>> In wrapping up with firewalls,
there are some best practices
that we want to take to heart.
One of the first things is to
block unnecessary ICMP traffic.
ICMP is very exploited protocol.
It's the protocol behind ping entries for you,
and really that is no business
coming from outside your network to inside.
It just is too vulnerable,
so we block ICMP.
Also, we keep our access control lists simple ACLS,
when you're creating rules that they
say block this traffic,
allow this traffic,
you can get very confused the more that you
have with the way these can be priorities.
You may wind up allowing access that you didn't intend,
or blocking access that you didn't
intend. Keep the list simple.
Firewall should have an implicit deny meaning,
unless I explicitly grant
access then that access should be denied.
Block directed IP broadcasts.
Don't allow someone outside your
>> network to broadcast in.
>> That's a directed broadcast.
Next suggestion, perform ingress and egress filtering.
I don't just care with coming in.
I care what's going on.
If I'm seeing certain types of traffic
going out, like for instance,
a public IP address coming from
my internal network that tells me something's going on.
That may be an indication that one of
my internal clients has a malware and is
perhaps being used as a zombie to
launch a downstream denial of service attack.
We watch traffic coming in and out.
We enable logging honored firewalls.
We also make sure that fragmented packets
don't come through.
Those could cause damage
or if it's possible to reassemble them,
and that's a possible option.
Ultimately, just keeping a
secure by default environment with
our firewalls will go
a long way towards protecting our organization.
Just a little review here with our
>> access control lists.
>> We've already talked about the significance
of our access control lists.
You can have these on routers and on firewalls,
but this is how we create the rural set.
Here we have an illustration.
You've got various servers.
You see their IP addresses underneath.
We've talked about access control lists,
and this is how you build a rules to block
or allow traffic coming through.
But let's take a look at how you would configure them.
We have a series of tasks here.
First, we want to allow the accounting computers
to have HTTP access only to administrative Server 1.
When we're creating our firewall rules,
we want to look at source computer,
the destination computer,
and then we have to think about the port number.
Remember, we have an implicit deny.
All traffic is denied by default.
We have to create lists for what we're going to allow.
What we're going to see is the source address
10.18.255.10 with the mask of 24 bits.
This is the accounting computer,
are going towards the destination computer,
which should be the administrative Server 1.
It is port 443,
because all we're allowing a secure web traffic
and that's a TCP port and we'll have to allow it.
Essentially, what happens,
is for each one of these tasks we'll
have to configure a portion of the firewall.
A lot of times this shows up on
the exam as a setup drop-down errors.
Our next task is to allow
the HR computer to communicate with Server 2 over SCP,
and SCP uses the port number 22.
You can see the second rule provides that access.
The third is to allow the IT computer to have
access to the administrator Server 1 and 2.
That's accomplished by creating two rules.
We allow it to Server 1,
we allowed to Server 2, and
we've completed our list of tasks.
This may be comparable to
something that you would see on the exam.
Just getting that flow for
how firewalls work will be helpful.
You'll see lots of these on the security plus exam.
Once again, make sure you know
your ports because without knowing them,
you're not going to be able to
>> complete these activities.