WEBVTT

1
00:00.000 --> 00:00.068 align:middle line:84%


2
00:00.068 --> 00:02.610 align:middle line:90%
In the previous Nugget, we took
a look at some of the actions

3
00:02.610 --> 00:05.040 align:middle line:90%
that we can set up as part
of an axis control policy

4
00:05.040 --> 00:06.540 align:middle line:90%
and what they do
and what they mean.

5
00:06.540 --> 00:09.040 align:middle line:90%
And just for good measure before
we implement the rule let's

6
00:09.040 --> 00:11.760 align:middle line:90%
go to our client who's
on that inside network.

7
00:11.760 --> 00:13.740 align:middle line:90%
We'll do an ifconfig
just to confirm.

8
00:13.740 --> 00:18.060 align:middle line:90%
So this client's at 0.103,
and if we do a ping out

9
00:18.060 --> 00:20.340 align:middle line:84%
to 8.8.8.8--

10
00:20.340 --> 00:21.120 align:middle line:84%
that works, great.

11
00:21.120 --> 00:22.930 align:middle line:84%
Control C to stop that.

12
00:22.930 --> 00:24.030 align:middle line:84%
Let's ping something else.

13
00:24.030 --> 00:28.440 align:middle line:84%
Www.cisco.com, that looks great.

14
00:28.440 --> 00:29.520 align:middle line:84%
Great.

15
00:29.520 --> 00:30.970 align:middle line:90%
I just wanted to
make sure that we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.520 --> 00:30.970 align:middle line:90%
I just wanted to
make sure that we

16
00:30.970 --> 00:33.820 align:middle line:90%
had full connectivity
before we start restricting

17
00:33.820 --> 00:34.940 align:middle line:84%
some of that traffic.

18
00:34.940 --> 00:36.830 align:middle line:84%
So let's go to the FMC next.

19
00:36.830 --> 00:37.330 align:middle line:84%
All right.

20
00:37.330 --> 00:39.040 align:middle line:90%
So here at the
FMC we'll go ahead

21
00:39.040 --> 00:41.680 align:middle line:90%
and we'll modify our
access control policy

22
00:41.680 --> 00:43.090 align:middle line:84%
by adding a new rule to it.

23
00:43.090 --> 00:46.820 align:middle line:90%
We'll do that by clicking on the
Policies tab here at the top,

24
00:46.820 --> 00:49.390 align:middle line:90%
and then from below that if
it isn't already selected

25
00:49.390 --> 00:51.060 align:middle line:84%
we'll click on Access Control.

26
00:51.060 --> 00:52.060 align:middle line:84%
And that's where we are.

27
00:52.060 --> 00:52.723 align:middle line:84%
Fantastic.

28
00:52.723 --> 00:54.640 align:middle line:90%
And here's our starter
policy that's currently

29
00:54.640 --> 00:58.030 align:middle line:90%
being used on FTD-1, and
we'll click on the pencil icon

30
00:58.030 --> 00:59.853 align:middle line:84%
to edit that policy.

31
00:59.853 --> 01:01.270 align:middle line:90%
Now, why are these
all policies is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
00:59.853 --> 01:01.270 align:middle line:90%
Now, why are these
all policies is

32
01:01.270 --> 01:03.760 align:middle line:90%
that we can only have
one access control

33
01:03.760 --> 01:07.790 align:middle line:90%
policy applied to a given
firewall at any given time.

34
01:07.790 --> 01:09.400 align:middle line:90%
So we get lots of
different policies

35
01:09.400 --> 01:13.630 align:middle line:90%
and we could swap them out, but
only one access control policy

36
01:13.630 --> 01:16.700 align:middle line:84%
per firewall at any given time.

37
01:16.700 --> 01:19.120 align:middle line:90%
So with the Starter Policy
selected and the Rules tab

38
01:19.120 --> 01:24.450 align:middle line:90%
selected, let's go ahead and
click here to Add a New Rule.

39
01:24.450 --> 01:27.000 align:middle line:90%
And let's call this
No Ping to 8.8.8.8.

