Hi everyone and welcome to the next video.
So in this video or in be going over logging and backups now I'm just going to briefly show you this
in this video about where they are and how to do it.
However each firewall tends to do it a different way but in since sense they made it relatively easy.
So if we wanted to do a backup we would go to diagnostics backup and restore.
Now the backup area depends on what you wanted to actually do.
So in our case in most cases you're going to want to do all and then not back Part D R D data which
is fine.
And then we would normally encrypted data and provided a password
download as well.
So what this does is this downloads it and off we go.
That's it.
It's all it takes to download a file or to download the
backup configuration.
So if we go at it
we can see it is encrypted.
Perfect.
Now what happens if we didn't encrypted what does it look like.
Let's go ahead and download it again see here with
text on it.
So now we can see we actually have the college team out which is the actual configuration so it's important
to backup machines not just a firewall but for any network device and any machine.
Now it's also important when you're writing your own tools as a red team or you need to be able to if
you're if you're running a if you wrote a service as an example a phishing service you would need to
perform the backups of a database that you're working with or have some way to back the data or leverage
a database or some other medium that somebody else's are in the company is already using that's backed
up on a frequent basis.
Now to restore it's the same thing you just tell it which restore areas in this case that's all.
And then we browser config file if the configuration is encrypted we give it the password and then off
it goes this will reboot the firewall so the network will drop.
This is the the main point of contact for the network and for the organization.
So that needs to be done in the maintenance window.
And I would recommend doing the backup during a maintenance window as well.
Now the other half of this is as a logs.
Right.
So if we go into status system logs we'll see there's a lot of options here.
So this is the standard general log that we can see here so sinking firewall also when things reload
on the system are peasant issues anything being started is going be here for example you see the SSA
starting the web configured which is the web UI starting.
So we go over Gateway.
This is the actual lead the way in Gateway which sends the sending out its intervals.
So we have firewall in our case we've got our default block rules in place so we see there's a lot of
blocks going on.
So this would tell you if something got blocked from the firewall from a rule it ends up in this log
DHB we can see that right here.
We got our our new address and this is all the information from the DCP service from the router.
And then what we worked on in the previous video was an IP section.
So if you go under here under IP SEC you would see your logs here.
Now this only is going to happen if you actually go and try to start the tunnel in your case since you
guys followed the video and you try to start the tunnel.
You should see logs here.
And if you don't then tunnel it knows that the other end of the tunnel is not it's not available so
it doesn't even attempt to log it which is perfectly fine.
So when you go through that in the next video when you guys build the other half of the tunnel you will
then start seeing logging here and this can be used for debugging purposes in case the tunnel doesn't
come up for whatever reason.
Now this also works for VPN which is slightly different.
This is the under the LP to LTE LTE 2p version of the tunnels.
We can end up load balancing open VPN and any settings that change.
And this is more along the lines of If we want to send this log somewhere if we want to.
So for example a remote logging if we need to send it out use this log what do we want to send out.
How big can the files be before they're rotated.
So go ahead and play around some of the settings here look at the logs that you've generated already
and then understand what is being provided to you and what I also want you to do is go ahead and take
a backup of the config the whole machine and then go ahead and restore it just so you understand what
the process looks like and how long it actually takes.