Firewalls Part 2

Introduction

Welcome to the Firewalls - Part 2 Practice Lab. In this module you will be provided with the instructions and devices needed to develop your hands-on skills.

Learning Outcomes

In this module, you will complete the following exercises:

• Exercise 1 - Manage Windows Firewall Logging
• Exercise 2 - Manage Static Packet Filters

After completing this lab, you will be able to:

• Configure firewall logging
• Test basic connectivity after creating the static packet filtering rules
• Perform network sniffer trace using Wireshark

Exam Objectives

The following exam objectives are covered in this lab:

• Understand dedicated firewalls - characteristics of firewall, software firewall, stateful versus stateless firewall inspection
• Understand protocol security - network sniffing

Lab Duration

It will take approximately 45 minutes to complete this lab.

Exercise 1 - Manage Windows Firewall Logging

Windows Firewall supports logging feature that describes how the firewall process different types of traffic. The collected logs provide important information such as date/time, source/destination IP addresses, port numbers, and protocols.

Firewall logging is useful for verifying the newly added firewall rule works properly or troubleshoot them if the rules do not work as expected. The logs can assist in identifying unusual activity such as repeated failed attempts to access the firewall or an internal computer. Similarly, suspicious and repetitive outbound connections coming from internal servers like web servers could be an indication that an intruder is using your system to hack into other corporate networks. Note that the firewall logs are not fully detailed and do not provide conclusive information needed to track down the source external activity.

Learning Outcomes

After completing this exercise, you will be able to:

• Configure firewall logging
• Perform network sniffer trace using Wireshark

Exercise 2 - Manage Static Packet Filters

Static packet filtering controls access to a network by analyzing inbound and outbound data packets either by letting them pass or stopping them based on the IP address of the source and destination network. This is a basic firewall feature that provides network packet filtering based only on data packet information and administrator defined rules either allow or block traffic.

Windows Server supports static packet filtering feature included in the Routing and Remote Access Services.

Learning Outcomes

After completing this exercise, you will be able to:

• Test basic connectivity after creating the static packet filtering rules