Checkpoint SD-WAN Lab

Check Point's SD-WAN solution centralizes traffic routing across multiple WAN links, continuously measuring link quality to steer applications onto the best available path and failing over automatically when conditions degrade. It builds encrypted tunnels between sites to connect branches, data centers, and cloud networks under consistent policy, improving application performance, increasing resiliency through link diversity, and replacing device-by-device configuration with centrally managed routing intent governed through SmartConsole.

Goals

This lab provides a hands-on environment for practicing core Check Point SD-WAN configuration concepts. It covers policy configuration, VPN enablement, and overlay tunnel creation and configuration, while building familiarity with SmartConsole and Gaia WebUI for management and troubleshooting. The lab demonstrates how Check Point capabilities work together to configure SD-WAN and enforce security policy across WAN traffic.

Objectives

By completing this lab, you will be able to:

• Navigate SmartConsole and Gaia WebUI to review and validate an existing Check Point SD-WAN deployment.
• Enable VPN on a Check Point gateway and configure the settings required to support SD-WAN overlay connectivity.
• Build and install SD-WAN nano agents on security gateways 
• Create and configure overlay tunnels between branch and hub sites, defining the transport links  tunnel parameters.
• Use SmartConsole Logs and Events and gateway monitoring tools to verify tunnel status.

Hardware

• Security Management Server (dc1-cpsms) – virtual appliance (1 vCPU, 4–8 GB RAM, 50 GB disk)
• Branch Firewalls (br1-cpfw01, br2-cpfw01) – virtual appliances (2 vCPU, 4–8 GB RAM, 50 GB disk each)
• Data Center Cluster (dc1-cpfwcluster01, dc1-cpfwcluster02, dc1-cpfwcluster03) – virtual appliances for ElasticXL (2–4 vCPU, 8 GB RAM, 50 GB disk each)
• Lab Workstation – Windows 10/11 with SmartConsole, RDP, and MTPuTTY installed (2 vCPU, 4 GB RAM)
• Branch Clients – Windows 10 virtual machines (br1-win10-client, br2-win10-client) (2 vCPU, 2–4 GB RAM)
• Data Center Server – Ubuntu Server (dc1-ubuntu-server) for SSH testing (1–2 vCPU, 2 GB RAM)

Software

• Check Point R82
  • Security Management Server software (SmartConsole + Management blades)
  • Security Gateway software with blades: Firewall, VPN, Threat Prevention, Identity Awareness (optional), Logging & Monitoring
  • ElasticXL clustering enabled for Data Center firewalls
• SmartConsole R82 – installed on Lab Workstation for management and policy configuration
• Windows 10/11 Clients – used for RDP access, browsing, SSH testing
• Ubuntu Server (22.04 LTS or similar) – running OpenSSH for NAT/SSH exercises
• MTPuTTY – multi-session SSH client for lab management
• RDCMan or Remote Desktop – for connecting to Windows clients
• Wireshark or tcpdump – optional tools for traffic analysis