WEBVTT

1
00:00.000 --> 00:03.640
So friends before we actually finished this skill, what I want to do is to

2
00:03.640 --> 00:04.360
actually address

3
00:04.360 --> 00:09.100
the subject of configuring our firewall utilizing Ansible Recall and the

4
00:09.100 --> 00:10.440
earlier videos, we

5
00:10.440 --> 00:14.280
actually disabled the firewall.

6
00:14.280 --> 00:18.180
Because quite simply what it was doing, it was blocking access to our HTTP

7
00:18.180 --> 00:18.840
server.

8
00:18.840 --> 00:22.440
So let's see how we can go and actually modify this there, okay?

9
00:22.440 --> 00:25.970
So what I want to do is I want to go to my browser and if you search for Ans

10
00:25.970 --> 00:27.000
ible Firewall

11
00:27.000 --> 00:29.880
D, let's click this top link here.

12
00:29.880 --> 00:33.390
Now we can see here this module is part of the Ansible Politics Collection, but
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.880 --> 00:33.390
Now we can see here this module is part of the Ansible Politics Collection, but

13
00:33.390 --> 00:33.640
if you

14
00:33.640 --> 00:36.910
don't have this collection installed in user command Ansible Galaxy Collection

15
00:36.910 --> 00:37.680
Install Ansible

16
00:37.680 --> 00:40.760
Dot Politics, and then you can access this module.

17
00:40.760 --> 00:44.040
Now it says here in the synopsis, this module is going to allow for the

18
00:44.040 --> 00:45.080
addition or deletion

19
00:45.080 --> 00:46.880
of services and ports.

20
00:46.880 --> 00:50.930
So pretty much if you want to allow or disallow a service such as SSH, you can

21
00:50.930 --> 00:51.680
specify the

22
00:51.680 --> 00:55.390
service itself, or if you wish, you can target a particular port, you can say

23
00:55.390 --> 00:56.120
listen, I want

24
00:56.120 --> 01:02.840
to close off port 1, 2, 3 on TCP or conversely open up port whatever it may be.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:56.120 --> 01:02.840
to close off port 1, 2, 3 on TCP or conversely open up port whatever it may be.

25
01:02.840 --> 01:06.960
So let's scroll on right down here, check out this option here in Mediate.

26
01:06.960 --> 01:10.480
This is going to be a billion value, now by default it's set to false.

27
01:10.480 --> 01:13.950
If we set it to true though, what it means is that the configuration that you

28
01:13.950 --> 01:14.600
're setting

29
01:14.600 --> 01:18.310
is going to be applied immediately if the configuration has been set as

30
01:18.310 --> 01:19.160
permanent.

31
01:19.160 --> 01:22.160
So let's go and look at this permanent status, scrolling on down, we can see

32
01:22.160 --> 01:22.920
here permanent

33
01:22.920 --> 01:27.100
as a parameter that again takes a billion value, and pretty much what it's

34
01:27.100 --> 01:28.600
saying here is that

35
01:28.600 --> 01:32.610
should this configuration be ended running firewall deconfiguration or
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.600 --> 01:32.610
should this configuration be ended running firewall deconfiguration or

36
01:32.610 --> 01:33.640
processed across

37
01:33.640 --> 01:37.620
reboots, basically do you want the change that you just made to be temporary,

38
01:37.620 --> 01:38.080
and when

39
01:38.080 --> 01:41.570
you reboot the system it's going to flush out that firewall rule, or

40
01:41.570 --> 01:42.640
alternatively you

41
01:42.640 --> 01:46.800
can have it processed with permanence, this is all we're talking about here.

42
01:46.800 --> 01:50.750
Now if you want to specify a particular port or a particular range of ports to

43
01:50.750 --> 01:51.480
maybe remove

44
01:51.480 --> 01:55.710
or add from your firewall you can use the port option, whereas scrolling on

45
01:55.710 --> 01:56.280
down if you

46
01:56.280 --> 02:00.210
just want to specify a particular service then you can just use the service
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:56.280 --> 02:00.210
just want to specify a particular service then you can just use the service

47
02:00.210 --> 02:00.840
keyword which

48
02:00.840 --> 02:02.560
is going to take a string value.