40
01:27.000 --> 01:29.000 align:middle line:90%
And instead of saying
from any zone to any zone,

41
01:29.000 --> 01:31.310 align:middle line:90%
let's specify that traffic
from an interface associated
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.000 --> 01:31.310 align:middle line:90%
let's specify that traffic
from an interface associated

42
01:31.310 --> 01:33.050 align:middle line:90%
with the inside zone
where the traffic's

43
01:33.050 --> 01:35.360 align:middle line:90%
coming into the firewall
and being ratted

44
01:35.360 --> 01:37.850 align:middle line:90%
out the outside zone or
an interface associated

45
01:37.850 --> 01:40.160 align:middle line:90%
with the outside
zone, and we could

46
01:40.160 --> 01:41.480 align:middle line:84%
click on the Networks tab.

47
01:41.480 --> 01:43.970 align:middle line:90%
We could be very granular
here about the source

48
01:43.970 --> 01:45.140 align:middle line:84%
and destination networks.

49
01:45.140 --> 01:46.860 align:middle line:90%
For the source I
don't really care.

50
01:46.860 --> 01:49.280 align:middle line:90%
We could add 10 if we wanted
to, but I'm really concerned

51
01:49.280 --> 01:50.197 align:middle line:84%
about the destination.

52
01:50.197 --> 01:52.700 align:middle line:90%
We want to focus on the
destination for this access

53
01:52.700 --> 01:55.370 align:middle line:84%
control rule to be 8.8.8.8.

54
01:55.370 --> 01:59.240 align:middle line:90%
So there is an object right
here, Google at 8.8.8.8,

55
01:59.240 --> 02:01.700 align:middle line:90%
and if there wasn't an object
that represented our target
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
01:59.240 --> 02:01.700 align:middle line:90%
and if there wasn't an object
that represented our target

56
02:01.700 --> 02:03.320 align:middle line:90%
we could click on
the plus symbol

57
02:03.320 --> 02:05.160 align:middle line:90%
and go ahead and create
it and then use it.

58
02:05.160 --> 02:08.030 align:middle line:90%
So here I'll just drag
and drop Google 8.8.8.8

59
02:08.030 --> 02:09.260 align:middle line:84%
over to the destination.

60
02:09.260 --> 02:12.110 align:middle line:90%
Our next thing we want
to match on is ports.

61
02:12.110 --> 02:14.280 align:middle line:84%
So we'll click on Ports.

62
02:14.280 --> 02:17.000 align:middle line:90%
Now, even though ICMP
really isn't a port,

63
02:17.000 --> 02:19.010 align:middle line:84%
it's really a protocol.

64
02:19.010 --> 02:21.290 align:middle line:90%
This is where we'd
specify that that's

65
02:21.290 --> 02:22.590 align:middle line:84%
what we want to match on.

66
02:22.590 --> 02:24.330 align:middle line:90%
So for the destination
we'll go ahead

67
02:24.330 --> 02:26.240 align:middle line:90%
and let's create a new
object that represents

68
02:26.240 --> 02:28.220 align:middle line:84%
an ICMP echo request.

69
02:28.220 --> 02:31.250 align:middle line:90%
So we'll click on plus
to create new object.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:28.220 --> 02:31.250 align:middle line:90%
So we'll click on plus
to create new object.

70
02:31.250 --> 02:40.840 align:middle line:90%
Click on Add Object and we'll
call this ICMP_Request_IPv4,

71
02:40.840 --> 02:43.365 align:middle line:90%
and it is going
to be ICMP and it

72
02:43.365 --> 02:46.930 align:middle line:90%
is going to be an echo
request, which is type 8.

73
02:46.930 --> 02:47.480 align:middle line:84%
Looks great.

74
02:47.480 --> 02:47.980 align:middle line:84%
All right.

75
02:47.980 --> 02:48.980 align:middle line:84%
And we'll click on Save.

76
02:48.980 --> 02:51.850 align:middle line:90%
We called this
ICMP_Request_IPv4.

77
02:51.850 --> 02:57.590 align:middle line:90%
Click on Save and then we'd go
ahead and grab that and select

78
02:57.590 --> 02:59.210 align:middle line:84%
that for the destination.

79
02:59.210 --> 03:01.840 align:middle line:90%
So if we have traffic that's
coming in on the inside,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:59.210 --> 03:01.840 align:middle line:90%
So if we have traffic that's
coming in on the inside,

80
03:01.840 --> 03:04.930 align:middle line:90%
going to the outside and
it's destined for 8.8.8.8

81
03:04.930 --> 03:07.540 align:middle line:90%
and it's ICMP and
in that ICMP payload

82
03:07.540 --> 03:10.310 align:middle line:90%
there's an echo request, then
it's going to be a match.

