Hi, everyone, and welcome back.
Now, in today's video, we look into the deployment aspect of network firewalls.
So this is going to be the practical session associated with network firewall.
Now, before we go ahead and deploy it, there are certain important things that we need to understand
from the architecture point of view.
So just the device, the network firewall protects these subnets within your VPC by filtering the traffic
going between the subnets and the location outside of your VPC.
For example, if you see you have a customer subnet over here and you have the Internet gateway and
the resources which are part of the customer subnet needs to send some traffic towards the Internet.
So between the customer subnet and the Internet gateway, you have a dedicated subnet of a firewall
subnet where your network firewall related endpoint resides.
So this is very important.
You have to create a specific subnet where your network firewall endpoint resides so that it can filter
the traffic going between the Internet gateway and your customer subnet, and the rules would be applied
accordingly.
Now let's quickly discuss about the route table entries as well.
So at the firewall subnet level, what we'll have to do, the ten 000 is the default local route.
This is fine.
One route we'll have to add, which is the 0000 towards the Internet gateway because once the traffic
from the AC to instance of a customer subnet reaches to that of the firewall subnet, firewall subnet
should have the connection towards the Internet gateway so that it can send the traffic towards it.
So this is one of the entries that you'll have to add in the firewall subnet route table.
The second route table entry is related to the customer subnet and what we need to do for 0000 instead
of sending it to the Internet gateway, you'll have to specify the VPC endpoint that is associated with
the network firewall.
All right.
So this is the second entry.
And the third entry that you'll have to add is at the Internet gateway level.
So you can use an edge association where any traffic that is going towards the customer subnet.
So if you'll see the customer subnet is ten 020 slash 24.
So any traffic going towards that should go towards the VPC endpoint.
So even the inbound traffic from the Internet gateway to the customer subnet must pass via the firewall
subnet area.
So these are the three important route entries.
Great.
So let's do one thing before we proceed further related to the network firewall related discussions,
let's go have the architecture ready.
Now, one thing before we start that you have to verify is the network firewall pricing.
So whenever you see some database services which performs a lot of interesting things, always check
the pricing first.
So related to the network firewall pricing, you see you have a network firewall endpoint as we were
discussing that you will have an endpoint in one of the subnets.
So the cost here is $0.395 per hour, around $0.4 per hour.
At this stage.
It can happen that after a few months when you're watching this video, the pricing might change, but
just verify the pricing before you create the resources over here.
Great.
Now, within my address environment, let's quickly go to the VPC service.
So I'll click on Create VPC.
And recently they have launched this new Create VPC experience.
So this way it becomes very simple to launch a VPC here.
So everything is generated for you.
So the name of the VPC is Project.
This is going to be the cinder block.
If you go a bit down, you can specify the availability zones and the number of public as well as the
private subnets.
So let's do one thing just for simplicity.
The public subnets will select as to the private subnet will select as zero.
So you see the overall configuration has changed.
Their net gateway is not really required.
The VPC endpoint of S three Gateway is also not really required.
So these are the basic configurations here.
Once this is done, you can go ahead and create the VPC.
Great.
So our VPC is created.
Let's quickly do a view VPC and these are all the configurations here.
Now let's filter things out by our project.
VPC So you should be able to see the project VPC over here.
Let's go to the subnets now in here.
As expected, there are two subnets now similar to the diagram that we were discussing.
They are two subnets here.
One is dedicated for the firewall subnet.
Second is dedicated for the customer subnet.
Now, let's do one thing.
Let's go a bit down.
Let's go to the firewalls over here.
So this is the network firewall.
Let's click on Create Firewall.
Let's give it a name.
I'll say Demo Network Firewall.
You can select the VPC.
In our case, the VPC is associated with a ten 00c order.
I'll select this one.
You can select the availability zone.
I'll be using the availability zone of three over here and there is only one subnet here which will
be selected.
Let's go a bit down.
The next section is associated with the firewall policy will be discussing about this in just a moment.
But at this stage, let's select create an associate empty firewall policy that is completely fine.
Then you have a delete protection in case if you need, I'll just deselect it and I'll also deselect
the subnet change protection, primarily because this is a testing environment for protection environment
you can have delete protection and so on.
Once this is, then you can go ahead and create a firewall.
All right.
So it is not getting created.
So we might have missed one thing.
Let's quickly go a bit up to understand.
It says that a resource name must be set.
So let's go a bit down.
And here's the firewall policy name we have not said again.
We'll be discussing about what firewall policies in just a moment.
Let's just call it the firewall policy.
Let's go a bit down.
We'll create a firewall.
All right.
So at this stage, it is in the provisioning state.
And even from here, if we'll quickly open up the firewall, you see it is in the provisioning state.
Now, if you'll see there are multiple options within the network firewall.
You have firewall, you have firewall policies and you have the network firewall rule groups.
So let's go ahead and understand each one of them till the time our network firewall gets provisioned.
Now, similar to what we were looking into the console, there are three primary resource types that
the network firewall manage.
You have a firewall, you have a firewall policy and you have the rule group.
So let's start with the Rule Group Warrior.
