FTD · BUILD

FTD-style: publish a server, and read its events

PC1 already reaches the internet through FTD1. Now put SRV on a DMZ and publish it as 203.0.113.10. Rules name the server’s real address, because the firewall undoes NAT before it reads them. Then use Analysis to see which rule let the traffic in, and the packet tracer to test a port that a ping can’t.

Cisco FTD-style track · Cisco FTD-style, FTD Manager · 5 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Zone DMZ, and Gi0/2 named dmz in that zone (172.16.1.1/24).
Host object WEB (172.16.1.10). In NAT1, a static rule PUB-WEB for WEB from DMZ to OUTSIDE with public address 203.0.113.10.
In ACP1, a rule PING-WEB: allow icmp from OUTSIDE to DMZ, destination WEB, with Log connections on. Add a port object HTTP (tcp 80) and a rule HTTP-WEB allowing it the same way.
Deploy. R1 reaches 203.0.113.10, and Analysis shows the event with rule PING-WEB.
On FTD1: packet-tracer input outside tcp 8.8.8.8 1234 203.0.113.10 80 ends in allow, with a Snort step.

Start this lab

Before you start

A rule’s Log connections is what makes an Allow appear in Connection events; the default block is always logged. A rule’s destination is WEB, not 203.0.113.10: try it the other way and the tracer shows the drop.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.

Concept

Firewall NAT: three sections, applied in order

An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.