83
03:10.310 --> 03:13.870 align:middle line:90%
Now the question is, what do
we want to do as an action

84
03:13.870 --> 03:15.068 align:middle line:84%
if this is matched?

85
03:15.068 --> 03:17.110 align:middle line:90%
And that's what we're
supposed to have right here

86
03:17.110 --> 03:19.070 align:middle line:84%
in the dropdown for actions.

87
03:19.070 --> 03:22.030 align:middle line:90%
Do we want to allow it, which
allows for the processing?

88
03:22.030 --> 03:23.530 align:middle line:90%
Do we want to trust
it, which means

89
03:23.530 --> 03:25.330 align:middle line:84%
no further processing forward?

90
03:25.330 --> 03:28.510 align:middle line:90%
Or do we want to monitor it,
meaning at a log entry for it,

91
03:28.510 --> 03:30.533 align:middle line:90%
or do we want to
block that sucker?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:28.510 --> 03:30.533 align:middle line:90%
or do we want to
block that sucker?

92
03:30.533 --> 03:32.450 align:middle line:90%
And that's exactly what
we're going to choose.

93
03:32.450 --> 03:34.090 align:middle line:84%
There's block right there.

94
03:34.090 --> 03:36.100 align:middle line:90%
And also, while
we're here I'm going

95
03:36.100 --> 03:38.590 align:middle line:90%
to click on the Logging
tab and let's go ahead

96
03:38.590 --> 03:42.460 align:middle line:90%
and also do logging at the
beginning of this connection,

97
03:42.460 --> 03:46.030 align:middle line:90%
and that way we can see that
it happened in our events log.

98
03:46.030 --> 03:48.532 align:middle line:90%
So once that's all set
we'll click on Add.

99
03:48.532 --> 03:50.740 align:middle line:90%
We can also resize the
columns to see all the wording

100
03:50.740 --> 03:51.952 align:middle line:84%
if we want to as well.

101
03:51.952 --> 03:52.910 align:middle line:84%
But there's our policy.

102
03:52.910 --> 03:54.243 align:middle line:84%
So we're going to click on Save.

103
03:54.243 --> 03:56.318 align:middle line:90%
That's step number one,
and then step number two,

104
03:56.318 --> 03:57.860 align:middle line:90%
we're going to go
ahead and deploy it

105
03:57.860 --> 04:00.790 align:middle line:90%
so it actually takes effect on
the Firepower Threat Defense
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
03:57.860 --> 04:00.790 align:middle line:90%
so it actually takes effect on
the Firepower Threat Defense

106
04:00.790 --> 04:01.535 align:middle line:84%
appliance.

107
04:01.535 --> 04:02.410 align:middle line:84%
So we'll do that now.

108
04:02.410 --> 04:06.500 align:middle line:90%
We'll click on Save,
click on Deploy,

109
04:06.500 --> 04:09.130 align:middle line:90%
and then make sure
that FTD-1 is selected.

110
04:09.130 --> 04:10.630 align:middle line:90%
There's the access
control policies.

111
04:10.630 --> 04:12.463 align:middle line:90%
It's going to be modified
in this new policy

112
04:12.463 --> 04:14.057 align:middle line:90%
and we'll click
on Deploy and then

113
04:14.057 --> 04:16.390 align:middle line:90%
we'll give that like, I don't
know, a minute and a half.

114
04:16.390 --> 04:19.490 align:middle line:90%
90 seconds to go ahead
and do its magic,

115
04:19.490 --> 04:22.960 align:middle line:90%
push that policy out to
FTD-1, verify that it's good,

116
04:22.960 --> 04:25.700 align:middle line:90%
and then you and I will verify
that the policy is working

117
04:25.700 --> 04:28.070 align:middle line:90%
by trying a few more
pings from our client

118
04:28.070 --> 04:29.840 align:middle line:84%
on the inside network.

119
04:29.840 --> 04:30.520 align:middle line:84%
All righty.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:29.840 --> 04:30.520 align:middle line:84%
All righty.

120
04:30.520 --> 04:34.100 align:middle line:90%
Under Status it says that the
task of deployment is done.

121
04:34.100 --> 04:36.170 align:middle line:90%
And so let's go
ahead and try it.

122
04:36.170 --> 04:37.385 align:middle line:84%
Let's go over to our client.

