In this demo,
we're going to go over the lab setup I'm using in all the demos in this course.
When I built the lab for this course, I used only open source software and
operating systems or evaluation copies that are free to obtain. Links to the
images and software will be in the demo files.
For this course,
I'm running multiple virtual machines in a subnet behind a Snort server
running on Ubuntu Server 18.04. These servers are running on two VMware
ESXi hosts connected through a switch,
which I am accessing through VMware Workstation. VirtualBox and other
virtualization software will work just as well if that is your preference.
The Snort virtual machine is set up to use inline mode.
I set up two network interface cards on this machine,
setting one to my local network and the other to an internal network that
only exists on a switch connecting these two hosts.
Although I configured a small back end,
you do not need nearly as many virtual machines to fall along with the
demos for this course. A single machine running Snort will be sufficient
to practice configuration and test alerts.
I set up this environment to enable Snort's inline operation
and provide a more realistic environment.
I included a Kali Linux VM to run port scans and send other traffic to
the internal network, and a vulnerable server inside the internal
Globomantics network to serve as its primary target.
I also set up a small Windows domain on the internal network,
which is not necessary for you to follow along. To install Snort, I went
through this install guide for Ubuntu Server on Snort's website.
I went up through the basic install, app ID configuration, and initial testing.
I stopped configuring here at Installing Snort Community Rules since that's
something we'll go over in this course. Following the same guide will enable you
to replicate the environment and easily follow along in the demos. This guide is
easy to follow for anyone new to Snort, and especially for anyone new to a
primarily command line environment.
If you prefer to use a different host operating system,
there are multiple installed guides available on Snort's website
that are very easy to follow. To get the systems to communicate
through Snort, I had to enable routing on the Ubuntu Server and
configure the firewall to allow communication between the internal
and external network.
There are a lot of tutorials available online to help you configure Ubuntu
to route if you want to operate in inline mode. This configuration will not
be necessary to follow along in the demos. Again, a simple environment with
a single Snort server is sufficient to practice navigating through Snort's
configuration files, enabling modules, and activating rules files.
Now that we've covered the lab setup,
we're ready to start up Snort and begin configuring it. In the next clip, we'll
navigate to our Snort server and capture our first packets.