WEBVTT

1
00:00.000 --> 00:02.680
So for our game plan here is what I propose we do.

2
00:02.680 --> 00:05.280
Let's first of all verify and set up our topology.

3
00:05.280 --> 00:09.040
So we have all the VMs and devices we need for proper testing.

4
00:09.040 --> 00:13.240
And as part of that, I'd like to have a VM here called Mint 10.

5
00:13.240 --> 00:16.880
It's a Linux machine running a flavor of Linux called Mint Linux.

6
00:16.880 --> 00:21.320
I'd also like to place a VM out here and let's call that Mint 23.

7
00:21.320 --> 00:24.120
Just to remind ourselves when we see it that it's on the 23 network.

8
00:24.120 --> 00:26.480
And let's also put another VM down here.

9
00:26.480 --> 00:29.760
We'll call it Mint -20, which will be on segment 20.

10
00:29.760 --> 00:33.200
And let's also create a little web server here called Web 10.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.760 --> 00:33.200
And let's also create a little web server here called Web 10.

11
00:33.200 --> 00:36.000
And I'd also like to update our network address translation.

12
00:36.000 --> 00:40.360
So traffic trying to go out to the public internet here through the 23.1.2

13
00:40.360 --> 00:40.720
network.

14
00:40.720 --> 00:43.160
Instead of setting up a range of IP addresses,

15
00:43.160 --> 00:47.760
I want to go ahead and update Source NAT just to do overloading on the virtual

16
00:47.760 --> 00:48.360
address here

17
00:48.360 --> 00:50.720
of .60 for our Tier 0 gateway.

18
00:50.720 --> 00:55.680
So for Source NAT, we'll map it all out to 23.1.2.60.

19
00:55.680 --> 00:58.840
And the reason I'm doing that is because I want to make sure any other IP

20
00:58.840 --> 00:59.040
addresses

21
00:59.040 --> 01:03.040
they play with out here that they're not currently tied up or being used by the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:59.040 --> 01:03.040
they play with out here that they're not currently tied up or being used by the

22
01:03.040 --> 01:03.840
NAT process here.

23
01:03.840 --> 01:07.280
So we're just going to overload on that single address for outgoing traffic.

24
01:07.280 --> 01:11.650
And then also I'd like to set up destination NAT so that from the outside world

25
01:11.650 --> 01:11.760
here,

26
01:11.760 --> 01:15.840
including from this Mint 23 device, we can go ahead and access the web page for

27
01:15.840 --> 01:18.080
this Web 10 web server right here.

28
01:18.080 --> 01:21.010
So I don't know if the IP address is going to be yet because it's going to be a

29
01:21.010 --> 01:21.680
DHCP client.

30
01:21.680 --> 01:24.890
But once it gets its IP address, we'll go ahead and set up destination NAT to

31
01:24.890 --> 01:25.520
the Web 10.

32
01:25.520 --> 01:28.240
So we'll say destination NAT for Web 10.

33
01:28.240 --> 01:31.520
And so we'll take whatever its last octet is here, 1010.0.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:28.240 --> 01:31.520
And so we'll take whatever its last octet is here, 1010.0.

34
01:31.520 --> 01:33.200
Whatever that last number is.

35
01:33.200 --> 01:37.220
And we'll set up destination NAT here on our Tier 0 gateway that is using the

36
01:37.220 --> 01:38.000
last octet.

37
01:38.000 --> 01:42.000
So it'd be, for example, this was 1010.0.185.

38
01:42.000 --> 01:45.520
Up here, we can map it out to 23.1.2.185.

39
01:45.520 --> 01:47.920
Same last octet, but on the two different networks.

40
01:47.920 --> 01:51.040
Now, one of the questions that might come up is, OK, why exactly do we want to

41
01:51.040 --> 01:52.320
get that destination NAT

42
01:52.320 --> 01:54.640
from an address space out here down to this device?

43
01:54.640 --> 01:57.040
And that's because one of the things I want to demonstrate

44
01:57.040 --> 02:00.780
is how we can use a gateway firewall to filter traffic that's trying to come
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:57.040 --> 02:00.780
is how we can use a gateway firewall to filter traffic that's trying to come

45
02:00.780 --> 02:01.520
into our environment

46
02:01.520 --> 02:02.240
as well.

