So for our game plan here is what I propose we do.
Let's first of all verify and set up our topology.
So we have all the VMs and devices we need for proper testing.
And as part of that, I'd like to have a VM here called Mint 10.
It's a Linux machine running a flavor of Linux called Mint Linux.
I'd also like to place a VM out here and let's call that Mint 23.
Just to remind ourselves when we see it that it's on the 23 network.
And let's also put another VM down here.
We'll call it Mint -20, which will be on segment 20.
And let's also create a little web server here called Web 10. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's also create a little web server here called Web 10.
And I'd also like to update our network address translation.
So traffic trying to go out to the public internet here through the 23.1.2
network.
Instead of setting up a range of IP addresses,
I want to go ahead and update Source NAT just to do overloading on the virtual
address here
of .60 for our Tier 0 gateway.
So for Source NAT, we'll map it all out to 23.1.2.60.
And the reason I'm doing that is because I want to make sure any other IP
addresses
they play with out here that they're not currently tied up or being used by the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they play with out here that they're not currently tied up or being used by the
NAT process here.
So we're just going to overload on that single address for outgoing traffic.
And then also I'd like to set up destination NAT so that from the outside world
here,
including from this Mint 23 device, we can go ahead and access the web page for
this Web 10 web server right here.
So I don't know if the IP address is going to be yet because it's going to be a
DHCP client.
But once it gets its IP address, we'll go ahead and set up destination NAT to
the Web 10.
So we'll say destination NAT for Web 10.
And so we'll take whatever its last octet is here, 1010.0. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so we'll take whatever its last octet is here, 1010.0.
Whatever that last number is.
And we'll set up destination NAT here on our Tier 0 gateway that is using the
last octet.
So it'd be, for example, this was 1010.0.185.
Up here, we can map it out to 23.1.2.185.
Same last octet, but on the two different networks.
Now, one of the questions that might come up is, OK, why exactly do we want to
get that destination NAT
from an address space out here down to this device?
And that's because one of the things I want to demonstrate
is how we can use a gateway firewall to filter traffic that's trying to come WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is how we can use a gateway firewall to filter traffic that's trying to come
into our environment
as well.
So for our gateway firewall policy on our gateway zero here, let's set up a
policy to permit
HTTP traffic.
And the reason I'm going to use HTTP instead of HTTPS is because that's what
this little VM is
supporting as a server at the moment.
So I want to permit HTTP traffic inbound to the Web 10 server.
And then for the second rule, as part of the policy here on gateway zero,
let's do a deny of everything else will put all there to Web 10.
So effectively, we should be able to test from this Mint 23 computer to make WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So effectively, we should be able to test from this Mint 23 computer to make
sure we can go to
the Web page here, but everything else, including FTP or SH or anything else
that we might try,
should be denied.
And then for the third example of using gateway firewall services,
let's go ahead and pick on one of our gateways here at tier one.
In fact, let's use tier one gateway A, which is this one right here.
Now, in order to use a gateway based firewall here on our tier one gateway,
we are going to need to associate it with our edge nodes.
So we'll do that as well as part of the process of setting it up because WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll do that as well as part of the process of setting it up because
currently it's set up
as a distributed firewall only.
And it doesn't have the services of our edge nodes.
And if we want to have a gateway firewall on a tier one gateway, it needs to be
leveraging
our transport nodes.
So one of our steps there will be to go ahead and associate gateway A with the
edges,
meaning the edge transport nodes.
So we can just point to the cluster to go ahead and do that.
And then for the rules, let's go ahead and imagine we want to control here on
the gateway policy on
gateway A to have it deny any traffic sourced from 10 10. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
gateway A to have it deny any traffic sourced from 10 10.
In fact, that's too wide.
Let's go ahead and deny ICMP echo requests coming from 10 10 if they're trying
to go to 10 20.
So we'll say no, ICMP echo requests, which is the beginning part of a ping from
10.10
if they're trying to go over to 10.20.
And as we implement the gateway firewalls first on gateway zero and then on
gateway A,
we'll also do some before and after testing just to verify that the actual
gateway policy
is indeed permitting or denying the traffic as expected.