In this video I like to walk you through what it looks like when we have these
three firewalls
as part of the same security fabric and that way the login information will be
listed duplicates
here at the 4D Analyzer because all three of these devices are part of the same
security fabric.
So to do that let's go ahead and make firewall 1 the root of the security
fabric
and then we'll have firewall 2 and firewall 3 joins. So port 4 will be the
upstream port
that firewall 2 and firewall 3 will use to join this security fabric and if we
come across any
bumps in the road we'll handle them as they come up. Alright so currently we
have firewall 1, 2, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have firewall 1, 2,
and 3 as three separate individuals who are reporting to 4D Analyzer and let's
go to firewall 1
and we'll go down to security fabric and fabric connectors and currently it's
stand alone here
in the security fabric setup so we'll click that click on edit on firewall 1
and we'll serve as the
fabric root. We'll use port 4 as the port that the downstream firewalls can
join the fabric and
we'll call this our FGT fabric and for the management IP address I'm going to
specify the
management IP address I'm currently using to manage that firewall which is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
management IP address I'm currently using to manage that firewall which is
firewall 1 and we'll
click on okay I also want to make sure under network and interfaces I want to
make sure port 4 is
willing to go ahead and allow security fabric connections. So here under
network interface for
port 4 currently we're allowing security fabric connections to come in
fantastic. So let me go
back to security fabric fabric connectors and currently we are the root and we
're currently
logging to 4D Analyzer so let's go over to firewall 2 and tell it to join the
fabric.
So here in firewall 2 we'll go down to security fabric and then fabric WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here in firewall 2 we'll go down to security fabric and then fabric
connectors and here on
the tile for security fabric setup we'll go ahead and click on it click on edit
and we'll say you're
not going to be stand alone you're going to go ahead and join an existing
fabric and I don't need
to worry about an anthropology about other downstream devices beyond it and the
upstream
4D gate IP address is 10.123.0.51. So let's confirm that together. So this port
4 here
is the IP address of 10.123.0.51 that's the IP address the last octet last
number I used for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
number I used for
all of its interfaces. So that would be the correct IP address for firewall 2
to use to join
the root and become part of the 4D gate security fabric. So for a single sign-
on I'm going to set
that to manual click on okay and it says joining an upstream device will cause
this device's automation
configuration to be discarded and because I haven't set up any animation yet
that's okay and we'll
click on okay all right and then we'll go to firewall 3 and we'll do a similar
thing we'll go to security
fabric fabric connectors and then here for security fabric setup we'll click
that click on edit and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that click on edit and
then we'll specify that we wanted to join the fabric as well. So we're going to
join an existing
fabric and that's the upstream slash firewall 1's IP address of 10.123.0.51.
For SAML settings
let's go ahead and do manual and then click on okay. Again this warning is that
any device
automation configuration will be discarded that's fine because we haven't
configured any yet and
I'll click on okay. So now these three firewalls firewall 1 firewall 2 and
firewall 3 are part of
the same security fabric. Another interesting note is that if we hadn't yet had
firewall 2 and
firewall 3 sending logging over to 40 analyzer by joining the security fabric WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
firewall 3 sending logging over to 40 analyzer by joining the security fabric
where firewall 1 was
already sending over to the 40 analyzer firewall 2 and firewall 3 would also
have incorporated the
sending of messages over to 40 analyzer and once again we'd have to go to 40
analyzer to
specify that we want to allow those inbound connections as authorized devices
and as we go
back to firewall 2 and firewall 3 oh we have to add firewall 1 specify that we
need to authorize
firewall 2 and firewall 3 to join the security fabric. So back at firewall 1 we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
firewall 2 and firewall 3 to join the security fabric. So back at firewall 1 we
need to authorize
firewall 2 and firewall 3 to join so let's go ahead and click on the link there
and then click on firmware
and registration which takes us to system firmware and registration and then we
can go ahead and
take firewall 2 and firewall 3 and with them both selected we can click on
authorize. So now those
two firewalls are authorized to join this fabric. So now if we go back to
firewall 2 it's showing
as authorized and same thing for firewall 3 it's also showing as authorized and
the benefit of having
these 40 gates as part of the same security fabric is that now as they're all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
these 40 gates as part of the same security fabric is that now as they're all
sending logs over to
the 40 analyzer the 40 analyzer can logically treat them all as one device or
one entity and can help
reduce duplicates. So for doing for example IDS here, IPS here or an anti-mal
ware here and maybe
other security measures here all that log information is going to be sent over
and correlated here at
the 40 analyzer. So we won't miss anything but at the same time we won't have
duplicate information
for the same exact event coming from two different firewalls. Because the 40
analyzers treat the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
analyzers treat the
security fabric as one larger logical device. So back at 40 analyzer now if we
go to device manager
it's now showing us that as part of this FGT fabric it includes firewall 1
firewall 2 and firewall 3
as part of that same security fabric and this one up here is the branch
firewall off on the right
hand side of our topology.