123
04:37.385 --> 04:39.260 align:middle line:90%
So here in our client
let me hit the up arrow

124
04:39.260 --> 04:42.230 align:middle line:90%
key a couple of times,
leaving our ping to 8.8.8.8,

125
04:42.230 --> 04:44.950 align:middle line:84%
and that's great.

126
04:44.950 --> 04:46.210 align:middle line:84%
It's failing.

127
04:46.210 --> 04:49.020 align:middle line:90%
Now, the fact that
it's failing is good

128
04:49.020 --> 04:51.340 align:middle line:90%
and what we want to make
sure is that the other pings

129
04:51.340 --> 04:53.860 align:middle line:90%
to anywhere besides that
direction or that IP address

130
04:53.860 --> 04:55.150 align:middle line:84%
also work.

131
04:55.150 --> 04:57.280 align:middle line:90%
So we'll do a Control C,
hit the upper arrow key

132
04:57.280 --> 04:59.095 align:middle line:90%
a couple of times,
we'll ping cisco.com,

133
04:59.095 --> 05:01.270 align:middle line:84%
and that indeed is working.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
04:59.095 --> 05:01.270 align:middle line:84%
and that indeed is working.

134
05:01.270 --> 05:02.320 align:middle line:84%
That is great news.

135
05:02.320 --> 05:04.720 align:middle line:90%
And we can go verify some
of the details of that

136
05:04.720 --> 05:06.520 align:middle line:90%
by looking at the
log information

137
05:06.520 --> 05:09.700 align:middle line:90%
back on the Firepower
Management Center.

138
05:09.700 --> 05:13.060 align:middle line:90%
So back on the FMC, if we
click on the Analysis tab

139
05:13.060 --> 05:18.420 align:middle line:90%
here at the top, and then from
the sub-tab select Connections,

140
05:18.420 --> 05:20.490 align:middle line:90%
then from that
menu select Events.

141
05:20.490 --> 05:24.865 align:middle line:90%
So the breadcrumbs is
analysis, connections, events.

142
05:24.865 --> 05:25.740 align:middle line:84%
And that looks great.

143
05:25.740 --> 05:30.210 align:middle line:90%
So here we have a block of this
client trying to go to 8.8.8.8
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
05:25.740 --> 05:30.210 align:middle line:90%
So here we have a block of this
client trying to go to 8.8.8.8

144
05:30.210 --> 05:32.190 align:middle line:84%
and that was the echo request.

145
05:32.190 --> 05:35.340 align:middle line:90%
This little allow right
here is using UDP, great,

146
05:35.340 --> 05:36.932 align:middle line:90%
so that should have
been permitted.

147
05:36.932 --> 05:38.640 align:middle line:90%
And that UDP as I look
at the port number

148
05:38.640 --> 05:41.340 align:middle line:90%
right there, that's a DNS
requests because right after we

149
05:41.340 --> 05:45.270 align:middle line:90%
did our ping to cisco.com so
that DNS request to resolve

150
05:45.270 --> 05:47.550 align:middle line:90%
cisco.com to an IP
address, and then

151
05:47.550 --> 05:50.970 align:middle line:90%
it proceeded with the pings
right here to cisco.com

152
05:50.970 --> 05:54.540 align:middle line:90%
So it was between
DNS requests and ICMP

153
05:54.540 --> 05:56.610 align:middle line:90%
echo requests that
were all here allowed,

154
05:56.610 --> 05:59.858 align:middle line:90%
but the block happened
exactly as we expected it to.

155
05:59.858 --> 06:02.400 align:middle line:90%
In the previous Nugget, we took
a look at some of the actions
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
05:59.858 --> 06:02.400 align:middle line:90%
In the previous Nugget, we took
a look at some of the actions

156
06:02.400 --> 06:04.908 align:middle line:90%
that we can set up as part
of an access control policy

157
06:04.908 --> 06:07.200 align:middle line:90%
and what they do and what
they mean, and in this Nugget

158
06:07.200 --> 06:09.510 align:middle line:90%
we implemented an
example policy rule

159
06:09.510 --> 06:11.190 align:middle line:90%
and then verified
the results based

160
06:11.190 --> 06:13.690 align:middle line:90%
on the action we
assigned in that policy.

161
06:13.690 --> 06:15.480 align:middle line:90%
I hope this has been
informative for you

162
06:15.480 --> 06:18.680 align:middle line:90%
and I'd like to thank
you for viewing.