-: Firewall issues, in this video, 2 2
we're going to discuss firewall issues 3 3
and how to troubleshoot network issues 4 4
involving incorrect firewall settings 5 5
and block services, ports or addresses. 6 6
First, let's talk about the purpose of a firewall. 7 7
Remember firewalls or network security devices 8 8
that moderate and filter 9 9
incoming and outgoing network traffic 10 10
based upon established rule sets. 11 11
Essentially firewalls act as an inspection point and barrier 12 12
between a private internal network and the public internet 13 13
or other private internal networks, 14 14
if you're using screen subnets, 15 15
Now, firewalls can exist as either host-based firewalls 16 16
or network-based firewalls. 17 17
A host-based firewall is a piece of software 18 18
that runs on an individual computer or device 19 19
that's connected to your network 20 20
and performs the functions of a firewall 21 21
to protect that one single device. 22 22
For example, if you're running a windows, client or server, 23 23
you can utilize the built-in windows defender firewall 24 24
to go dock to host based, 25 25
two-way network traffic filtering and inspection, 26 26
as well as blocking unauthorized network traffic 27 27
from flowing into or out of your device. 28 28
A network-based firewall is a network security device 29 29
that's deployed inline with the network traffic flow, 30 30
just before the border or gateway router 31 31
in order to monitor and filter incoming 32 32
and outgoing network traffic 33 33
based upon your established rule sets. 34 34
In general, regardless of whether the issue resides on a 35 35
host-based firewall or a network-based firewall, 36 36
the network connectivity issues experience 37 37
will be caused by one of three different situations. 38 38
First, access to protected resources 39 39
from unprotected networks, isn't working. 40 40
Second, access to unprotected resources 41 41
from protected networks, isn't working. 42 42
Or third, access to the firewall 43 43
and its configurations, isn't working. 44 44
Basically the problems can be broken down 45 45
into either traffic is not going through the firewall 46 46
or traffic is not going to the firewall, 47 47
and in either case it's not working properly. 48 48
So to troubleshoot these issues, 49 49
you should use your seven-step troubleshooting method 50 50
and understand the OSI model to troubleshoot each layer 51 51
from layer one physical all the way up 52 52
until you identify the issues. 53 53
Now, for example, is the firewall properly cabled 54 54
into the network at the right position? 55 55
If so, does the link lights on the network interface card 56 56
show up that the link is established 57 57
between the router and the firewall? 58 58
If it does layer, one is probably not your issue. 59 59
Next, we go to layer two, 60 60
and we determine if the router and firewall 61 61
are communicating using AARP and their Mac addresses. 62 62
If they are, we're going to move up to layer three 63 63
and determine if the firewall has a valid IP address, 64 64
subnet mask and default gateway. 65 65
And that way it can communicate properly on the network. 66 66
Once we've done all that we can now inspect the firewall 67 67
itself for issues. 68 68
Usually when traffic isn't flowing to 69 69
or through the firewall, 70 70
the issue is going to be related to a misconfigured rule set 71 71
as part of your access control list or ACL. 72 72
Now the access control list 73 73
is simply a collection of permit and deny conditions, 74 74
which we call rules. 75 75
And they're going to provide security 76 76
by blocking unauthorized users 77 77
and allowing authorized users to access specific resources. 78 78
To inspect the firewall rules on a network based firewall, 79 79
you're going to use the command show access dash lists 80 80
to display the contents of the current access control list 81 81
on a Cisco device, as an example. 82 82
Each device is going to have a different command, 83 83
but for Cisco it's show access lists. 84 84
Now, let's say for example, you're trying to figure out 85 85
why the network clients and the internet filter group 86 86
are not able to access Google, Facebook 87 87
or Dion training's websites. 88 88
You might log into your firewall or router 89 89
and check the current ACL restrictions. 90 90
In this example, 91 91
you can see there's a deny statement in line 20 92 92
for the internet filter group. 93 93
And it states that all TCP network traffic 94 94
from any IP to any IP over any port 95 95
should be blocked by this rule. 96 96
Basically, any clients have been added 97 97
to the internet filter group 98 98
will be unable to connect to any websites 99 99
because they're using TCP to connect a report 80 100 100
or port 443, when they're trying to go to a website. 101 101
Similarly, if we have a client in the one-on-one group 102 102
and it's having timing issues, 103 103
we could look at our ACL and see what the root causes 104 104
looking at line 10 within the one-to-one access control list 105 105
states to deny any UDP traffic 106 106
from any IP to any IP that uses NTP, 107 107
which is port 123 and use for the network time protocol. 108 108
The problem here is that NTP operates using UDP traffic. 109 109
So the single line in the ACL 110 110
will break all MTP functionality 111 111
for any devices assigned to group 101. 112 112
So when you're writing or editing an ACL rule, 113 113
always be careful to think through 114 114
