Hi, everyone, and welcome back.
Now in today's video, we are going to discuss about the aid network firewall.
Now at a high level overview, the network firewall is a stateful managed network firewall and intrusion
detection and prevention service for your VPC.
Now, at a high level overview, let's understand this with a diagram.
So let's say that there are two subnets that are available as part of the VPC.
And on the right hand side, you have the Internet gateway for the resources to connect towards the
Internet.
And between both of these sets, the network firewall.
Now, the question that comes is what are the things that you can do at the network firewall level?
Now, as we're discussing that, it's the firewall.
So you will have some kind of a firewall functionality and some kind of intrusion detection and prevention
functionality as well.
So in this case, what you can do, for example, you can add a set of rules.
So in this diagram there are three rules.
First, and the second rule is based on domain based filtering.
So you see any traffic going towards facebook.com, action is blocked towards twitter.com, action is
allowed and towards a specific set of SSID range, the action is allowed.
So this is one common set of rules that you will generally see.
Along with that, the network firewall offers great number of functionality.
So let's do one thing.
Let's go ahead and jump directly to demo to understand things in more detail.
So currently I am in the VPC console and within here you have the network firewall.
So let's quickly open this up.
I have a demo network firewall.
The status is ready.
And if you go a bit down into the final details here, you will see that this specific network firewall
is associated with a VPC.
So this is the VPC where it's associated with and there is also a dedicated subnet where the firewall
end point lies.
So this is the basic let's go ahead and look into how exactly these rules would really look like.
Now, within the network firewall rule groups over here, there are two rule groups.
One is the domain filtering, and second one is the IP filter stateless?
Let's quickly look into the domain filtering rule group.
If we go a bit down in the domains, there are two domains that are added.
One is Facebook.
The second is Twitter.
And the action to take here is deny.
And the traffic that needs to be inspected is both the HTTP as well as the ECB's.
So in order to test it, I have an easy to instance that is already running.
Let's quickly connect to this, easy to and verify if the rule really applies.
So within here I'll quickly do a code on say https facebook dot com.
So at this stage you'll notice that we are not really getting any response to understand this in a better
way.
Let's do one thing.
I also have one more easy two instance, and this easy two instance is running in a different VPC altogether,
which does not have the network firewall.
All right.
So this second tab is associated with a different VPC.
Now, from this instance, when you do a girl on the steps of Facebook.com, you see immediately we
get a response back.
But for the easy to instance, that is part of the network firewall based VPC.
No response is coming back.
Similarly, instead of Facebook this time, if we do a Twitter, the output is similar from the instance
that is outside of the network firewall.
VPC Let's try it out.
And as expected, we are getting the response back.
So I hope that this at a high level overview, you understood the domain based filtering that is part
of the network firewall.
The second thing that I wanted to show you, let's go better to you have a stateless filtering that
is available now.
Again, one thing that needs to be understood is that this specific blocking, you see, it's based
on the domain and the traffic that needs to be inspected is HTTP and https.
So this would mean that if I do a ping on facebook.com.
You see, it is working well because Ping uses the ICMP protocol and here the protocol that is primarily
used is the HTTP as well as the https since we have added a domain here.
Great.
So this is one part.
The second rule that we have is based on the IP filter and the type here you see it is a stateless one.
So let's quickly open this up.
Now, if you look into this specific rule, what we are doing in this rule, the protocol is all the
source is eight, eight, eight, eight, and the destination is 0000 and the action is drop.
So whenever you have this specific IP address, you will generally see for all of the protocols the
action would be denied.
So let's understand this.
So from the easy to instance, let's do a ping on 8.8.8.8 and you see a reply is not really coming now
from the easy to instance that is outside of the network firewall range.
If you try to do a ping on this address, as expected, the reply is coming back.
All right.
So I hope with this you understood the basics on how the network firewall allows us to perform the operation
on both the domain as well as the set of IP addresses.
Now, one more thing that I wanted to show you is that whenever you create a set of rule group, it
is a little more advanced than you will typically see in the other set of firewall related offerings
in place is that you have multiple options over here.
For example, you can specify domain lists, you can even specify compatible IP rules in case if you
have those IP rules available, it becomes much more simpler.
In fact, a lot of organizations uses Sadik ATA, so it becomes much more easier to switch to network
firewalls here.
So let's go back to within the rule type.
You have both the options of stateful as well as the stateless.
Let's quickly open up the stateless over here.
And within here you have an option of PCB flags.
So if you'll open this up, you see you have various DHCP flags, flags, sin fin, you have push,
you have reset, you have ACH and so on.
So the idea here is that the network firewall functionality provides much more greater features than
the traditional firewalls that you will see in a device.
Again, if you are not aware about the DHCP flags, that is completely fine.
Just know that it provides the functionality associated related to the TCP flags, which other firewalls
directly does not provide that.
Now, in order to check as part of this demo, it is really working or not.
What we can really do is we can remove one of the domain that is part of the block here.
So let's go ahead and remove Twitter.
Late now from our AC two instance.
Let's do a call I on Twitter.
And you see things are working perfectly well.
Now, before we conclude, let's quickly revise the benefits of network firewall.
So at a high level overview, you can use the network firewall to monitor and protect your VPC traffic
in a number of ways.
First one is that you can configure the network firewall to pass the traffic through only the known
service domains or the IP address endpoints such as S3.
So this is easily possible because network firewall allows domain as well as IP based rules.
Second is you can use the custom list of known bad domains to limit the types of domain names that the
application can access.
Now for today's demo, we had used Facebook and Twitter, but that is not really the bad domains.
There are a lot of bad domains available related to bots, related to ransomware, etc. So you can go
ahead and use that list as part of the network firewall as well.
And third is you can perform the deep packet inspection on traffic entering or leaving.
Your VPC is now related to the second point I remember because in one of the organizations that I was
working with at that time, the network firewall was not really dead.
So what we used to do is we had a custom list of bad domains that was provided to us by Splunk itself,
because we had the Splunk CRM, which is the Splunk Enterprise Security product.
And we used to add this as part of our Splunk instance.
And the traffic from it is primarily the VPC flow log we use to match that to the custom list of byte
domains.
And we used to verify if there are any matching happening or not.
If there is a match that is happening, then immediately we were alerted for great.
So that's the high level overview and with this will conclude today's video.