---
# System prepended metadata

title: 邁達特_經銷商進階教育訓練Lab Guide
tags: [教育訓練, Checkpoint]

---

# 環境說明
![image](https://hackmd.io/_uploads/BJhk9JYO6.png)

172.20.10.x  Management 可用 IP : 172.20.10.100-172.20.10.199  GW:172.20.10.10
172.20.11.x  Firewall-Ext 可用 IP : 172.20.11.100-172.20.11.199  GW:172.20.11.10
172.20.12.x  Client-Int 可用 IP : 172.20.12.100-172.20.12.199
172.20.13.x  Heartbeat可用 IP : 172.20.13.100-172.20.13.199

## Lab1
### Lab1.1 設定Cluter HA
此時介面如下
![image](https://hackmd.io/_uploads/SJkzJqwt6.png)
點選新增按鈕 -> Cluster -> Cluster
![image](https://hackmd.io/_uploads/rJtty9vFa.png)
選擇左側Wizard Mode
![image](https://hackmd.io/_uploads/Hyxjy5DKp.png)
設定資訊如下
Cluster Name:Cluster
Cluster IPv4 Address:172.20.10.199
High Availability
![image](https://hackmd.io/_uploads/BkIXgqPt6.png)
按下Add -> Add Existing Gateway 
![image](https://hackmd.io/_uploads/S1pDx9wKT.png)
將CP-SG1/CP-SG2加入Cluster
![image](https://hackmd.io/_uploads/HJctlqPYa.png)
此時會出現一個警告說會變成Cluster Member 按下Yes
![image](https://hackmd.io/_uploads/SJ4slqvt6.png)
會出現一個Cluster警告,後續再開啟Cluster Member
![image](https://hackmd.io/_uploads/SJMyWqwFp.png)
完成後如下圖 按下Next
![image](https://hackmd.io/_uploads/rya8W9PYa.png)
172.20.13.0 設定為Cluster Synchronization -> Primary
![image](https://hackmd.io/_uploads/Hk4SD9DKT.png)
172.20.12.0設定172.20.12.199/255.255.255.0
![image](https://hackmd.io/_uploads/rylZuqwtp.png)
172.20.11.0設定172.20.11.199/255.255.255.0
![image](https://hackmd.io/_uploads/Bk_9dcDYT.png)
172.20.10.0設定172.20.10.199/255.255.255.0
![image](https://hackmd.io/_uploads/HkmuuqDt6.png)
完成後按下Finish -> 介面顯示如下
![image](https://hackmd.io/_uploads/rJoR_qDta.png)
進行Install policy
注意勾選For gateway cluster, if installation on a cluster member fails, do not install on the cluster.
![image](https://hackmd.io/_uploads/rk8LMjvtp.png)

點開左下腳 Mputty
![image](https://hackmd.io/_uploads/B1COKqPKp.png)
連線進入172.20.10.101/102
1. 按下cpconfig
2. 按下6 去Enable cluster membership for this gateway
3. 按下y

![image](https://hackmd.io/_uploads/SkTFj5wFa.png)
最後Reboot生效
![image](https://hackmd.io/_uploads/BJQY29DFT.png)

第二台再執行一次
![image](https://hackmd.io/_uploads/Sy952cPFp.png)

完成後顯示正常畫面如下圖
![image](https://hackmd.io/_uploads/rJh84jvt6.png)
點開mPutty
輸入cphaprob state
可以顯示目前cluster狀態
![image](https://hackmd.io/_uploads/ryezPsPtT.png)



## Lab 2
### Lab2.1 匯入hosts.csv到SMS

透過winscp把hosts.csv上傳到/home/admin資料夾中
檔案在downloads
![image](https://hackmd.io/_uploads/rkWUMqO96.png)


先更改default shell 否則無法傳SCP
利用mPutty登入SMS 172.20.10.100
```
>lock database override
>set user admin shell /bin/bash
>save config
```
![image](https://hackmd.io/_uploads/r1crbihYT.png)

第一次登入跳出fingerprint警告
![image](https://hackmd.io/_uploads/SJK8ej3tp.png)
警告標語->按下Yes
![image](https://hackmd.io/_uploads/SJCdes3K6.png)
輸入密碼
![image](https://hackmd.io/_uploads/rJ6Kgs3F6.png)
登入成功,開啟視窗 左側是windows 選擇hosts_objects.csv 拉到右側/home/admin目錄
![image](https://hackmd.io/_uploads/ryeCbshtT.png)
按下OK 注意到hosts_objects.csv在目錄下面
![image](https://hackmd.io/_uploads/S130-j2Yp.png)


### Lab2.2 透過SMS API command一次建立多個物件
重新連入SMS ssh console
注意此時進入Expert Mode #
且hosts_objects.csv在目錄下面
![image](https://hackmd.io/_uploads/ryHqfinYp.png)
輸入指令mgmt_cli add host –batch hosts_objects.csv
然後做login
![image](https://hackmd.io/_uploads/r1aiDs3tp.png)

