FTD · CAPSTONE

FTD-style capstone: one manager, a pair, a branch and an IPS

Three registered, empty firewalls and one manager. HQ is an active/standby pair (HQ1, HQ2) with an inside and a DMZ with the web server SRV. BR is a branch, joined to HQ by an IKEv2 tunnel. One access policy and one NAT policy serve all of them, because zones make that possible. R1 is the internet, with 198.18.0.1 behind it, and LAP1 is somebody out there.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router and switches · 6 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Zones INSIDE, OUTSIDE and DMZ. HQ1: inside 192.168.1.1, outside 203.0.113.1, dmz 172.16.1.1, each /24 with standby addresses .2, and a default route to 203.0.113.254. BR: inside 192.168.2.1, outside 198.51.100.1, default route to 198.51.100.254.
One access policy, default block: allow icmp from INSIDE to OUTSIDE for 192.168.0.0/16, and allow tcp 80 from OUTSIDE to DMZ to SRV (172.16.1.10) with an IPS policy (base balanced, prevention) and logging. One NAT policy: PAT for 192.168.0.0/16 and static 203.0.113.10 for SRV. Assign both to HQ1 and BR.
Pair HQ1 and HQ2 over Gi0/3 (FOLINK, key LABKEY, 10.255.255.1/30 and .2), and a tunnel between HQ’s 192.168.1.0/24 and BR’s 192.168.2.0/24. Deploy to all.
PC1 reaches 198.18.0.1, and PC1 reaches PCB through the tunnel.
From LAP1: traffic tcp 203.0.113.10 80 payload "GET /index.html" arrives, and traffic tcp 203.0.113.10 80 payload "x or 1=1" is dropped by Snort.
It all keeps working without HQ1: the check takes HQ1’s links down in a copy of the lab.

Start this lab

Before you start

Build in the order of the tasks, and read the preview for each firewall before you deploy: HQ2’s is only failover lines. Name a separate object for each network in the tunnel, and a wider one for the shared policy. The NAT exemption comes with the tunnel, and it is read before PAT.

Concept

Zones let one policy fit many firewalls

A rule names zones, not interfaces. Each firewall says which of its interfaces belong to each zone, so the same rule compiles to different lines on different firewalls. Security levels stop mattering: every interface gets level 0, and the rules decide.

Concept

An access rule reads the address, Snort reads the contents

An access rule allows or blocks by address and port, so it passes an attack on an allowed port. An Allow rule with an IPS policy sends its traffic through Snort, which reads the contents and compares them with its rules. Prevention mode drops what a drop rule matches, and detection mode only reports it, so you can see what a policy would break before you trust it.

Concept

Active/standby failover

Two firewalls act as one. The active unit forwards traffic on the main addresses, and the standby waits on the standby addresses, with a copy of the configuration that the active unit sends it over the failover link. If the active unit or one of its monitored interfaces fails, the standby takes the role and the main addresses, so hosts keep the same gateway. The unit that recovers does not take the role back.

Concept

Site-to-site IPsec VPN

Two firewalls join their LANs across the internet. Interesting traffic, which the crypto ACL names, is encrypted and sent to the peer. First the firewalls agree in IKE phase 1 (a policy both have, and the same pre-shared key), then in phase 2 (a transform set or proposal both have, and crypto ACLs that mirror each other). NAT comes before encryption, so the VPN traffic needs a NAT exemption.