Welcome to module to get firewall installation
in this section we're going to run the setup with the in terms of session outcome at the end of the
session.
We would like to have the final configure so that the users on the inside LAN have access to Internet.
And here is how everything should look.
By the
first of all
up to this point.
We have talked about the firewall.
So let's say
this is the fourth thing it's firewall
and we have configure our port one
let's say Internet
port one.
And if you remember we have said that this is 172 dot 27.
Not to that 1 5 5 left 24.
Good.
Now at this point we would like to provide Internet access to home users to the land.
Let's say that this is our PC so that's PC and this is connecting to the firewall on port to this is
Port to.
Now on this on this side of the connection we are going to set up a basically service.
So the 40 games we provide IP addresses to the terminals and we will have a range let's say 1 9 2 1
6 say Dot 1 0 flesh 24.
And for example the fourth game would be that one and ABC would be up 100 after successfully configuring
the firewall as basically server to serve the the dispute was that will come from the line on the line
segment.
We will just test everything.
So do not just configure a network engineer I pre-professional have to go through two or three phase.
First of all yes we have to configure to configure the network in the way that we need.
Second is to verify and this is also very important we have to verify that our configuration is in place
that all all the configurations that we have gone through have been implemented and last if everything
is not going necessarily And it's a must we have to troubleshoot.
So at the end we all have said Birol already has a connection but I have tested it and we'll just set
up the server to serve the PCs that are left out in the last the last second and we will just be on
the Internet.
Let's say we go through.
We go to the DNS The is like we did for the for for the fourth days of 8 8 8 8.
And why not just try and HGT p.s..
So something like doubled up Dubreuil something we'll see.
So this is what we are going to configure now.
Everything is set up.
Now we have a brief understanding on what I'm going to figure and what the outcome.
So let's get started.
So first we're going to log in the admin interface.
Remember we have admin and no password so here here's how the web interface is going to scratch a user
interface looks like.
And as a first step we are going to run during the run to set up the right top corner we have every
system and set up with
first of all maybe we just want to set up a password.
So we have a default in Aveeno baffle with this list set up fast for us and all passwords.
Nothing is small.
And for a new password we'll just say admin so he knows the name and admin password.
Next reporting is to select the time.
So now why is that.
Something happens at the moment in time.
Some are some issues of course in the network.
You have to have correct timestamps in the log events so that you can correlate.
You can see if let's say an interface went down on the on the on the fourth grade and maybe going to
correlate with some other event that took place in the network.
If you don't have a proper time zone sets on NTPC server Knittle time portable server that will serve
the firewall with the correct time zone and timestamped you will not be able to correlate the events
and figure out what has really happened is with them.
I'm going to set up now the the the time as I'm based in depressed Romania I would just say GMT plus
2 for us.
So next this is what we have currently configured on our interfaces.
We have one static IP addresses flash 24 port so facing downwards down to the internet to talk to the
internal network.
So these IP address and these will be presented with the full case they fall into an alliance which
is that the first five years with the Packers will traverse combing the Internet wanting to once we
say that one of what the rest of the board.
We don't need them for this for this moment we'll just skip it.
Now very important we have to set up with DHP server has said so that all internal clients are providing
an IP address.
And this is done exactly like this.
You click on the port of Port that is again facing the last segment enabled the service
and scroll.
So let's let's put a thought an IP address as in the diagram depicted just a few moments ago we said
that it's going to be one line or two that won't succeed.
So that's one.
One hundred and let's have a 10 IP address range so one to not want to say that one loved one and not
one 10 and now we just hit next.
So this is just a summary of the configuration as in past it has been modified.
Time Zone has been also set up.
Part one is the same for two it's configured like one loved one and we have also configured to configure
the service on it.
So we just now configure
and we have just been locked out of the session let's see now.
Getting at me and I mean would provide us access
and just now have logged in again for good.
I'm 64 for cambium image and let's see how it looks.
Configuration good
network interfaces and the way you are configuring this one
DCP class one.
So this looks fine.
It means that our our PC or our computer has requested and received the IP address from from this list
firewall.
