Hello my name is she has from Teach epics.
Welcome you all to Cisco firewalls course in this with you.
We will cover some specific configuration related to Cisco a is a access control lists and also we will
do a practical lap to show how to configure the firewall from Cisco.
So by the end of this video you will be able to understand the basics of configuring the Cisco as a
firewall and what actually you need to do in order to fulfill and accomplish your task.
So let's start Let's first review and highlight some concepts here.
As we all know there is a firewall has by default two interfaces.
One is outside and one is inside the inside which has by default the security level of one hundred is
considered the highest security level.
And the outside has the security level of zero and it's considered the lower security level by default
all outbound traffic is allowed which means from the higher to the lower by default traffic and communication
is allowed.
So it can move from the 100 to the zero security level without any restrictions.
However the other direction is not allowed by default.
So from outside to the inside from zero to 100 it's not allowed by default.
OK.
So that means if you don't have any access control list configured on the firewall by default you go
from inside to outside.
Go
Ok.
And also if you don't have any access control list configured by default traffic is restricted from
the outside to the inside as it chose here in disfigure.
So traffic will be stopped.
So what if you want to bypass these default behavior of the A's a firewall.
What if you want to allow traffic from the outside to the inside.
Then you will need to configure an access control list here.
Right.
So if you configure an access control list with a pyramid pyramid statement to allow traffic from the
outside to the inside it will bypass this default behavior for the firewall which is denying traffic
from the outside to things.
OK let's move forward to this slide actually this slide shows that you can create access control list
as much as you want.
However they will have no effect if you don't apply them on a specific interface.
How you apply them.
You need to use this command axis group.
So the steps here are very easy.
First you create the Axis list you give it the number permit you define the IP address and the wildcard
mask then is it going to work like this once you create it.
No you will have to define which interface you will apply this access control list on.
So in this example we defined the interface of fast internet zero over zero and then you apply these
command axis group.
This number is the same number of the access list and you define that direction whether it's in or out
whether it's inbound or outbound
access control restroom.
OK so here are the steps.
Create the far access control list define which interface you want to apply the access control list
on and then you apply.
We will have a lab here.
The purpose of these lab is to deny pink from this B.S. to this firewall OK so this P.C. will have this
IP address 1 9 2 1 6 8 1 10 and the 5 1 5 5 0 6 will have by default the inside interface 1 9 2 1 6
8 1 2 1 with the same subnet mask of 24.
So we will need now to deny pin gain from this P.C. to the firewall.
OK so here you go.
As it shows here one that one is this interface
so let's see how we will do this let's open Cisco packet tracer
let's change this to 10 OK.
This is actually the final lap after it has been configured so let's open a new Cisco packet tracer
lab here
let's first grab the five five or six five or and then we grabbed a P.C.
let's chronic those two devices together network interface card to gigabit Ethernet one over one which
if it has by default like you see one that one.
OK so let's first start by giving an IP address to this P.C. go to the configuration tab here first
item at zero and let's give it 1 9 2 1 6 8 1 that we will give it 10 with the subnet mask default 2
5 5 2 5 5 2 5 5 0 which is that 24.
It's equivalent to 24.
OK
all right.
So
by the way that the subnet here the subnet IP address would be 9 1 9 2 1 6 8 1 0 0 slash 24.
This one will have one.
This one will have top 10.
So let's configure this but before we configure this we need to specify the gateway for this P.C. the
gateway will be the P.C. you will be having the gateway of 1 to 1 which is the inside IP of the internal
interface of the inside interface of the firewall.
So let's give it.
And the gateway address 1 9 2 1 6 8 1 the 1 That's it that's all we need on the P.C. now let's go to
the firewall and configuring
go through the seal I type enabled it will prompt me for a password by default there is no password.
Press enter then let's start configure this firewall all we need to configure here is to fly and configure
a security level for this Internet interface it has an IP already IP address already it's up already
but we need to give it a name of inside and define that security net so configure sternum or contracted
interface Gigabit Ethernet one over to one
let's give it an inside name interface
inside security live in just type as easy and press def we will give it the security level of one hundred
and then that's it that's all we need it's already on but in case it's not on just type no shut down
no shut
Oh right.
Control Z and save your configuration here control set enter civic configuration by typing copy running
can start
enter your concentration is saved right.
So now what else we need to do now let's ping from this P.C. to the inside interface so let's go to
the P.C. here.
Open the door.
Click on the desktop tab.
Go to the command prompt and ping
1 9 2 2 1 6 8 1 1.
Perfect.
It's pinging right.
As you can see it's green.
So the connection is up and running.
It's pinging.
Now what do we need to do is we need to restrict this pinging.
We don't want this P.C. to ping actually anywhere.
Not only this interface.
We don't want this P.C. to ping anywhere in this network.
So what we need here to create an access control list and we will give it a name of being you can either
give it a number or a name so let's go to the firewall configure Thurman
OK.
We type access that list if you don't remember what to type.
Just type question mark it tells you here oh what a name.
We will give it a name will speak in math capital letters again question mark.
It will ask you.
You want to use deny or extended payment.
This actually access control list will be an extended access control list so we will type extended
again.
Question mark.
What do I want to do.
I want to deny the ping so type deny again.
Question mark since you want to deny the ping the ping walks on a protocol called ICMP into Internet
control messaging protocol or management protocol.
So any time you want to either allow or deny being you deny or allow this protocol ICMP so type ICMP
here is the option here they're giving you many options ICMP DCP UDP IP Soleil type ICMP.
Again question mark
OK.
It gives you these options whether you type an IP address for the source any host object what do I need
to know.
I need to deny this specific IP address the specific host.
So I would choose the host option by post again.
Question mark it asking me to put that IP address of this host which is 1 9 2 1 6 8 1.
Then again question mark
where or to where I want to deny this ping.
I want to deny pinging from this P.C. to anywhere.
So I would use any that's it.
Type enter the access control list is created.
OK.
Is it effective.
No.
You need to apply it on a specific interface.
All right.
So what do we need to do.
We need to use the access group command so to have access that's group
question mark
from two for the name or award our access list name is being sought by the same name
bank.
Again question mark.
All right so how I want to deny pinging I want to deny pink let's see our lab here the inbound in the
inbound direction from here to here.
So on this interface the inbound traffic so I will choose here in.
All right in question mark.
All right.
It trumps me which interface you want to apply this rule on.
I want to apply it of course own the inside interface which is this one OK.
So here is the sequence axis that's group you type the same name of the axis list that you created.
You type the direction in which direction you want to apply the Axis control list which is the inbound
in and then you type the word interface first so we will type interface
question mark.
It would prompt you.
Is it the inside or the outside.
I want to apply it on the inside.
So type inside.
That's it.
Press enter control said
and save your configuration.
Right.
You say the configuration.
Now let's try to ping again
same IP.
Boom.
It worked.
We cannot think because we denied being from this P.C. to this interface.
OK.
So first before we create the access control list we were able to ping now the ping failed.
So that means our access list is working.
All right.
So that's all for this with you.
I hope you enjoyed it.
In the next video also we will cover and configure a lab for allowing access from the outside to the
inside.
Thank you very much and see you in the next video.