So Rule Group basically defines the set of rules to match against the VPC traffic and the actions to
take when the network firewall finds a match.
Now, in the demo video we were discussing about rules related to how domains are blocked, how IP addresses
are blocked.
So all of those rules where you specify Facebook.com, Twitter.com, IP addresses, all of those things
are added as part of the rule group.
This is one part.
Second part is related to firewall policy.
In firewall policy, you can have one or more rule group, so you can add a set of rule groups into
a firewall policy.
And there are a few other configurations and settings that you can also add over warrior.
And third is the firewall, which provides the traffic filtering logic for the subnets in the VPC.
Also note that the firewall policy gets associated with the firewall.
Now within our console, our network firewall is still in the provisioning state.
That is fine because we still have to do multiple things like root table entries and so on now until
the time it is in the provisioning state, let's go ahead and quickly create a new rule group.
So I'll create a rule group over here.
Now you have the option of Stateful Rule Group as well as the Stateless Rule Group.
I'll just create a rule group.
Let's just call it a domain filter.
You can give a capacity here.
I'll just say five.
And within here there are multiple ways in which you can specify like the tuple value.
You have to specify source IP, source port destination IP, destination port protocol and so on.
Domain list and the server are compatible.
IPS rules will be using the domain list over here and the domain name you can say facebook.com and let's
also specify Twitter.com.
All right.
You can specify the protocols, HTTP, https, and you can specify the actions whether the traffic towards
this should be allowed or deny.
So I'll just say deny and we'll create a stateful rule group over here.
Now, this rule group that we had created, it needs to be associated at the firewall policy level.
So before we do that, let's also create one more rule group over here.
Within here, I'll select the Stateless Rule Group within the name, I'll say IP filter within the capacity.
You can just give it a file as an initial start.
And within the rules over here you can select the protocols in case there are a lot of protocols that
are available.
You see there are so many protocols that are available over here.
So this is one.
Second is the source.
Let me just say 8888 destination 0000/0.
Let's go.
Bit down.
Within the actions you can do past drop.
I'll just say drop.
I'll add a rule and we have one rule that is available.
I'll click on Create Stateless Rule Group.
All right.
So at this stage, there are two rule groups that are available.
Now, this rule groups can be added to a firewall policy.
So let's go ahead and add both of these rule groups to our firewall policy.
And currently, we have this one firewall policy that is available.
I'll select that.
There are these two rule groups over here.
We have domain filter and IP filter.
And along with that, you also have certain list of rule groups that are available in case if you would
like, you can select that.
I'll not be using that for today's demo.
Let's go a bit down.
I'll click on next.
So just verify the number of rule groups that are added.
In this case it is to.
And then click on Add Rule Group to Firewall Policy.
Great.
Now as we're discussing, you have your rule groups, you have the manage rule groups as well.
So this is quite useful in the enterprises.
But for our testing environment, we'll keep it simple.
Let's go a bit down.
Let's go to firewalls and our firewall endpoint is ready.
Now, if you'll quickly open this up, let's go a bit down.
Let's look into the firewall details.
Let's go a bit down here.
You will see that our firewall is associated with this VPC and there is one subnet ending with BD eight,
which is basically the firewall subnet.
And this is the endpoint ID.
Now in the roundtable entries we were discussing on how the traffic from the customer subnet needs to
go towards the endpoint, the traffic specifically the one that is going towards the Internet.
And same goes for the Internet gateway.
The traffic that is going towards the customer subnet must go through the VPC endpoint.
So this is something that we'll have to add.
Now, let's do one thing.
Let's go better.
Let's search by our project VPC.
Let's go to the subnets.
There are two subnets available.
If I quickly open up one of the subnets.
Let's look into the round table here.
There are two round table 14000, which is towards the Internet gateway and the second subnet.
Again, it has the same round table, so we'll have to modify this now before we modify it.
Let's quickly re verify in which subnet the network firewall is created.
Let's open up fiber details again and it is in eight.
So eight is the second one.
So the first one the associated with the 3v1, this is going to be our customer subnet where we'll be
launching an AC two instance.
So what we need to do for this specific subnet, which is going to be the customer subnet, in fact,
you can just rename it as well.
Let's just call it as customer subnet.
So it's easier to identify.
For this, we'll have to add the round table entry.
So let's do that.
So in the roundtable will quickly create a new round table.
I'll say customer subnet.
It will be associated with our project VPC.
I'll create a round table and in this round table there is a default route of ten zero zero 16, which
we see in that diagram as well.
This is fine.
The next route we need towards the destination of internet and it should go towards the VPC endpoint.
So we'll edit the routes.
Let's add a new road towards the Internet and it should go towards the endpoint, which is our VPC endpoint
over here and I'll click on Save.
All right?
And we have to associate this with our subnet.
Let's add it, and we'll associate it with our customer subnet.
Great.
Now, from these subnets, let's quickly verify.
So from a customer survey, look into the round table.
There are two routes, one towards the local and second towards the VPC endpoint.
So our customer subnet part is completed.
The next part is the firewall subnet as well.
So within the route table, you can either use the default route table or you can just create a new
route table and create a new round table so that it's easier to understand.