what you're intending to do with that rule. 115 115
First, you need to ensure there's no typos in your rules 116 116
because this will cause a lot of issues, 117 117
they'll result in traffic being blocked. 118 118
When it really shouldn't be. 119 119
Second, verify the protocol important numbers 120 120
that you're referencing in your rule 121 121
and ensure they're correct. 122 122
Do you really want to block TCP or UDP? 123 123
Make that decision? 124 124
You want to block a specific port or all ports? 125 125
All of this is important to consider. 126 126
Third, verify the source and destination addresses 127 127
are referenced by the rule. 128 128
Did you include the correct IP address or network IP 129 129
and the correct subnet mask? 130 130
A simple typo like 0.0.255.255 instead of 0.0.0.255 131 131
is going to cost 65,636 IPs to be blocked. 132 132
Instead of the 256 IPS, you were intending to block. 133 133
Fourth, verify the order of the rules 134 134
is being applied correctly. 135 135
Remember ACL's are always processing order 136 136
from the top of the list to the bottom of the list. 137 137
Your most specific rules need to be first 138 138
and your motion rules need to be at the end. 139 139
Let's consider this example and see if we can determine 140 140
why a network client can't connect to Google servers 141 141
at 8.8.8.8 from within the Dion training group of clients. 142 142
Now, first, we're going to pull up the access control list 143 143
and look for the Dion training group rules. 144 144
Under these rules, 145 145
we look under the rules pertaining to this issue. 146 146
In this case, 147 147
we can't reach the server located at 8.8.8.8. 148 148
So if we look at rule 20, 149 149
we're going to see there's a permit rule for all TCP traffic 150 150
going from any IP, going to the server at 8.8.8.8, 151 151
if it's over port 80, which is used for web traffic. 152 152
So based on this rule loan, 153 153
the traffic should be able to reach the server. 154 154
Now, let's see what other rules we have 155 155
for servers at 8.8.8.8. 156 156
Now we have one rule at line 40, 157 157
and it again says to permit traffic over TCP 158 158
from any IP to the server at 8.8.8.8 using port 25. 159 159
So we're going to allow email traffic over SMTP 160 160
to be sent from any of our clients 161 161
to the server at 8.8.8.8 162 162
Again, this seems fine, and we shouldn't have an issue. 163 163
Now, remember, ACL rules are implied in order, 164 164
and once it finds a matching rule, 165 165
it's going to stop as it goes down the access list. 166 166
So look at it from the beginning. 167 167
The first rule is line 10. 168 168
It says to deny any TCP traffic 169 169
from any IP address to any IP address. 170 170
And this applies to all ports because none were specified. 171 171
So if I'm trying to visit the server at 8.8.8.8, 172 172
will rule 10 match this packet? 173 173
Is it going to go from any IP to any IP using TCP? 174 174
Yes, yes it is. 175 175
Therefore the traffic is going to be blocked 176 176
and it will never get to rule 20 or rule 40 177 177
that specifically allow traffic to this server 178 178
at 8.8.8.8 over port 80 or port 25. 179 179
So instead we can change the order of this ACL 180 180
and we're going to put the more specific lines 181 181
like 20 and 40 at the top. 182 182
So we're going to make them 10 and 20 respectfully. 183 183
Then we're going to take the current line 10 184 184
and move it to the bottom of our list. 185 185
So to make this easier to see I'm creating a new group here 186 186
called Dion training new at the bottom of this ACL. 187 187
Here, you can see the difference in the order 188 188
from Dion training group to the Dion training new group. 189 189
So notice I now have our most specific ACL 190 190
listed at 10 and 20 and a more generic one at line 30, 191 191
which is for the any IP to any IP, but for a specific port. 192 192
Then I have my most generic rules at the bottom, 193 193
lines, 40 and 50. 194 194
This is going to block all traffic for UDP 195 195
and all traffic for TCP. 196 196
Remember when you're troubleshooting issues with firewalls, 197 197
always check your ACL's 198 198
to ensure they're in the right sequence 199 199
and that you haven't missed typed anything in them 200 200
because this can lead to a lot of connectivity issues 201 201
and the wrong traffic being blocked 202 202
or being allowed through your firewall. 203 203
Similarly, when you're dealing with software firewalls, 204 204
like the windows defender firewall, 205 205
it's important to look not just at the IP addresses 206 206
and ports that are being blocked, 207 207
but also you need to look at the 208 208
applications and services themselves. 209 209
Under your windows defender firewall, 210 210
you're going to see inbound rules and outbound rules listed. 211 211
Under each type, 212 212
you're going to see the name of the application or service 213 213
and whether it's allowed or denied. 214 214
Then you're going to see if any specific IP addresses reports 215 215
are being allowed or blocked 216 216
with those applications and services. 217 217
Just like in the earlier examples with network firewalls, 218 218
a simple typo here can cause a lot of connectivity problems 219 219
for your clients and your servers. 220 220
So always double check your ACL's 221 221
to ensure they're blocking and allowing 222 222
exactly what you want them to do and in the right order.