Check Point Certified VPN Specialist (CPVS) R82 (includes 180 days’ lab access)

• Security Administrators; Security Engineers 

• Security Consultants; Security Architects

NIST/NICE Work Role Categories 

• Implementation and Operation (IO) 

• Protection and Defense (PD)

Module 1: Check Point VPN Solution Overview 

• Identify the core components of the Check Point VPN solution. 

• Explain the differences between Site-to-Site, Remote Access, and Mobile Access VPN deployments. 

• Describe the encryption and key-exchange protocols used in Check Point VPNs. 

• Explain how Access Control policies affect VPN traffic flow. 

Lab tasks 

• Examine the existing VPN Configuration 

• Update the VPN to Use IKEv2 

• Verify VPN Operation 

Module 2: Site-to-Site VPN Configuration 

• Explain Site-to-Site VPN basics, deployment, and communities. 

• Describe pre-shared keys and certificates used to authenticate with third-party and externally managed VPN Gateways. 

• Explain Link Selection. 

• Explain tunnel management features. 

Lab tasks 

• Review the existing VPN Community 

• Modify the Topology (Mesh to Star) 

• Verify the VPN 

• Configure Fundamental Routing Settings 

• Edit the VPN Community 

• Modify the Access Control Policy 

• Verify the Route-Based VPN

Module 3: Advanced Site-to-Site VPN Configuration 

• Describe when externally managed certificate authentication is required. 

• Explain policy requirements for VPN routing (bidirectional rule coverage on the central Gateway). 

• Analyze key design factors for VPN and NAT integration. 

• Compare ISP Redundancy and SD-WAN use cases. 

• Implement a trusted external Certificate Authority (CA) trust workflow. 

Lab tasks 

• Review Route-Based VPN configuration 

• Reconfigure BGP Routing 

• Configure Route Redistribution 

• Verify VPN and Dynamic Routing 

• Configure Route-Based VPN with a Third-Party Peer 

• Configure BGP Communication 

• Modify OSPF Route Redistribution 

• VPN and Dynamic Routing 

Module 4: Remote Access VPN Configuration 

• Describe Check Point Remote Access solutions and how they differ from each other. 

• Describe how client security can be provided by Remote Access VPN. 

• Compare authentication methods and determine the appropriate option for a given deployment. 

• Describe Remote Access connectivity features, including Office Mode, Visitor Mode, and Hub Mode. 

• Explain Multiple Entry Point (MEP). 

• Configure a Remote Access VPN using SmartConsole. 

Lab tasks 

• Configure Remote Access VPN 

• Configure Office Mode 

• Configure and Verify Local User Authentication 

• Configure and Verify Active Directory Authentication 

• Verify Access to Internal Resources

Module 5: Advanced Remote Access VPN 

• Explain how Multiple Entry Points (MEP) improve Remote Access VPN availability. 

• Describe how Visitor Mode affects gateway selection and failover in MEP environments. 

• Explain how multiple login options work in Remote Access VPN authentication. 

• Describe certificate parsing and its role in user identity mapping. 

• Explain how advanced authentication methods (DynamicID and machine authentication) enhance security. 

Lab tasks 

• Review Remote Access VPN 

• Prepare Site Bravo 

• Enable Multiple Entry Point 

• Update Bravo Policy 

• Validate Primary Connectivity 

• Validate Failover 

Module 6: Mobile Access VPN 

• Explain how the Mobile Access Software Blade (MAB) secures remote communications. 

• Identify and differentiate Mobile Access features including portals, link translation, native applications, and reverse proxy. 

• Describe the Mobile Access security policy models. 

• Describe the additional Mobile Access protections, including endpoint compliance scanning and Secure Workspace. 

Lab tasks 

• Enable Mobile Access VPN 

• Configure Mobile Access Authentication 

• Configure Mobile Access Policy 

• Deploy the Guacamole Web Application 

• Configure Native Application Access to A-Host 

• Verify Mobile Access VPN Connectivity

Module 7: VPN Troubleshooting 

• Identify and use the appropriate troubleshooting and debug commands/tools to resolve VPN troubleshooting issues. 

• Understand the layered VPN troubleshooting methodology to isolate issues across Phase 1 (IKE), Phase 2 (IPSec), and traffic flow. 

• Describe the roles of the Check Point VPN Daemons — IKED and VPND — and the VPN kernel module in tunnel negotiation and traffic handling. 

• Understand how the debug workflow captures logs for tunnel-establishment and traffic-processing issues. 

• Differentiate between IKEv1 and IKEv2 negotiation phases when analyzing VPN troubleshooting information. 

• Recognize common VPN failure conditions and the tools used to investigate them. 

Lab tasks 

• Set the Stage 

• Troubleshoot Remote Access Traffic 

• Troubleshoot Alpha to Bravo Traffic 

• Troubleshoot Alpha to Charlie Traffic 

• Verify Restored Functionality 

• Restore the Environment

Solid knowledge 

• Unix-like and/or Windows operating systems 

• Internet 

• Networking Fundamentals 

• Networking Security 

• System Administration 

• TCP/IP Networking 

• Text Editors in Unix-like OS 

• Six months minimum practical experience with Check Point Security Management

Prepare for exam #156-845 at www.vue.com/checkpoint

An exam voucher can be purchased at an additional charge – please contact us for further information.

Full information on Check Point’s Certification Program can be viewed at https://www.checkpoint.com/downloads/training/check-point-certification-faq.pdf

Attend two Infinity Specialization courses and pass their exams to automatically become a Check Point Certified Security Master (CCSM).

Attend four Infinity Specialization courses and pass their exams to automatically become a Check Point Certified Security Master Elite (CCSM Elite).

Choose from the following Infinity Specialization courses:

• Check Point Certified Endpoint Specialist (CCES)

• Check Point Certified Troubleshooting Administrator (CCTA)

• Check Point Certified Automation Specialist (CCAS)

• Check Point Certified Cloud Specialist (CCCS)

• Check Point Certified Troubleshooting Expert (CCTE)

• Check Point Certified Maestro Expert (CCME)

• Check Point Certified Threat Prevention Specialist (CTPS)

Please note that Check Point only offer e-kit courseware for training courses. Each delegate will be provided with an official set of e-kit courseware.