunityStar, Aldwick-Branches: centre HQ-GW, satellite BRANCH-RTR
EncryptionIKEv2 only; phase 1 AES-256, SHA-256, DH group 19; phase 2 AES-256, SHA-256, PFS group 19
AuthenticationPre-shared key Aldwick-Branch-VPN-2026
VPN domainsHQ-GW: HQ-LAN; BRANCH-RTR: Branch-LAN (172.16.0.0/24)
PolicyAny service between HQ-LAN and Branch-LAN through the community, logged
DeviceInterfaceAddressNotes
SMSeth010.0.0.110/24Management server
HQ-GWeth0 / eth110.0.0.111/24 / 67.83.0.111/24Main IP 67.83.0.111
HQ-PCGi0/010.0.0.10/24Gateway 10.0.0.111
ISPGi0/0 / Gi0/167.83.0.113/24 / 198.51.100.1/30Knows no private address
BRANCHGi0/0 / Lo0198.51.100.2/30 / 172.16.0.1/24Lo0 stands in for the branch LAN

What you’ll practise

  • Explain VPN domains, communities and why an externally managed peer needs an interoperable device
  • Create an interoperable device and define its VPN domain
  • Build a star community with IKEv2 and a pre-shared key
  • Write an access rule that matches a VPN community
  • Mirror the Check Point VPN domains in an IOS crypto map ACL
  • Verify the tunnel with vpn tu tlist, show crypto ikev2 sa and show crypto ipsec sa

The tasks

  1. Check the starting point
  2. Objects and VPN domains
  3. The community
  4. Policy
  5. The IOS side
  6. Bring it up and prove it

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Check Point to IOS with an interoperable device5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.SMSHQ-GWISPBRANCHHQ-PCHQ-LANGi0/0eth0eth0Gi0/1Gi0/0eth1Gi0/0
5 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • HQ-GW eth0 to HQ-LAN (network)
  • HQ-PC Gi0/0 to HQ-LAN (network)
  • HQ-GW eth1 to ISP Gi0/0
  • ISP Gi0/1 to BRANCH Gi0/0
Nodes in Check Point to IOS with an interoperable device, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
HQ-GWCheck Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
BRANCHCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQ-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 06 - Check Point to IOS with an interoperable device and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.