Differences
This shows you the differences between two versions of the page.
|
sred:laborator_3._dedicated_firewall_security [2022/11/04 11:41] horia.stoenescu Edit setup |
sred:laborator_3._dedicated_firewall_security [2022/11/04 14:40] (current) horia.stoenescu Moved syslog exercise to lab5 and changed grading |
||
|---|---|---|---|
| Line 25: | Line 25: | ||
| The topology here is almost the same as the one from the last lab, the only difference being the new zone (called inside2) with another client (client2, which is the Kali VM). | The topology here is almost the same as the one from the last lab, the only difference being the new zone (called inside2) with another client (client2, which is the Kali VM). | ||
| - | {{:sred:lab4_topology.png?800|}} | + | {{:sred:lab4_topology.png?750| }} |
| ==== Exercises ==== | ==== Exercises ==== | ||
| Line 33: | Line 33: | ||
| </note> | </note> | ||
| - | === e1. [1p] New guy in network === | + | === e1. [2p] New guy in network === |
| Remember that we deployed the firewall with 4 interfaces: 1 for mgmt and the rest of 3 for traffic (only 2 of them inside and outside where used and configured). Then, there is 1 left we need to configure for inside traffic data. | Remember that we deployed the firewall with 4 interfaces: 1 for mgmt and the rest of 3 for traffic (only 2 of them inside and outside where used and configured). Then, there is 1 left we need to configure for inside traffic data. | ||
| Line 65: | Line 65: | ||
| - test access to other websites like google.com, digi24.ro etc. | - test access to other websites like google.com, digi24.ro etc. | ||
| - | === e3. [1p] File policy === | + | === e3. [2p] File policy === |
| We can block a client from downloading malware file from websites, emails, ftp server etc. by using file policy in an access policy. There is need firstly to enable the following licenses: threat and malware, then create an access policy with action Allow (the only action where file policy can be used), from zones inside and inside2 to outside zone. This will protect internal users from downloading any known malware by Talos. | We can block a client from downloading malware file from websites, emails, ftp server etc. by using file policy in an access policy. There is need firstly to enable the following licenses: threat and malware, then create an access policy with action Allow (the only action where file policy can be used), from zones inside and inside2 to outside zone. This will protect internal users from downloading any known malware by Talos. | ||
| Line 196: | Line 196: | ||
| Of course, using the method do not decrypt, we can except some websites based on url, users, certificate or tls version from decryption (we may not want to to decrypt health or banking data for our users). | Of course, using the method do not decrypt, we can except some websites based on url, users, certificate or tls version from decryption (we may not want to to decrypt health or banking data for our users). | ||
| - | </note> | ||
| - | |||
| - | === e7. [2p] Send some logs === | ||
| - | |||
| - | {{:sred:lab4_syslog.png?800|}} | ||
| - | |||
| - | As logging is limited on our FTD device, we can use an external device for log collection. This can be a syslog server, that we will configure firstly on our linux router VM. | ||
| - | |||
| - | To configure it, do the following: | ||
| - | <code> | ||
| - | sudo apt-get update | ||
| - | sudo apt-get install syslog-ng | ||
| - | sudo mv /etc/syslog-ng/syslog-ng.conf /etc/syslog-ng/syslog-ng.conf.bkup # same the default one | ||
| - | sudo vim /etc/syslog-ng/syslog-ng.conf | ||
| - | |||
| - | # add here: | ||
| - | @version: 3.5 | ||
| - | @include "scl.conf" | ||
| - | @include "`scl-root`/system/tty10.conf" | ||
| - | options { | ||
| - | time-reap(30); | ||
| - | mark-freq(10); | ||
| - | keep-hostname(yes); | ||
| - | }; | ||
| - | source s_local { system(); internal(); }; | ||
| - | source s_network { | ||
| - | syslog(transport(udp) port(1025)); | ||
| - | }; | ||
| - | destination d_local { | ||
| - | file("/var/log/syslog-ng/messages_${HOST}"); }; | ||
| - | destination d_logs { | ||
| - | file( | ||
| - | "/var/log/syslog-ng/logs.txt" | ||
| - | owner("root") | ||
| - | group("root") | ||
| - | perm(0777) | ||
| - | ); }; | ||
| - | log { source(s_local); source(s_network); destination(d_logs); }; | ||
| - | |||
| - | # create the log dir and restart the server | ||
| - | sudo mkdir /var/log/syslog-ng | ||
| - | sudo touch /var/log/syslog-ng/logs.txt | ||
| - | sudo service syslog-ng restart | ||
| - | |||
| - | # check the service if it is LISTENING on port 1025 | ||
| - | sudo netstat -atupn | grep 1025 | ||
| - | </code> | ||
| - | |||
| - | After this, go to another terminal on Router VM and test the syslog server: | ||
| - | <code> | ||
| - | # get the ip address of linux router VM | ||
| - | ifconfig eth0 | ||
| - | # then use it below - mine was 10.3.0.84 | ||
| - | logger -n 10.3.0.84 -P 1025 "testing my new syslog server" | ||
| - | </code> | ||
| - | |||
| - | And from another terminal, check the logs.txt file: | ||
| - | <code> | ||
| - | tail -f /var/log/syslog-ng/logs.txt | ||
| - | Nov 10 10:00:00 ubuntu eve: testing my new syslog server | ||
| - | </code> | ||
| - | |||
| - | Do the same thing from FTD expert mode and check with tail logs.txt: | ||
| - | <code> | ||
| - | > expert | ||
| - | admin@ciscoasa:~$ logger -n 10.3.0.84 -P 1025 "testing syslog from ftd" | ||
| - | </code> | ||
| - | |||
| - | Next, go to FDM and configure syslog for client. There are 3 important parts here: | ||
| - | |||
| - | 1. create the syslog server object | ||
| - | |||
| - | 2. enable logging for remote device and select severity level as informational | ||
| - | |||
| - | 3. create a new access policy rule with: | ||
| - | |||
| - | - in: inside and inside2 | ||
| - | - out: outside | ||
| - | - application: ICMP | ||
| - | - action: ALLOW | ||
| - | - logging: at the end of connection and send connection events to syslog server (configured at step 1). Note that all these events are informational and can also be seen locally on FTD : Monitoring > Events | ||
| - | |||
| - | <note> | ||
| - | For more info about syslog-ng, see [[https://www.techrepublic.com/article/how-to-use-syslog-ng-to-collect-logs-from-remote-linux-machines/|here]]. | ||
| </note> | </note> | ||