So I say firewall route table.
This would be associated with the project VPC.
I'll click on Create Route Table.
Let's go ahead and edit the routes.
I'll add one more route.
Let's refer to a diagram.
So the route of 0000 should go towards the Internet gateway.
So we'll use that.
So the zero zero route should go towards the Internet gateway and I'll click on Save Changes.
Great.
And the third route is associated with the Internet gateway.
So you can use the Edge Association where any traffic going towards the customer subnet needs to go
towards the VPC endpoint.
So what you can do, you can quickly open up the subnet, get the C range.
So this is the C range, let's copy this.
Let's create a round table.
I'll just call it as ICW.
Root table will associate it with our project VPC and we'll create that out table.
So a round table is created.
This time we'll use the Age Association.
Let's associate it with the Internet gateway.
And in the notes we'll add the CAGR of our customer subnet.
The target this time would be the VPC endpoint.
As you see, the target would be the VPC endpoint.
This is what we are going to do.
We'll click on Save Changes.
Perfect.
So all of our round table entries are now created.
So now, in order to test the things that are working as expected, let's quickly open up the easy to
console and let's launch a new instance.
We just name it as customer subnet.
AC two let's go a bit down.
Within the keeper, you can either select the key or you can proceed without the keypad.
I'll just select the key for the time being.
Let's go a bit down within the network settings.
We'll have to edit it so that it uses a project VPC and it uses our subnet, which is the customer subnet,
to make sure it launches within the customer subnet within the auto and public IP.
I'll just say enable and we'll click on launch instance.
All right.
So we are getting an error stating that the requested instance type is not supported in this availability
zone.
All right.
So let's edit the instance config.
Let's go a bit down this time instead of PT to micro because it does not seem to be available in Osaka
in this specific availability zone.
Let's go for a different instance type altogether.
I'll just try and find out.
Large.
Let's see if it is available.
And yes, it is available.
So again, this is an important learning that not all of the instance types are available in all of
the regions.
So you'll have to verify generally if you'll use North Virginia, Ohio and other regions, you will
not really see an issue.
But in some of the newer regions, this is one of the issues that you will generally face anyways.
So let's open up our ESI to instance.
So it is in the initializing stage now till the time the instances initialize.
Let's do one thing for the security group associated with this easy to instance, there is a port of
22 that is allowed.
Let's quickly modify the security group.
I'll edit the inbound rules.
Let's add a new rule.
I'll say all traffic allowed from all and then remove the earlier rule of 22 and I'll click on Save.
Great.
Let's go back to the instances and the statistic is passed over here.
So let's do one thing.
Let's copy the public IP of the instance.
And from a seal, I will go ahead and try to ping it.
And as expected, we are able to connect to the instance.
So let's go ahead and try and do an SSH.
Great.
So we are now connected to the AC two instance.
From here, let's quickly verify if we are able to connect to the servers like Facebook using Ping and
it is working as expected.
Now let's do a call with hyphen A on the https facebook.com.
And as expected, you are not really getting any reply back.
Let's do a control c.
Let's also try Twitter
and as expected, you are not getting any reply back.
Now what you can do in order to verify if it is really working as expected.
Let's go to the rule groups over here and within the domain filter.
Let's remove these domains.
Let's remove one of the domains.
Let's say I'll remove Twitter.
All right.
Perfect.
So from the clay, let's clear the screen.
And after a few seconds, note that it takes a little amount of time in seconds for the rules to be
reflected.
So now if I do a goal, you see it works perfectly well and we are getting a reply back.
Similarly, we also had a stateless rule that would block the traffic towards the 8888 IP address.
And you see, we are not really getting a reply back.
Great.
So that's the high level overview about the network firewall.
Again, the video went a little longer, but since there are a lot of things that were involved and
we were discussing about each and everything, practically, it took a little amount of time.
Now, one more thing to note is that initially it might look a little confusing because there are so
many things involved related to route entries, related to the network firewall concepts and so on.
But once you implement it practically things will become much more simpler.
Now again, note that before we conclude the video, make sure that you delete all of the resources
that you have created.
Otherwise you will get an unexpected higher bill.
Now let me quickly show you how you can delete the network firewall.
So in case if you try to delete it directly, this might error out.
Let's try.
And as expected, it is editing out and it is stating unable to fulfill the request because the VPC
endpoints still exist in the route tables.
So what you need to do is you'll have to remove the VPC endpoint entries from the road table.
Let's quickly do that.
So from our custom VPC, let's go to the subnets and from the customer subnet, we had this round table
entry and same at the Internet gateway level.
So let's quickly remove that.
So at the Internet gateway level route, let's remove the route.
I'll delete the VPC endpoint route.
Let's go back.
Similarly.
At a customer subnet level.
Let's remove the road.
And once the road entries are removed, if you try and delete the file, well, let's try it once more.
You see, this time it is working perfectly well.
Let's remove the earlier error message so the deletion is in process.
All right.
And similarly, make sure that you also delete the custom VPC and the AC two instances that were created.
So that's the high level overview.
And with this will finally conclude today's video.