Check Point Advanced Network Threat Prevention [Sandblast]

outline of topology for three labs shows a three-interface checkpoint gateway linking a 192.168.1.0 dns server and a 172.16.0.0 mail server, with static routes and cloud sandblast deployment.

Learn how to deploy checkpoint sandblast to protect web traffic with threat emulation and threat extraction, enable https inspection, configure threat prevention policy, and review logs and user checks.

Install a DNS server on a Windows server to resolve mail traffic addresses for the Sandblast lab, using a straightforward role-based installation via Server Manager with admin privileges.

Enable the mail transfer agent on the perimeter firewall and configure domain routing to a separate mail server, using threat emulation and threat extraction blades to protect mail traffic.

Configure sandblast mail threat prevention policy with MTA traffic, enabling threat emulation and extraction, manage infected mail handling, headers, notifications, and digital signature behavior.

Configure DNS for sandblast domain by creating a primary zone, mapping users to IP addresses, and setting a mail exchanger to route SMTP mail.

Set up a mail server and domain for sandblast on a Windows lab, enable smtp receiving and sending, and IMAP and POP3, then test threat extraction with Check Point logs.

Explore hybrid mode in Sandblast, splitting traffic between cloud and a private on-prem appliance to protect private files, with threat emulation analysis defaulting to cloud and customizable file-type locations.

Explore emulation connection handling in threat prevention, detailing background and hold modes, custom mode for web and email traffic, and the threat extraction safe copy via TX overthinks.

Deploy the Check Point endpoint client and Sandblast agent to understand threat extraction, emulation, full disk encryption, endpoint policy management, and the licensing and deployment workflow.

Deploy endpoint client using the initial 25 MB package, then configure Sandblast blades via a deployment policy. The process includes a 30-second heartbeat and remote access VPN licensing notes.