CHECK POINT · CAPSTONE

Check Point-style capstone: a resilient site and its branch

Put it all together. Headquarters is a cluster. A branch, GW3, connects to it through a community, and the tunnel ends on the cluster’s virtual address, so a failover doesn’t move it. PC1 still reaches the internet hidden behind the cluster, and nothing reaches the gateways themselves.

Check Point-style track · Check Point-style, Buddy Security Console, Cisco router · 5 objectives

Open in simulator More Check Point-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Build CL1 from GW1 and GW2: sync eth4, virtual addresses 192.168.1.1 (internal) and 203.0.113.1 (external). LAN (192.168.1.0/24) hides behind it, with an INSIDE-OUT rule.
Add GW3 at 10.0.0.4 (password LABKEY), with its interfaces and topology. Add object LAN3 (192.168.3.0/24).
Community HQ-BRANCH with CL1 and GW3, with NAT disabled inside it, VPN domains LAN and LAN3, and a VPN rule. Stealth rule at the top, destination CL1. Publish, and install on CL1 and GW3.
PC1 reaches 8.8.8.8 and PC3 (192.168.3.10). R1 can’t ping 203.0.113.1.
On GW1: clusterXL_admin down. PC1 still reaches PC3 through GW2.

Start this lab

Before you start

Rule order matters: the stealth rule first, then the VPN rule, then the general one. A member’s own interfaces belong to the cluster, so a community names the cluster and not its members.

Concept

A cluster shares virtual addresses

Two gateways act as one. Each keeps its own address, and the active member answers on the shared virtual ones, which is what hosts and routers use. A direct sync cable lets each see the other. Without it, each thinks it is alone and both stay active.

Concept

A VPN community, not a tunnel

Each gateway has a VPN domain, the network behind it. A community says which gateways talk: meshed links every pair, and star links satellites to centers. Traffic between two domains in a community gets encrypted, and a rule with the community in its VPN column allows it. Hide NAT breaks this unless it is disabled inside the community, because a hidden address no longer matches its domain.

Concept

A rule names objects, and NAT lives on them

Automatic NAT is set on a host or network, not in a rule. The object stands for both its addresses, so a rule names the object and you never write the public address. A rule that hides another fails verification, because nothing could ever reach the lower one.