Make ACL FireWall settlement in a network (secure the PC’s IP to prevent from connecting to a particular range of IPs)

     ____________Our entire network is subdivided into 3 networks (point A, two routers linked, point B)______________

1) Open your Cisco Packet Tracer software, click “file—>new” to create a new project. Down the page, you’ll see some icons. Click on the Desktop(computer, “End devices”) icon, and click on your desired device (desktop, laptop…) and click on the blank page area to bring it there. Do the same to bring as many as desktops you want to be on your network.

2) Next to the “End devices” icon, you’ll find an icon “Network devices”, choose it and choose “switches”, usually we use “2811” switch. All your PC from a started point would have to connect with it via an ethernet cable “Copper Straight-Through”, will be found from the “Connections” icon.

3) Next, you’ll have to connect each switch to a particular router. Let’s say that you have one started point and one destination; so you’ll have to have then 2 switches and 2 routers. With the same “Copper Straight-Through” cable, you’ll have to connect your switches to their particular routers and choose “FastEthernet0/0”. Then, click on your router1 to change its properties. Slide with two fingers to right side of this little pop up page (in the Physical tab), you’ll see a little green light in a mixer icon, click on it to turn it off, then choose from the left side “WIC-1T”, drag it in a black space next to the mixer icon, or a little upper it.
Click the mixer icon again to turn the light green on.

4) To the same for all your routers.

5) Now, you can connect your two routers by choosing the “Serial DCE” cable, and “serial bla/bla, 0/0” when clicking on your router to put that cable. 

6) Click on a PC, choose “Desktop” tab and “IP Configuration” to set your IP addr. From now, leave it as “Static”. Put something like 192.168.1.3,,, keep the 192.168.1.1 for the seed/gateway for the A point, and the 192.168.1.1 for a server if you plan to run a server. Then, click on another PC, do the same, and you can put IP addr 192.168.1.4, etc…

7) Click on a PC from the B point now. Do the same thing, but don’t put the same seed. Eg, of how it should be: 192.168.2.3, and again we leave the 192.168.1.1 for being the default gateway, and 192.168.2.2 for any server, etc…

8) When you are done with PCs, click on a router, then choose “config” tab, “serial 0/0/0”, put the clock rate to sth like 128000, and its IP addr must be different as the computer’s addresses. So, put it like “192.168.3.2”, and check on ON above it. Then go to “FastEthernet 0/0”, in IP addr, put then A point seed/gateway IP, this one “192.168.1.1”. Turn the “port status” ON again, and close it. Do the same thing for all your routers while putting your IP addresses 192.168.3.3, blabla.3.4, blabla.3.5, etc…

                         _____________This Step9 is very important for the communication______________
9) Click on router1 again, now go to “CLI” and type: exit, to leave the “if config”. And type: ip route 0.0.0.0 0.0.0.0 192.168.3.1, then press enter. And type “exit”.
The four first zeros mean any IP addr from the A point, and space, the second four zeros is any IP addr of the destination point, B point.
Likewise we do for the second router, with the IP route. It represents the base/seed on which router1 192.168.3.2 and router2 192.168.3.3 are communicating.

10) Test your network to see if the communication is successful or failed, by click on the “message with +” icon, and click on a PC from point A, and on another one on point B. On the right pane down the page, you’ll see the notification “successful”, or “failed”. If you want, you can click on “Simulation” to see how the process is going.
If you proceed exactly how we proceeded, it should work. If by accident while putting the message icon on both side, you got a “Failed” status, retry to bring that message icon to them again.

11) What if we want to connect our PCs to a Server DHCP?_So, click on the “End Devices” icon, then choose the “server”, and put it in the blank page. Then click on it, choose “config” tab, and “FastEthernet0”, check “Static” to give it an IP_addr. If you put your server in the A point area, give it an IP_addr which matches its zone, like 192.168.1.2; then go to the “Services” tab, choose “DHCP”. 
As we have already set up our gateway for each PC, so we go to the “config—>setting”, then “Static” and paste the gateway IP_addr there “192.168.1.1”. Then, copy and paste the IP_addr given in “Config—> Setting—>Static” in the default gateway in the “Services” tab, this 192.168.1.1 then click “Save” and check “ON” for “Service” right above. Close the tab. Click now on “Connections” and choose “Automatically Choose Connection Type”, then connect your server to your particular “Switch network”.
By doing so, all of our PCs will be assigned a DHCP IP_addr, getting from the server.