回到SMS 點選Object Exployer
可看到hosts_objects.csv中的物件都已經建立
![image](https://hackmd.io/_uploads/BJEW_o3Ka.png)

## Lab3 
### Lab3.1 切換ClusterXL 模式到 load sharing (AA mode)
點選Cluster物件 按下edit　或是直接點兩下
![image](https://hackmd.io/_uploads/r1uKosntp.png)

點選ClusterXL and VRRP

### Lab3.2 查找SK
打開Google瀏覽器搜尋 Check Point Daemon
![image](https://hackmd.io/_uploads/Sy-kXqO9T.png)
點選SK97638 Check Point Processes and Daemons

下滑搜尋 cpd
可以看到此process的功能 使用的port
Description等等資訊
![image](https://hackmd.io/_uploads/BkD87qOq6.png)

延伸練習 利用cpwd_admin list 並選一個process查詢看看功能與作用

![image](https://hackmd.io/_uploads/BJwU2b5qa.png)

## Lab4

### Lab4.1 檢視Logs
切換到LOGS & MONITOR > Logs中

可在此視窗看到Logs
![image](https://hackmd.io/_uploads/HyPTIh3Ka.png)

### Lab4.2 檢視View
回到Gateway & Services
點選SMS並開啟 Smartevent
![image](https://hackmd.io/_uploads/HyaaFN0Ka.png)

點選左上角
Install database
![image](https://hackmd.io/_uploads/rJouPh3tp.png)
按下Install
![image](https://hackmd.io/_uploads/BJRFwhhFa.png)
還沒開啟SmartEvent前畫面如下
![image](https://hackmd.io/_uploads/ryNh_h3tT.png)
完成後顯示,若沒有出現可以重開SmartConsole
![image](https://hackmd.io/_uploads/Hyci3R3KT.png)

點選New Tab可在中間看到預設四組View

點選組邊View可開啟其他預設View


嘗試開啟不同的View，看看有甚麼不同

### Lab4.3 檢視Report，並建立排成報表
點選New Tab
選擇Report
![image](https://hackmd.io/_uploads/S1XieyTtT.png)

選取Network Activity再點選Export to PDF
點選OK

![image](https://hackmd.io/_uploads/ryzRW16ta.png)

執行完成的報表可以在Archive中download到本機
選取不同的Report範本建立報表，檢視內容
![image](https://hackmd.io/_uploads/HJuqQkpY6.png)
回到Report
點選Network Security
點選Action -> Scheduled PDF
![image](https://hackmd.io/_uploads/B1AWnl6F6.png)
調整排程報表時間
請設定當下時間後的五分鐘
![image](https://hackmd.io/_uploads/BJ3MaeaKa.png)
設定好的排成報表可在Tasks > Scheduled中檢視

過五分鐘後可在Archive檢視產生好的排成報表

![image](https://hackmd.io/_uploads/HyMBpxat6.png)
## Lab5
### Lab5.1啟動Anti-Virus、Anti-Bot、ThreatEmulation、ThreatExtration
切換回HA mode  ThreatExtration只支援HA mode
![image](https://hackmd.io/_uploads/H1ogQbTKa.png)
啟動各功能如下圖
![image](https://hackmd.io/_uploads/B1fp-bpY6.png)
啟用後Instal Policy 注意到Active Blades
![image](https://hackmd.io/_uploads/SJenNXCtT.png)


### Lab5.2設定Anti-Virus Policy

登入SmartConsole後，切換到SECURITY POLICY > Threat Prevention > Policy中
![image](https://hackmd.io/_uploads/ry6zU7At6.png)
在Action欄位點選滑鼠右鍵，選擇New新建一個policy profile
![image](https://hackmd.io/_uploads/SJJeDmCFp.png)
取一個profile name，勾選Anti-Bot、Anti-Virus、Threat Emulation。IPS
![image](https://hackmd.io/_uploads/BJ6MOQCK6.png)

切換到Anti-Virus可調整細部設定
Protected Scope選擇Inspect incoming and outgoing files
File Types選擇Process ll file types
點選OK
![image](https://hackmd.io/_uploads/By0IOQRtp.png)
Policy profile修改成剛剛新建的profile，記得

編輯Threat Prevention Policy profile
![image](https://hackmd.io/_uploads/Bkyz07RKT.png)

切換到Threat Emulation > General中

Protected Scope選擇Inspect incoming and outgoing files
![image](https://hackmd.io/_uploads/SyH7JV0t6.png)
切換到Advanced
並確認為Rapid Delivery，點選OK

Publish and install policy
![image](https://hackmd.io/_uploads/HJDO1EAFT.png)

Publish and install policy
![image](https://hackmd.io/_uploads/HJgZliQ0Kp.png)

注意Threat Prevention 這個要有勾選才會生效
![image](https://hackmd.io/_uploads/HJ_3d7Ct6.png)
