Course Description
This three-day course offers comprehensive training to enhance enterprise knowledge of VPN-1 NGX troubleshooting, network planning, and route-based VPN. For students who have completed NGX II and need VPN-1 troubleshooting skills, this class provides hands-on experience with Firewall-1 debug mode, VPN-1, and IKE debug modes to identify issues in each of these features, lab experience with route-based VPN and OSPF routing over VPN tunnels. Students work with fw monitor commands to capture packets as the pass through the Check Point Inspect Engine, and use the Check Point Infoview, and IKEview troubleshooting utilities.
Certification
Exam #156-515.65 - CCSE Plus NGX R65
Who Should Take This Course?
- You are a system administrator, security manager, or network engineer supporting installations of VPN-1 NGX, and who needs the tools to troubleshoot and maintain these installations.
- A CCSE seeking their Check Point Certified Security Expert Plus NGX (CCSE Plus NGX) certification
Course Fee: $2,995
Course Prerequisites
- Check Point Security Administration I NGX R65
- Check Point Security Administration II NGX R65
Course Objectives
After completion of this course, participants will learn
- How to troubleshoot NGX product problems using troubleshooting guidelines
- How to monitor and evaluate security gateway and OS perfomance
- How to back up, restore, and upgrade a SmartCenter Server and VPN-1 Pro Security Gateway
- How to troubleshoot NGX problems using troubleshooting utilities
- How to perform NGX kernel debugging
- How to perform user level process debugging
- How to troubleshoot security server issues
- How to use VPN debugging tools
- How to troubleshoot remote access VPN issues
- How to configure advanced VPNs
- How to troubleshoot ClusterXL problems
- How to deploy and test ClusterXL
- How to implement Office Mode
Course Outline
Chapter 1: General Troubleshooting
- Troubleshooting Guidelines
- Before Installing VPN-1 NGX
- IP forwarding and Boot Security
- SIC and ICA Issues
- Network Address Translation
- Lab 1: Initial Installation
- Install the Security Gateway
- Install the City Site Web Server
- Install Primary SmartCenter Server
- Lab 2: Enable SCP on SecurePlatform (optional)
- Implement SCP on SecurePlatform
Chapter 2: Network Monitoring
- State Tables and Kernel Memory
- Lab 3: Configure SNMP
- Configure SNMP on SecurePlatform
- Testing snmp locally
- Testing snmp queries from SNMP Manager
- SNMP Trap
- Lab 4: Configure SNMP Manager (optional)
- Installing SNMP Manager
Chapter 3: Disaster Recovery
- Filing Structures
- Recovery Methods
- Lab 5: Recovering SmartCenter Server
- Recovering a SmartCenter Server
Chapter 4: Troubleshooting Utilities
- cpinfo
- Lab 6: Using cpinfo
- Run cpinfo on the Security Gateway
- Examine cpinfo Output File
- Run cpinfo on the SmartCenter Server
- Lab 7: Analyzing cpinfo in InfoView
- Open Gateway cpinfo in InfoView
- Review Installed Products, System, Licence, and other information
- Launch SmartDashboard in InfoView
- Lab 8: Object Filler (optional)
- Converting Cisco to Check Point
Chapter 5: Protocol Analyzers
- tcpdump
- snoop
- fw monitor
- Wireshark
- Lab 9: Comparing Client-Side NAT vs. Server-Side NAT with fw monitor
- Configure Automatic Static NAT for www.yourcity.cp
- Run fw monitor while webdallas Browses the NAT Address of www.yourcity.cp
- Disable Client-Side NAT
- Add Host Route on fwyourcity Gateway
- Run fw monitor while Browsing NAT IP Address
- Run fw monitor to Capture Browsing NAT IP of www.yourcity.cp
Chapter 6: NGX Kernel debugging
- Fw ctl debug
- Fw Commands
- Fw ctl Commands
- Other fw Commands
- Fw Advanced Commands
- Fwm Commands
- Lab 10: fw ctl debug
- Run fw ctl debug
Chapter 7: User-level process debugging
- NGX User Processes
- Debugging fwd
- Debugging fwm
- Debugging cpd
- Watchdog process - cpwd
- Lab 11: Using cpd and fwm Debugging
- Run debugs
- Replicate the Problem
- Turn off debugs
- View the Output
Chapter 8: Security Servers
- The Folding Process
- Troubleshooting Security Server Issues
- Debugging Security Servers
- Messaging Security
Chapter 9: VPN Debugging Tools
- IKE Basics
- Troubleshooting Overview
- VPN Debugging Tools
- Troubleshooting Tables
- Lab 12: Troubleshooting Site to Site VPN
- Configure the local Gateway
- Configure the peer
- Lab 13: Debug Site to Site #1
- Replicate the failure
- Lab 14: Debug Site to Site #2
- Troubleshooting Site to Site Failure
Chapter 10: Debugging Remote Access
- Remote Access Overview
- SecureClient Ports