12) Now you can verify by clicking on each PC, then “config” tab, then pick “DHCP”, wait for 2-4-5 seconds till it updates, then you will see the DHCP assigned_IP_addr. You can click on your “FastEthernet0” too to see the DHCP IP_addr. Do likewise for the other PCs.

13) Check if they are connected well again, if the communication is successful as we did in step10. All must be alright.

14) We can now secure our network via our rooter. Click on router1 of point A, and choose “CLI” tab, and press “enter”; it’s the Command Line Interface abbreviation. Type “config” and press enter, to get into the “router (config)#” shell, or if when typing “enter” in the first step in CLI area you get your rooter name, eg: “R1>”, you should type firstly “enable” and press enter to have “R1#” instead of “R1>” Now you can type that “config”. Then type “enable ?” to find options. You’ll see 2 options (password and secret). You can firstly secure it with password protected option. Do so by typing: enable password Jean11, then enable secret Jean22,,, press enter in both the commands.

15) Type “username ?” to find options. Type “username blabla ?” to see again more options. You’ll have 3 options you can do, either by choosing him a password, or privilege level, or secret level. We choose again password. So we type: username blabla password Jean1234,,, then we press enter. 

16) Then type “line ?” to get more options what to do. You will have stuffs like that if you’ve configured your network exactly as ours:
  <2-499>  First Line number
  aux      Auxiliary line
  console  Primary terminal line
  tty      Terminal controller
  vty      Virtual terminal
  x/y/z    Slot/Subslot/Port for Modems
Therefore, you can proceed by typing “line vty 0 4” for example. Then type, “login local” and press enter. Close the tab. And now we will test if the password is working perfectly.
Go to any PC (from A point, or point B) —> “Desktop—>Command Prompt”, then telnet the router password (the router1, which they are connected to) by typing “telnet IP_addr_of_the_router1”, (telnet 192.168.1.1, or its 192.168.3.2), and press enter. NOTE: To get the ip_addr of the router1, click on it, then “config—>FastEthernet0/0”, and “config —> Serial0/2/0”; both of them will work after inserting the username blabla & password Jean1234 in the command prompt. You will get to the “router” shell.

Alright !!! So far so good.
17) You can type thus “?” to see more infos, then press enter.

_________________________Now, it’s time to set up our Firewall, let’s build it:—————Start a new project——————————————>

1) Establish a firewall into our network
2) Set the security inside/outside
3) Assign the DHCPD ip addresses via our firewall. NOTE (important): Before setting up your dhcpd ip range into your terminal, please make sure that you go to each of your devices and change the Static option to DHCP; and quickly close the terminal so that the system doesn’t generate you a random dhcpd IP address, such as 169.blablabla.
4) Set NAT network
5) Set the route and the router range IP add…
6) Ping an outside IP addr from an income source IP (from PC0-PC2), then create an access-list.
7) Finalize the access-list by creating an access-group, as being the last command.
8) Check your NAT information.
____________

1) To begin with this topology, we need to assign a specific PC (i.e new PC) to our firewall via a “Console” cable. Go to “Network Devices” icon, choose “Security” icon, and choose any of the firewall. We choose for this demonstration the “5505”. Tap the “Conections” icon, and choose the “Console” one. Then, tap on your new PC, choose sth like “RS 232”, then drag it to your firewall, and choose “console”. 
*The reason why we make a connection between the new PC and the firewall is because that, through that PC, we’ll assign the firewall a IP_addr, and other configurations.

2) Now, connect your firewall to router1 and to the server using “Copper Straight-Through”. And connect your router(s) to the server via “cropper cross-over”, because they are usually similar types of devices.

3) Click on that new PC (which is connected to the firewall), then choose “terminal” and click “ok” if you like the front. So, now you get into a “ciscoasa (config-if)” terminal. Type “exit” 2 times to exit that “(config-if, or config) terminal, so that we get into a shell similar to “ciscoasa>”, not this one “ciscoasa#”, that’s why we type “exit” twice. Then type “en” to enable it. It will ask you for a password, just press enter, cause the password is by default nothing. It will give again the terminal of “ciscoasa#”. 

