VPN Specialist (CPVS)

DOC-TDS-CPVS-R82.10-V1.0

FRAMEWORK FOR SUCCESS Prepare for Success | Learn from Experts | Expand your Knowledge

Course Overview This course provides intermediate knowledge and hands-on experience in designing, configuring, and troubleshooting secure VPN solutions. You explore Site-to-Site, Remote Access, and Mobile Access VPN deployments. The course covers key technologies such as IPSec and IKE/IKEv2, VPN Communities, authentication methods, and encryption domains, with advanced topics like NAT integration, PKI, high availability, and SD-WAN. Through practical labs and real-world scenarios, participants develop the skills required to implement, manage, and troubleshoot secure VPN environments.

Course Details Prerequisites Target Audience • Security Administrators; Security Engineers • Security Consultants; Security Architects

Duration: 3 days

Accreditation: Yes

NIST/NICE Work Role Categories • Implementation and Operation (IO) • Protection and Defense (PD)

Solid knowledge • Unix-like and/or Windows operating systems • Internet • Networking Fundamentals • Networking Security • System Administration • TCP/IP Networking • Text Editors in Unix-like OS • Six months minimum practical experience with Check

Point Security Management

SUGGESTED

RECOMMENDED

RECOMMENDED

RECOMMENDED

SUGGESTED

SUGGESTED

CHECK POINT COURSES | LEARNING PATH

Click HereHow to Enroll

https://protect.checkpoint.com/v2/r02/___https://securityservices.checkpoint.com/categories/trainingprograms___.YzJlOmNwYWxsOmM6b2ZmaWNlMzY1X2VtYWlsc19hdHRhY2htZW50OjMzZWU0Njk4MDk0ZDJiYTdkMThkZGE4ZmUwZGU1YTQzOjc6Y2JkYzoxZWI5YTU5NmU1YmZmZjQ3YjE3NGZlMWJhNzAxZTJhYWI3OWNkZTgzOThmYTE2MTE3NDJmYmQzZDMxMjBmY2FiOnA6VDpO https://protect.checkpoint.com/v2/r02/___https://securityservices.checkpoint.com/categories/trainingprograms___.YzJlOmNwYWxsOmM6b2ZmaWNlMzY1X2VtYWlsc19hdHRhY2htZW50OjMzZWU0Njk4MDk0ZDJiYTdkMThkZGE4ZmUwZGU1YTQzOjc6Y2JkYzoxZWI5YTU5NmU1YmZmZjQ3YjE3NGZlMWJhNzAxZTJhYWI3OWNkZTgzOThmYTE2MTE3NDJmYmQzZDMxMjBmY2FiOnA6VDpO

VPN Specialist (CPVS)

DOC-TDS-CPVS-R82.10-V1.0

FRAMEWORK FOR SUCCESS Prepare for Success | Learn from Experts | Expand your Knowledge

Module 3: Advanced Site-to-Site VPN Configuration • Describe when externally managed certificate

authentication is required. • Explain policy requirements for VPN routing

(bidirectional rule coverage on the central Gateway). • Analyze key design factors for VPN and NAT integration. • Compare ISP Redundancy and SD-WAN use cases. • Implement a trusted external Certificate Authority (CA)

trust workflow.

Lab tasks • Review Route-Based VPN configuration • Reconfigure BGP Routing • Configure Route Redistribution • Verify VPN and Dynamic Routing • Configure Route-Based VPN with a Third-Party Peer • Configure BGP Communication • Modify OSPF Route Redistribution • VPN and Dynamic Routing

Module 4: Remote Access VPN Configuration • Describe Check Point Remote Access solutions and how

they differ from each other. • Describe how client security can be provided by Remote

Access VPN. • Compare authentication methods and determine the

appropriate option for a given deployment. • Describe Remote Access connectivity features,

including Office Mode, Visitor Mode, and Hub Mode. • Explain Multiple Entry Point (MEP). • Configure a Remote Access VPN using SmartConsole.