So let's see if this is true and whether the configuration that we have received said I have to.
To Lance so to nix Network Interface Cards.
This is the order the management is for accessing remotely the PC and this one line interface is the
one that has requested or not.
See in a jiffy if if it has IP connectivity.
So let's hit an IP config.
And yes we have the first idea that was available in the range.
One up to say that one hundred and the default gateway is obviously the good
in connectivity no
OK we have connectivity.
It's also if we have connectivity to the Internet.
And no we don't have any connectivity either IP or with DNS included.
It's obviously that he's not going to work.
So why is this happening.
We have to realize what we have configured up to this point and have a correct understanding of what's
happening and why do we we don't have connectivity connectivity yet that's white board the white board.
Our current situation and see what's what's happening and why it's not.
It's not currently working.
So yes we have the firewall we have the Portuguese firewall we have the PC we have connectivity between
the PC and the firewall.
Now we also see that we have connectivity between firewall and the Internet.
So we have connectivity from this point to this point.
But 23:3 Internet is not is not happening now.
Please take a moment to wonder and question yourself why is this not happening.
How should this happen and what should be else configured on the firewall.
Because this is the problem now actually is not a problem it's not sure what's happening but we have
to figure out step by step basis to understand more and what's happening and what should be done in
a proper way in a natural way so that things happen from the first the first place.
So the packet is is traversing the firewall to get to the Internet.
Start with the source IP of 1 and 2.
Once you say 1 to 100 and destination 8 8 8 8.
OK.
From the PC point of view it has connectivity to say so too.
Why.
Because the firewall is the default gateway so it will send all its packets to the firewall in the area
that the firewall would just know what to do with it.
On the other side the DNS server that we're pinging doesn't have any clue on one on where to send on
where to send the traffic.
And this is the reason it's not happening.
The firewall should not the IP address from the internal one name to the external 170 170 to 27.
Up to that one five.
And this is not that this has not been configured on the fire.
So our next natural step is to configure the firewall the firewall so that it will provide services
network address translation for the whole hour or the whole one to one seek sale.
What does use last 24 to do than that of this summit.
Two is external IP address that's already already has connectivity we have seen this happen.
We will login again with admin and I mean this time
and the menu that we have to go its policy and objects we have to create an IP for policy
currently would have one so in place in one thats one.
Its implicit denied for all sources to all these nations always for all services are denied.
But now and we see that a lot is this.
Now we have to add a new one so create new Let's call it Nides all capitals.
That internal letter.
So where is this traffic coming from.
So with in-coming interface it's port too.
We see the IP address when I want to say one that want the outgoing interface will be part one.
It's the WAN interface the wide area network interface for both forces are we going to provide this
net translation we will select all four traffic going to destinations.
So this will be also all so any traffic from any sort of any destination aren't going to allow this
to happen any in any moment every time.
Like always.
Are we going to define a schedule at this moment.
We'll just hit always and the action for this traffic comes from this port going to port from any source
to any destination always.
It's except now referring to this menu.
So this line of figuration are people on Decoration.
We can get the packets not the source IP to the outgoing interface a key address of the of the front
gate.
And this will be one or we can configure a dynamic pool and choose a different a different value different
IP address for this.
It's not necessary we'll use let's say that easier use your progression we are going to face.
We already have available.
It's part one and this at this moment we can write a comment here just that we we can document or configuration
step by step.
So I don't know month month later we can see that at this moment in time this configuration has redone.
So let's say configure that service for LAN segment enable this policy is very important and Wickett.
OK.
We forgot to select service.
So anyway the service will be all we want to do this for any any traffic that will be accessed by my
internal land and now.
OK.
So we have from port to port 1 this is an internal land policy or source or this nation always for any
traffic.
The action is to accept and it's enabling.
At this point we will have to go to to the PC again and connectivity from an ICMP perspective and also
from an application perspective.
And this will be a happy traffic to to any site.
So we are on the PC and our let's say being able 8.
Now it's OK it's functional and let's say being dandy but come yes it's functional Let's hit browser
and then we come
yes.
Now we see that we have full connectivity from the PC perspective as well.