49
02:02.560 --> 02:06.030
Now it actually gives us a little bit of a tip if you're curious about the type

50
02:06.030 --> 02:06.760
of services

51
02:06.760 --> 02:10.700
that you can specify and supply as a value to the service parameter, you can

52
02:10.700 --> 02:11.080
run the

53
02:11.080 --> 02:16.780
command firewall cmd get services, if that service is listed in this output you

54
02:16.780 --> 02:17.280
can use

55
02:17.280 --> 02:19.600
it as a valid value here.

56
02:19.600 --> 02:23.100
Now this is a very important one if you scroll on down, this is the state

57
02:23.100 --> 02:24.040
parameter, this

58
02:24.040 --> 02:27.840
one here is required so we're going to have to specify this when we use the

59
02:27.840 --> 02:28.520
module if

60
02:28.520 --> 02:30.040
we want the module to operate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:28.520 --> 02:30.040
we want the module to operate.

61
02:30.040 --> 02:33.490
So basically what we're talking about here is should the service or the port be

62
02:33.490 --> 02:34.040
accepted

63
02:34.040 --> 02:38.600
or denied or in the terminology here enabled or disabled.

64
02:38.600 --> 02:42.650
So how about we go and take this information and we shall apply it to a

65
02:42.650 --> 02:43.440
playbook.

66
02:43.440 --> 02:47.440
Now first thing is first I want to ensure that my firewall is running so I'll

67
02:47.440 --> 02:47.960
say pseudo

68
02:47.960 --> 02:52.520
systemctl start firewall D and again do the same thing on the blue box.

69
02:52.520 --> 02:57.390
Okay so if we check the status of our firewall indeed we can see this as active

70
02:57.390 --> 02:58.280
and running

71
02:58.280 --> 03:00.840
in the same thing is true on the yellow box perfect.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:58.280 --> 03:00.840
in the same thing is true on the yellow box perfect.

72
03:00.840 --> 03:03.640
So let's open up Firefox on my control modes.

73
03:03.640 --> 03:08.270
If I try to access my web server and hit enter notice because the firewall is

74
03:08.270 --> 03:09.360
now re-enabled

75
03:09.360 --> 03:11.560
it pretty much is blocking the connection.

76
03:11.560 --> 03:14.710
So let's create a new playbook called play four dot yml, let's give this

77
03:14.710 --> 03:16.040
playbook a name

78
03:16.040 --> 03:18.840
what I say play four and we'll just say manage firewall.

79
03:18.840 --> 03:21.990
Here we're going to target we're going to target the all groups of both hosts

80
03:21.990 --> 03:22.360
and the

81
03:22.360 --> 03:26.920
network gather facts is going to be set to false and then let's define our task

82
03:26.920 --> 03:27.240
.

83
03:27.240 --> 03:31.160
So let's give this task your name and we'll just say allow web traffic through
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:27.240 --> 03:31.160
So let's give this task your name and we'll just say allow web traffic through

84
03:31.160 --> 03:31.880
firewall.

85
03:31.880 --> 03:35.720
So the module will be answerable POSIX firewall D and now specify the service

86
03:35.720 --> 03:36.280
that I want

87
03:36.280 --> 03:37.280
to enable.

88
03:37.280 --> 03:42.660
Now what I'm going to do here is I'm going to just enable traffic for HTTP and

89
03:42.660 --> 03:43.480
HTTPS.

90
03:43.480 --> 03:48.200
Right now my web server is only serving traffic over port 80 that is regular on

91
03:48.200 --> 03:49.640
encrypted HTTP

92
03:49.640 --> 03:54.130
but nevertheless because that's a more realistic configuration let me just

93
03:54.130 --> 03:54.920
demonstrate it.

94
03:54.920 --> 03:58.600
So what I will do here is I will have my quotation marks and then my double

95
03:58.600 --> 03:59.640
curly braces and

96
03:59.640 --> 04:01.640
then I will use the keyword item.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:59.640 --> 04:01.640
then I will use the keyword item.