47
02:02.240 --> 02:07.010
So for our gateway firewall policy on our gateway zero here, let's set up a

48
02:07.010 --> 02:08.560
policy to permit

49
02:08.560 --> 02:10.000
HTTP traffic.

50
02:10.000 --> 02:13.610
And the reason I'm going to use HTTP instead of HTTPS is because that's what

51
02:13.610 --> 02:14.320
this little VM is

52
02:14.320 --> 02:16.000
supporting as a server at the moment.

53
02:16.000 --> 02:20.880
So I want to permit HTTP traffic inbound to the Web 10 server.

54
02:20.880 --> 02:24.160
And then for the second rule, as part of the policy here on gateway zero,

55
02:24.160 --> 02:28.800
let's do a deny of everything else will put all there to Web 10.

56
02:28.800 --> 02:32.240
So effectively, we should be able to test from this Mint 23 computer to make
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:28.800 --> 02:32.240
So effectively, we should be able to test from this Mint 23 computer to make

57
02:32.240 --> 02:32.880
sure we can go to

58
02:32.880 --> 02:38.000
the Web page here, but everything else, including FTP or SH or anything else

59
02:38.000 --> 02:39.120
that we might try,

60
02:39.120 --> 02:40.080
should be denied.

61
02:40.080 --> 02:43.840
And then for the third example of using gateway firewall services,

62
02:43.840 --> 02:47.200
let's go ahead and pick on one of our gateways here at tier one.

63
02:47.200 --> 02:51.600
In fact, let's use tier one gateway A, which is this one right here.

64
02:51.600 --> 02:55.680
Now, in order to use a gateway based firewall here on our tier one gateway,

65
02:55.680 --> 02:58.880
we are going to need to associate it with our edge nodes.

66
02:58.880 --> 03:01.920
So we'll do that as well as part of the process of setting it up because
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:58.880 --> 03:01.920
So we'll do that as well as part of the process of setting it up because

67
03:01.920 --> 03:03.040
currently it's set up

68
03:03.040 --> 03:04.880
as a distributed firewall only.

69
03:04.880 --> 03:07.120
And it doesn't have the services of our edge nodes.

70
03:07.120 --> 03:10.960
And if we want to have a gateway firewall on a tier one gateway, it needs to be

71
03:10.960 --> 03:11.360
leveraging

72
03:11.360 --> 03:12.480
our transport nodes.

73
03:12.480 --> 03:17.500
So one of our steps there will be to go ahead and associate gateway A with the

74
03:17.500 --> 03:18.000
edges,

75
03:18.000 --> 03:19.760
meaning the edge transport nodes.

76
03:19.760 --> 03:22.160
So we can just point to the cluster to go ahead and do that.

77
03:22.160 --> 03:25.910
And then for the rules, let's go ahead and imagine we want to control here on

78
03:25.910 --> 03:26.960
the gateway policy on

79
03:26.960 --> 03:30.800
gateway A to have it deny any traffic sourced from 10 10.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:26.960 --> 03:30.800
gateway A to have it deny any traffic sourced from 10 10.

80
03:30.800 --> 03:31.760
In fact, that's too wide.

81
03:31.760 --> 03:36.410
Let's go ahead and deny ICMP echo requests coming from 10 10 if they're trying

82
03:36.410 --> 03:37.440
to go to 10 20.

83
03:37.440 --> 03:43.280
So we'll say no, ICMP echo requests, which is the beginning part of a ping from

84
03:43.280 --> 03:44.080
10.10

85
03:44.080 --> 03:46.720
if they're trying to go over to 10.20.

86
03:46.720 --> 03:50.290
And as we implement the gateway firewalls first on gateway zero and then on

87
03:50.290 --> 03:51.200
gateway A,

88
03:51.200 --> 03:54.890
we'll also do some before and after testing just to verify that the actual

89
03:54.890 --> 03:55.840
gateway policy

90
03:55.840 --> 03:59.280
is indeed permitting or denying the traffic as expected.