Setting that example, traffic coming from Internet to DMZ, and this is the lab we have configured
for you.
So basically what we need to do is look at this.
There is this
this configuration guide.
Stating that the Internet, the Internet traffic and basically what we have.
So this is what this diagram so from this server, two hundred one dot 165, 140.
This is ten 501 dot three, actually.
So if this is the in the spreadsheet, you will see that.
So basically, what we need to do is we follow this guy.
And in this guide, what we are doing, this is a traffic, we are coming and you can see this is the
this is an our spreadsheet started not to do.
So basically, if we look at our spreadsheet in the spreadsheet, what we can see, we can look the
static net.
You can see this the static net here.
And this is the we can see our friends are already assigned.
We know that we should be working.
This is an machine from where you will be testing username and password is also providing you will be
given to type.
This one is a global IP, one is a private eye.
OK, so we will be configuring two things.
One, we need a static net and we also need one to one mapping static net.
And also we need to do the do the rule as well.
So three or four things are required in the steps and that Step-By-Step document has been configured
here.
And you can see the steps are here.
So first of all, we need to log in to the firewall.
After that, we need to create two two objects for one for private IP and one for public IP.
Each of you will be referred to the spreadsheet.
Please refer to the spreadsheet as what your diagram and what your villans here.
These are the global IP.
This is the private IP.
So basically, we have configure Madison and then we go into the room and we configure the Internet
to Internet, any destination, any source, and this time the difference is not the source, but it's
a destination.
So we will be hitting the destination, will be restricting translation type static IP and we see it
as a private private IP.
Then we are also creating a rule as well over here.
And this rule that we are hitting the Internet to Demsey and the private IP and we can allow these services
actually.
And then we can log the session and send the traffic to.
So basically this is these are the steps.
So first of all, I'm going to configure the object.
So I need to see 231 to 250 for that level.
So I need this Sipi.
Public static.
Including the sheer.
Seven.
Mass public IP, OK?
As much spreadsheet.
OK, then we have created these two, then we need to create a rule here, make sure you do at your
device group and the rule point of view, we need to create a new rule here.
In the DMZ.
But you don't get.
I'm putting the tag like Massell.
Right.
And you can use your own room.
So basically the traffic is coming from the Internet and the destination is going to the Internet because
look at the traffic is where the traffic is coming from.
Basically, the traffic will come from the Internet site.
OK, and as the Internet is going from here, it hit to this firewall and then what happened?
The IP address will be change from the Internet to the DMZ.
So basically it all changes that happening here.
So that's why the direction will be Internet, the Internet.
Any destination with any soldiers.
So now this time it's not source, but it's a destination IP.
That's my public IP address originally.
This is the two options here in the net.
One is the original packet.
One is the translated packet.
So basically we are seeing anybody coming from Internet and going to the Internet destination from any
source.
We are not specifically assigning to any any any specifically tie up to any sort.
We can do so for security reasons.
If is required, then we are selecting the public IP address.
We also selecting the basically here translation.
So nothing happening in the source IP, but happening in the.
Destination and my decision will be decided, it will be.
OK, there's no need for actually.
That's my starting note.
And it is better to keep the static not at the top.
So you see now the difference is that previously we were selecting a state source.
So in in any any firewall or anywhere in the nadra two things original packet and translated became
so different between the static that actually you can see.
In the static, not from trust to Internet site, we are seeing the source IP, if source IP is this,
it will be translated.
This is the translated one.
It will be translated into this.
So there are two things always print out.
And Postnet, this is our PLENETTE.
And that is our Postnet, what is going to happen with the original item here, we are saying if anybody
comes in, it will be translated into these open source translation.
But in the case of this static IP, we are seeing destination look at the source IP, anybody, any
destination, any interface.
If they hit to this destination, it will be translated into this IP.
Clear.
Then we also need to apply a rule as well.
And rule to apply to the.
Social, we trust Internet, sorry.
Any source?
So you can get some help from the rules point of view here.
So this is the source Internet, any source destination, DMZ, and then the public iapetus.
OK, so basically what we have allowed here, we have allowed.
We have allowed ICMP being assassinated, allegedly stolen McGroarty.
Come on.
Think.
ICMP.
So crossposting rule as well and.
Right.
So basically, that's what we have done.
So let me push the configuration.
Pushing the suffered with a spreadsheet, we can log into this device.
MSDS, see?
RTV.
And we already pay to.
One one three.
And user one and Cisco sees capital at one, two, three.
So that is a very subtle machine which is connecting to our Internet, so you need to login from your
home into this machine with the IP addresses provided and you need to try to test with the IP.
So let's see if he's working right now.
You see, it is really the little puppy for the triple one.
It is really.
If we go into the traffic.
So you see, it is traffic is going from here, it is denied the dialogue because there is no policy
existing as of now, we just push the policy we pushed in that rule as well.
So making sure that it should be working.
OK, so that's clearly show that the rule is not existing, no, not applied, it is job interactor,
Internet, wonderboy under 65 relating to this.
So you see this being graphic.
It's not working.
One of before 9/11.
See, it is not applicable.
OK, so let's wait for the devices to.
Seventy five percent.
So my request is, please, this is the workbook, please follow these guidelines for all the configuration
layer to layer three, static, not dynamic, not everything has been documented.
Everything has been given in the workbook format and also in the in the video format.
So there is no excuse.
OK, so let me try to test.
From the Excelon machine.
200, 250, forward at 11.
Just give me one word.
OK, one thing you need to make sure that this IP address is visible in the routing table.
And.
Some more and starts here.
Yeah, that's Ipis Vitya.
If you can figure this, if he wanted to just give me one minute bite change, I put the Internet to
Internet.
Because single, not existing just once.
Yes, I mentioned the sorcerous as well.
I that's right, my mistake, because maybe I taken the clone of this IP, that's why I should be removed.
So I was expecting the traffic from 10.
Yeah, that's why.
So you tie up to the single source.
Maybe that's why I didn't push it.
So that is sometimes happen when you are taking the clone from the from one of the rule.
Actually, previously, I was just Diyab, the one of the source IP, like the LAN IP, which is never
the case because the traffic is not coming from the source.
IP is coming from a different type, which is two hundred sixty five point sixty five one hundred.
But the rule was saying that you will be expecting the traffic from here, which is totally wrong.
OK, so let me just push the configuration right now.
Just wait for a second.
Ninety nine percent is completed.
Now let's go into the.
Outside the machine.
Now you see.
Password, Cisco, Cisco.
So you can see you can log in from the machine.
You can see.
Cisco, Cisco, I can log into the DMZ, Dr..
So this is I have tested the HTP, I have tested the pin and trace Otisville.
The bank is now also working.
OK, so now you see the traffic will be flowing from the.
In the letter, the DMZ out, so allowed now metastatic, now this is the rule.
So basically, the source is coming from here and it will be translated into the Mississippi.
OK.
So basically, this is the source.
It's coming from a different office.
So, see, you're actually heading to this IP.
So that's the destination, is it the source?
Sixty five, 100 year head into this and that will be translated 99p.
Is this not Polish 20?
Is it clear?
So there is a static that come from Internet2.