We provide course about Certified Troubleshooting Administrator (CCTA) R82. This course provides security professionals with the fundamental skills required to troubleshoot Check Point Quantum Security Management Servers and Security Gateways running the Gaia R82 operating system.
Course description:
Participants learn structured troubleshooting methodologies and gain hands-on experience with traffic monitoring, packet capture analysis, and problem isolation across key security components. The course combines theory with extensive practical labs, focusing on real-world troubleshooting scenarios in enterprise security environments.
Key takeaways:
After completing this course, participants will have the knowledge and practical skills required to effectively troubleshoot Check Point Quantum security environments.
• Apply structured troubleshooting methodologies using the OSI model
• Monitor traffic and analyze logs to identify security issues
• Capture and analyze packets using CLI tools and Wireshark
• Troubleshoot policy, routing, and NAT-related issues
• Diagnose and resolve process-related problems on Gaia systems
• Troubleshoot SmartConsole connectivity and functionality
• Resolve log collection and communication issues
• Troubleshoot Identity Awareness, Application Control, and URL Filtering
Course content:
Module 1 - Troubleshooting methodology and system analysis:
• The course begins with an introduction to troubleshooting principles and methodologies. Participants learn how to use the OSI model for problem isolation and how to analyze system resources, performance metrics, and diagnostic outputs on Check Point Security Gateways and Management Servers.
Module 2 - Traffic monitoring and packet capture fundamentals:
• Participants learn how traffic monitoring and packet captures are used during troubleshooting. The section covers log analysis, traffic flow verification, routing validation, and policy troubleshooting.
Module 3 - Packet capture analysis using CLI:
• This section focuses on packet capture analysis using command-line tools such as tcpdump, fw monitor, cppcap, and CPMonitor. Participants learn how to interpret outputs, apply filters, and analyze traffic directly from the CLI.
Module 4 - Packet capture analysis using Wireshark:
• Participants gain hands-on experience analyzing packet captures using Wireshark. Topics include capture file handling, coloring rules, and in-depth traffic analysis using both interface and FW Monitor captures.
Module 5 - Process troubleshooting on Gaia:
• This section covers troubleshooting of Check Point processes, including user space, kernel space, and firewall processes. Participants learn how to verify process states and diagnose process connectivity issues.
Module 6 - SmartConsole and log collection troubleshooting:
• Participants learn how to troubleshoot SmartConsole access issues and investigate log collection problems between Security Gateways and Security Management Servers.
Module 7 - Identity Awareness troubleshooting:
• This section focuses on troubleshooting advanced Identity Awareness issues using appropriate commands and diagnostic tools.
Module 8 - Application Control and URL Filtering troubleshooting:
• The course concludes with troubleshooting Application Control and URL Filtering issues, focusing on policy behavior, traffic inspection, and restoring normal operation.
Instructor: Thomas Norbeck
Thomas Norbeck er uten tvil Norges ledende instruktør på opplæring innen Check Points produkter, og gjennomfører både sertifiseringskurs og bedriftsintern kurs på Check Point versjoner og produkter. Thomas sin nøkkelkompetanse ligger innen Check Point spesielt, men også nettverksteknologi og sikkerhet generelt. I tillegg har han vært involvert i flere IT- og infrastruktur-prosjekter både som teknisk ressurs og som prosjektleder.
I ulike perioder har Thomas jobbet som konsulent parallelt med at han har opparbeidet lang erfaring med utvikling, tilpasning og gjennomføring av skreddersydde kurs for bedrifter innen ulike sektorer. Blant annet har han laget og gjennomført nettverkskurs på fire ulike kontinenter. Thomas Norbeck har 24 års erfaring med nettverk og sikkerhet både som instruktør og konsulent hos bl.a Azlan, A-Team, Ajourit og Curriculum før han begynte i Glasspaper i 2004. Han jobber i dag som Senior konsulent og instruktør for Glasspaper, samt at han er IT sjef og konsulentleder.
Target audience:
• Security Administrators
• Security Engineers
• Security Analysts
• Security Consultants
• Security Architects
Recommended prerequisites:
• Knowledge of Unix-like and/or Windows operating systems
• Understanding of networking fundamentals and TCP/IP
• Basic knowledge of network security and system administration
Note: A valid CCSA or CCSE certification is required to take the CCTA exam
Language:
• English course material, norwegian speaking instructor
Certification:
This course prepares participants for the Certified Troubleshooting Administrator (CCTA) exam (Exam 156-583). A valid or expired CCSA or CCSE certification is required to take the certification exam.