In this section we're going to talk about that rock more transparent.
Specifically we're going to understand what are the differences between the two and why we why should
we even care about whereas if necessary to implement this kind of configuration.
And of course how we do it.
So the whole thing is far more exposed between the internal network and existing robo Farmall.
This would be the transplantable if we refer to our previous diagrams.
Let's take a look at this one.
So in this case we said that the form gets things between the internal network and the Internet Internet
boundary on the right.
Well let's say that at this point this is no longer Watergate.
It's not a good Pharo Let's say I don't know if it's a Cisco or or GENEVER
checkpointing or I don't know what all
of the networks let's suppose that we're not sure or we are unsure about whether the connection the
connectivity is secure and we want to add an extra layer of security.
Well this is the place where we will install the We get fire.
So it will be transferable meaning it will not modify any IP address and details in our network but
we will just put it like in the middle and connected to our existing Raro firewall and connecting it
to our last second.
Let's switch now our talk sleights.
So as I said no changes like addressing scheme on applies security standing.
Which is basically the reason that transfer mode or that promote exists and the battle changes require
its just needed to provide the management of Gilbreth so that it's accessible to any configuration when
you manage it.
And when you analyze the security and the security and when you analyze the security events that may
or may not have have taken place.
So the first thing is to change for the new operator.
We have a couple of comments systems that think self-appraisal Motor Transport said manager or the management
might be a gateway.
Where does the traffic lead to.
It will come from the Terminator but it has to you have to specify where it's going next.
Optional you have to go through your DNS servers first that configure policy all traffic from the terminal
and for each member that this is what we have done when we configure the the source that we have said
that all the back is coming from but inside it will be not to the IP address or the outside interface.
This is similar to what we have done already.
And obviously that's shut down and either fall for the good firewall in the network.
And very important analyze results best dashboard as we have seen in the 40 of you all session and select
the now option in the graphical user interface for another 40.
Now I have deployed a new one.
It's not 1 5 6 Solas logic as is brand new.
You have only user name and password
up to this point.
We have discussed only about the GUI graphical user interface whether you like it or not there will
be bombs where you will have to switch to see a light command line interface.
More advanced.
It's less error prone and if you want to use the software for this like kernel security or your party
or others it's fine but if you want to use the line directly from the GUI This is the place.
It's in the top right corner.
Just click on it and the like cancel it up and run.
So first thing first step one is a change for the good operating mode.
You can see that on the left it says that it's running in the flow base is running in robot mode.
We'll just change that.
So config
config system settings
now set operation load question.
We have to Nat and transfer.
So we'll just go for transparent
of the work
of the lab we have to set the management IP address so set man JP We just pull the same idea as if I
have no.
So I need something to grasp
also the gateway for the packets going to
capitalism.
So again set gateway 1 7 1
and
we have lost connectivity.
Now the phone is reconfiguring itself and will wait until it's finished and get back.
All right so we are back now 48 has voted.
And look at this.
Now it's almost transparent.
As a post-war first 48 we have configured in round mobile it's not flow base and this one we can see
it's transparent.
So the migration has been unsuccessful.
That's the second step will be to configure DNS servers so go to network DNS and whether to accept the
fully got service by default or you want to specify your role.
It's a wrong decision.
Next it's the configure.
The next step is to configure the policy toward traffic from internal to the interim.
And if I've done this in the previous sections it's on policy and objects been for policy by default.
Yes we have found here implicit deny policy we want to create when you create new configure the new
policies a new policy in common interface Port-Au or one is the one that we have here as the one I mean
towards the existing firewall in the architecture and it's more general just to see how it's done on
the fast side service all except whether to activate the security profiles and DeWyze were filtering
DNS application control and IPs as a best practice.
It's it will not hurt you to to activate the logging longing a lot of traffic.
Why not all sessions see what's happening there.
Generally logs when sessions starts I would say this is also a good recommendation.
Capture packets maybe want to activate or to enable when things are not going right.
So hit OK and we are finished.
Also the fourth Foerster
now is the time for shutdown you'd shut down your you're 48 and sort it into the network and in the
end of everything it's put it up for you to go to work for you and all sessions
now.
And this is the place where all this is done with would populate the table and you could analyze to
see how things are working whether traffic is passing by or not.
And if it's conforming to your configure policy.