97
04:01.640 --> 04:06.190
This is going to act as my placeholder and then I'm going to specify permanence

98
04:06.190 --> 04:06.280
will

99
04:06.280 --> 04:10.920
be the billion value of true and I will specify immediate but also the billion

100
04:10.920 --> 04:11.560
value of true

101
04:11.560 --> 04:15.720
so we're going to have the configuration be immediately activated and persist

102
04:15.720 --> 04:16.680
and state

103
04:16.680 --> 04:18.120
is going to be enabled.

104
04:18.120 --> 04:21.640
Pretty much we're going to enable this particular service IE allow it.

105
04:21.640 --> 04:25.080
Now this here is going to be what I'm looping through.

106
04:25.080 --> 04:29.500
So what I want to do here is use my loop keyword and then I want to specify my

107
04:29.500 --> 04:30.440
values.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:29.500 --> 04:30.440
values.

108
04:30.440 --> 04:34.000
So right now I'm going to call a variable and the variable is just going to be

109
04:34.000 --> 04:34.760
rules.

110
04:34.760 --> 04:38.750
Right now as it stands I haven't actually defined those rules so what I could

111
04:38.750 --> 04:39.400
do is I could just

112
04:39.400 --> 04:45.150
specify my vars and I specify my rules here and the rules is going to be HTTP

113
04:45.150 --> 04:46.520
and HTTPS.

114
04:46.520 --> 04:51.640
So pretty much I'm going to take this iterable object, loop through it and upon

115
04:51.640 --> 04:52.760
first iteration

116
04:52.760 --> 04:57.960
we'll specify the service as HTTP, permanent true, immediate true and enable it

117
04:57.960 --> 04:58.840
then loop to the next

118
04:58.840 --> 05:03.730
configuration, HTTPS and then have the same configurations applied, permanent,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
04:58.840 --> 05:03.730
configuration, HTTPS and then have the same configurations applied, permanent,

119
05:03.730 --> 05:04.680
immediate and

120
05:04.680 --> 05:05.320
enabled.

121
05:05.320 --> 05:09.880
So let's just say this right here and if I just say Ansible Playbook play 4.YML

122
05:09.880 --> 05:10.600
and to enter,

123
05:10.600 --> 05:12.920
give it a moment, now we see a change.

124
05:12.920 --> 05:19.400
So if I say Ansible all and then -a and I run the command firewall CMD dash

125
05:19.400 --> 05:21.080
dash list services

126
05:21.080 --> 05:24.760
and I run this command against both my devices and to enter, look at what we

127
05:24.760 --> 05:25.480
actually seen the

128
05:25.480 --> 05:31.520
output, look at the yellow box right here, CB actually have HTTP and HTTPS now
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
05:25.480 --> 05:31.520
output, look at the yellow box right here, CB actually have HTTP and HTTPS now

129
05:31.520 --> 05:32.280
allowed

130
05:32.280 --> 05:38.060
in similarly on the blue box, the same thing is true, we're now allowing HTTP

131
05:38.060 --> 05:39.400
and HTTPS.

132
05:39.400 --> 05:43.400
So what that now means is if I go back to my browser right here on my control

133
05:43.400 --> 05:43.960
nodes,

134
05:43.960 --> 05:48.170
come back into Firefox, once again back on my control node, if I now try the

135
05:48.170 --> 05:48.680
website,

136
05:48.680 --> 05:53.560
as we can see here we can access the blue box and if I change this to 135 and

137
05:53.560 --> 05:54.520
enter,

138
05:54.520 --> 05:57.880
now we actually get the access to the yellow box server.

139
05:57.880 --> 06:02.040
So that's how we can modify our firewall rows using Ansible, let's now validate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:57.880 --> 06:02.040
So that's how we can modify our firewall rows using Ansible, let's now validate

140
06:02.040 --> 06:02.600
what we've learned

141
06:02.600 --> 06:03.640
within this skill.