-: Firewall Logs and Configuration Files
In the last lesson, we talked about
how you're going to correlate your firewall logs with your
DHCP server logs to figure out what IP was doing what
and what machine that translates to.
Well, here we look at our firewall and our router logs
and the configurations, they're going to tell us things,
like we talked about before with ACLs.
What's accepted, and what's going to be blocked.
This is a good way to start passively understanding
your network design;
what things are allowed,
what things aren't, what ports are going to go in,
and which ports they are not.
Reading your configurations is much, much quicker,
than trying to quote, reverse engineer" the log files.
Looking through the log files and figuring out
every single possible connection there is,
it takes a long time.
If somebody will just hand you the firewall configuration,
you'll know exactly what's allowed and what's denied.
We look at these firewall logs, not the configuration files.
The logs are going to be categorizing the information
and the debug messages, very similar to the router logs
we talked about before,
with a zero through seven categories.
Now, Cisco, Palo Alto, and Check Point,
three major firewall manufacturers, all log things
a little differently,
but they all have some comment elements.
The have a date and time stamp,
and they have details of the event, what actually happened.
These logs are designed to be human readable,
although human readable is a subjective term,
because some of them look kind of clunky.
Access logs on a Cisco device, just type in show logging,
and up will pop the firewall logs,
for you to take a look at them.
Here is an example of a firewall log.
I pulled this up on February 2nd,
and you can see it's an ASA Cisco device.
It was a user command, ASA admin.
They executed the enable command, which means they went
to super user status so they can make configuration changes.
That's just a very simple firewall log.
Again, it's human readable, kinda,
but you've got to know what you're looking for.
If you want to see a lot of these, you can go down
to the website at the bottom, the Cisco website,
and you can see how to identify incidents via the logs
on a firewall.
We're not going to in depth in this course on that,
just to know that you need to be able to read a firewall
log, as simply as I just did,
to understand what was going on.
Now, here's an example of firewall configuration.
Much easier to read, and these you do need know how to read,
because you're going to get questions on them.
IP access list extended, for the LAN.
This internal b lan.
Permit tcp traffic,
from 192.168.0.0,
to anything that equals port 22, so going
from this network out on port 22, perfectly acceptable.
Right?
Now, if you look at are you going to permit traffic
from 172.16.0.0?
Yes, if it's a slash 16 network, which is what
that subnet address in reverse order is,
any equates to 22.
The same thing with the next one, again, you're going to
allow SSH, but you're not going to allow it if it's coming
from 192 168 1.0.
We don't want to allow traffic from there,
and so we'll deny that SSH, right?
This tells you where you can SSH to, and where you cannot.
How do you read this?
Well, here we go.
Allow TCP traffic from 192 168.0.0
to any destination, right?
That's that 0.255.2, sorry,
that's the anything right before the eq,
IP on port 22.
Going from this network,
out anywhere is perfectly acceptable, okay?
That's how you're going to read this.
From here, to there, on what port.
If you can read it like that and put it into a normal
sentence like I did here on the bottom, it's going to
make a lot more sense as you're on the exam.
Keep that in mind, as you're reading these firewall
configuration ACLs, with the permit and deny statements.