Lab tasks • Configure Remote Access VPN • Configure Office Mode • Configure and Verify Local User Authentication • Configure and Verify Active Directory Authentication • Verify Access to Internal Resources

Agenda Module 1: Check Point VPN Solution Overview • Identify the core components of the Check Point VPN

solution. • Explain the differences between Site-to-Site, Remote

Access, and Mobile Access VPN deployments. • Describe the encryption and key-exchange protocols

used in Check Point VPNs. • Explain how Access Control policies affect VPN traffic

flow.

Lab tasks • Examine the existing VPN Configuration • Update the VPN to Use IKEv2 • Verify VPN Operation

Module 2: Site-to-Site VPN Configuration • Explain Site-to-Site VPN basics, deployment, and

communities. • Describe pre-shared keys and certificates used to

authenticate with third-party and externally managed VPN Gateways.

• Explain Link Selection. • Explain tunnel management features.

Lab tasks • Review the existing VPN Community • Modify the Topology (Mesh to Star) • Verify the VPN • Configure Fundamental Routing Settings • Edit the VPN Community • Modify the Access Control Policy • Verify the Route-Based VPN

VPN Specialist (CPVS)

DOC-TDS-CPVS-R82.10-V1.0

FRAMEWORK FOR SUCCESS Prepare for Success | Learn from Experts | Expand your Knowledge

Module 7: VPN Troubleshooting • Identify and use the appropriate troubleshooting and

debug commands/tools to resolve VPN troubleshooting issues.

• Understand the layered VPN troubleshooting methodology to isolate issues across Phase 1 (IKE), Phase 2 (IPSec), and traffic flow.

• Describe the roles of the Check Point VPN Daemons — IKED and VPND — and the VPN kernel module in tunnel negotiation and traffic handling.

• Understand how the debug workflow captures logs for tunnel-establishment and traffic-processing issues.

• Differentiate between IKEv1 and IKEv2 negotiation phases when analyzing VPN troubleshooting information.

• Recognize common VPN failure conditions and the tools used to investigate them.

Lab tasks • Set the Stage • Troubleshoot Remote Access Traffic • Troubleshoot Alpha to Bravo Traffic • Troubleshoot Alpha to Charlie Traffic • Verify Restored Functionality • Restore the Environment

Module 5: Advanced Remote Access VPN • Explain how Multiple Entry Points (MEP) improve

Remote Access VPN availability. • Describe how Visitor Mode affects gateway selection

and failover in MEP environments. • Explain how multiple login options work in Remote

Access VPN authentication. • Describe certificate parsing and its role in user identity

mapping. • Explain how advanced authentication methods

(DynamicID and machine authentication) enhance security.

Lab tasks • Review Remote Access VPN • Prepare Site Bravo • Enable Multiple Entry Point • Update Bravo Policy • Validate Primary Connectivity • Validate Failover

Module 6: Mobile Access VPN • Explain how the Mobile Access Software Blade (MAB)

secures remote communications. • Identify and differentiate Mobile Access features

including portals, link translation, native applications, and reverse proxy.

• Describe the Mobile Access security policy models. • Describe the additional Mobile Access protections,

including endpoint compliance scanning and Secure Workspace.

Lab tasks • Enable Mobile Access VPN • Configure Mobile Access Authentication • Configure Mobile Access Policy • Deploy the Guacamole Web Application • Configure Native Application Access to A-Host • Verify Mobile Access VPN Connectivity

VPN Specialist (CPVS)

DOC-TDS-CPVS-R82.10-V1.0

FRAMEWORK FOR SUCCESS Prepare for Success | Learn from Experts | Expand your Knowledge

FRAMEWORK FOR SUCCESS

LEARN FROM EXPERTS

PREPARE FOR SUCCESS

CERTIFY YOUR SKILLS

START YOUR JOURNEY

EXPAND YOUR KNOWLEDGE

FRAMEWORK FOR SUCCESS The Check Point Framework for Success provides a path for continuous progress and lasting achievement as learners advance their knowledge and expertise in Check Point Security products.

Start your Journey Visit https://securityservices.checkpoint.com/categories/trainingprograms.

Training, Certifications, Education Programs, Free Resources, Cyber Park, and More.

Prepare for Success Free YouTube videos.

Learn from Experts Instructor-led technical training taught globally by ATC Partners.

Certify your Skills Visit Pearson Vue at vue.com/checkpoint.

Expand your Knowledge Advanced, self-paced training.