4) What you have to know:
Usually when using ASA firewall in your Cisco Packet Tracer, or in a real environment, it has some predefined configurations. To view what it already has, type “sh runn” and press enter so that it writes the rest of the command automatically for you. Then, keep pressing enter for more infos.
You will see that it has an “interface Vlan1” with an IP_addr assigned, by pressing “enter” again, you will see even dhcpd IP_addr, etc… You are not the one who configured that IP, so you might want to change them. Do so, by typing “config t” to enter the global configuration mode, then move down the directory terminal of “ciscoasa(config)#”. Then copy & paste the dhcpd IP_addr for example with “no”. Your command for removing it would be “no dhcpd address 192.168.1.5-192.168.1.36 inside
“
If you want to verify, you can rerun the “sh runn”, enter.
We can also replace the its IP_addr instead of removing like above. To do so, we enter the global configuration mode (if weren’t), then type “int vlan 1”, as the vlan 1 was where we had that assigned IP_addr. Type “ip add 10.1.1.1 255.255.255.0”, and press enter to give any address and range you wish. Note: the assigned IP_addr is for that port (i.e the cable joint the switch and the firewall).

5) Now we can give it a name by which this interface will be referred in all other commands. Type “nameif anythinggg”, or “nameif inside”, whatever. Now you can add your security-level. What I mean by that?_We can use any value between 1 - 100. If we choose 100 for example, that means you choose an inside set on ASA firewall, the security-level is low. If you choose 0, it means it is set as Outside, and the security-level is in the most high condition. If we choose 1 or up to 99, these values are usually used for DMZ network, means that any other devices, servers (even external devices, out of your network) can connect with you.
So, the command is “security-level 100”, then press enter, and type “exit” to exit.
[[[[[[[[[
a DMZ or demilitarized zone (sometimes referred to as a perimeter network or screened subnet) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted, usually larger, network such as the Internet.
]]]]]]]]]

6) But since we are on a LAN, we can choose 100 value, it’s not a problem. Type “security-level 100” in the ciscoasa(config-if) terminal, then type “exit” to exit.

7) Now, we’re gonna set up a switchport access. We type there “switchport access vlan1”. NOTE ——VERY IMPORTANT—— If you are not yet familiar with the command line, OF COURSE you can use your “Config” tab instead. Eg: instead of typing in the command line “switchport access vlan1”, tap your server, and choose “Config” tab, then “Ethernet0/0”, then you will see “Access” in the right pane, choose your VLAN number. It will automatically write below in the blank page “switchport access vlan 1” (if you chose 1).

8) Now choose the VLAN 2 as we did in step4, (in the last paragraph), by typing in the command line “int vlan 2”, press enter. Give that port an IP_addr by typing “ip add 10.1.1.2 255.255.255.0”, then type “no shut”.
Give it a name again, “nameif outsideblabla”, or just “name outside”. Set its security-level by typing “security-level 0”, (as it is outside, we secure it safer). Type “exit”.

9) Go make the “switchport access” for vlan2. Do the same thing as is in step7. Exit by typing “exit” to quit the “ciscoasa(config-if)” terminal.

10) Now you can close the command line little page.
Click on the router2 to assign the outsider IP addresses (i.e, FastEthernet0/1), the one which goes to the server). 

11) As we set up our firewall with an IP_addr for the outside IP_addresses which is totally different than the ones assigned to our PCs, when our PCs are gonna traverse our firewall to go to another point, our firewall will assign each incoming PC with a new IP_addr. As such, we have to set up our firewall DHCP addresses via that new PC connected to it through the “Console” cable.
So, click that PC, choose “Desktop” tab, then choose “terminal” option and then click “ok”; now, we get into the firewall terminal as we can see (the ciscoasa>)

12) Type “?” to view options. Choose “enable” by typing “en”, the password is blank, so keep pressing enter. Then, go to the global configuration by typing “config t” to get into “ciscoasa(config)#” terminal, then type “dhcpd addr”, press enter to see the rest of what to do (it’s just a way to get know the commands). So type “dhcpd address 10.14.1.9-10.14.1.26 anythinggg”, press enter (check step5 to see how we named it). Explanation: The IP range from 9 to 24, will assign to any PC enter the firewall. That means, we allow only 17 PCs to traverse our firewall. But, it’s up to you, according to how big or small your network is (how many devices you have), you can increase or decrease the range.

13) Assign your firewall with a DNS address by typing “dhcpd dns 8.8.8.8 interface anythinggg”, press enter and close the page. Now, you can test it by opening any of your PC, then go to “Desktop” tab, “IP configuration”, if it was on DHCP, put it on Static, and put it again on DHCP, that makes a refresh, then you will see how it gets a range from your firewall. In this case, firewall is acting as a DHCP server, as we did in the first part.
NOTE: we do this step-by-step for DHCP in our firewall assuming we didn’t do the “DHCP” already. But, we did it in the first part (from 1 to 17)

14) Now, we can configure the route for our firewall to go to our routers1,2. If we want to make the route as default, we can make the route too router1 be the default one. That route is made from a cable linked to a destination (your chosen router). We can add a “copper straight-through” cable which will connect our firewall to our other routers (router1, or router2, etc… according to your network).
To do so, we click on that new PC (the one which is connected to our firewall via the “Console” cable), then we choose “Desktop—>Terminal” to make the configuration. We type: route outside 0.0.0.0 0.0.0.0 the_router_IP, which will be “route outside 0.0.0.0 0.0.0.0 192.168.3.2” then press enter.  (see step8 to find your vlan 2); NOTE: To get the ip_addr of the router1, click on it, then “config—>FastEthernet0/0”, and “config —> Serial0/2/0”

______Extra———————>

15) We can afterwards create an OSPF (Open Shortest Path First (OSPF) is a routing protocol for Internet Protocol (IP) networks.) on the router1 by doing so: Go to the particular router; in our case, it’s router1==2811 router0, we called router1, cause it’s our first. Click on the router, —> CLI then make sure we are into the global configuration mode “Router(config)#”. Because it’s not always there automatically, usually it is on “Router>” terminal. So, type “enable”, then enter the password that you have put while securing your network in step14 in our first part (that password was Jean22). Then type: “config t”, then press enter. Now, we get into the Router(config)# shell.

a) do: . Type “router ospf ?” enter to see more options. Pick any number, it doesn’t matter which. So, we choose then “router ospf 1”, enter. Type “net any_IP_addr_which_connect_to_it_via_a_cable”. The “net” means network. 
b) Since 10.1.1.2 is one of the network which connects to it, so, we have then “net 10.0.0.0 ?” to know what it requires. After seeing what it needs, we clearly see that it requires a wild card bits. So the final command is then “net 150.0.0.0 0.255.255.255 area 0”, then press enter. Copy & paste the same command again by a little modification “net 192.0.0.0 0.255.255.255 area 0”, since the next connected network/cable to it is 192.168.3.2.

16) We will create here an object network & enable NAT on the firewall (of course via that new PC). Being on terminal “ciscoasa(config)#” commonly called “global configuration”, we type: object network ? And press enter to view more info. The command will be: “object network anyName(network, so that you remember it). Eg: “object network LANyes”, then press enter. 
After, type: “subnet IP_base_addr_of_the_network_entering_the_firewall and the subnet_mask”. In our case, that IP_addr is 10.14.1.1, so the base will be 10.0.0.0, and the subnet_mask is 255.0.0.0. The complete formal command is therefore: “subnet 10.0.0.0 255.0.0.0”, press enter.
b) To configure/enable NAT, type “nat ?”,,, enter. Now, put inside the parenthesis what kind of NAT you want to have. From “ciscoasa(config-network-object)#” terminal, type: “nat (anythinggg, outside) dynamic interface”, press enter.

17) Now we can create an ACL (Access-List) on our ASA firewall:
But before that, we can try to ping a PC at another point, and/or ping the 192.168.3.2 (the cable_direction/network after the router1 which is router0 in our case) to see if any reply will be made. Obviously reply will be, because the connection will be made from that particular PC to the switch and to the router0. But, if we ping the 150.1.1.2, the request will be timed out. 
To do so, click on a PC from end A, choose command prompt and type “ping -t 192.168.3.2”, and press enter. Now try “ping -t 150.1.1.2”, press enter. NOTE: We’ve put -t in order to make the request be sent over and over.
Thus, as soon as we configure our ACL, the reply will start coming and our firewall will start giving us its service in our network. Click the PC designed to configure firewall, that new PC, choose “Desktop—>terminal”, and enter the global configuration (ciscoasa(config)# terminal). Type: “access-list ?”, then put anyName_chosen_by_you and again question mark, as “access-list krakra ?”. We’re gonna use the “extended” option.
So, we type: “access-list krakra extended permit tcp any any”, and press enter. 
Or “access-list krakra extended permit ?” to see more options, then again, put question mark again & again where it’s possible. Copy&paste the same command by modifying it, instead of “tcp”, put “icmp”, press enter again.
- The last but not least, we’re going to make an access group. As soon as we press “enter”, our command prompt ping terminal will start working, sending reply, they will stop saying “request timed out” (assuming you let them running, didn’t close them in the previous step above). 
Type: “access-group krakra in interface the_name_of_your_vlan2”, i.e ==> “access-group krakra in interface outside”, press enter. Wait some seconds, you will see your command prompts ping terminal will start sending reply.

18) Verify it:
Click on that new PC, “Desktop —> terminal”, then type “show nat”, press enter to see what you have done, how they were running.