You have spent, assuming you've been watching these videos in order, you have spent a lot of time watching
me work with a lot of different advanced networking devices trying to place them within a network to do
the job that they're designed to do.
That is absolutely fantastic.
However there's going to be a lot of stuff on the exam where you're going to be challenged on where
does this go and how does that fit in and throwing out some terms that might be of interest to you.
So what I want to do in this episode is go through four very different scenarios that you may see on
the exam and talk about how we place networking devices so that they can do the job that they're designed
to do.
What I'd like to start off with is something called a demilitarized zone or a DMZ.
Welcome to my little local area network at
Total seminars.
So what I have here is I've got a pretty nice little router.
It's got one connection to my internet service provider,
and then I have another connection that runs from the LAN side of the router
into my main switch and then I have some systems connected I have a lot more than just two.
But for demonstration purposes that will be more than sufficient.
And that's an overview.
OK.
So everybody we can get on the Internet we do all kinds of stuff that's a lot of fun.
But what I want to do now is I want to install a web server physically here at my location and I want
it to be a completely public web server and I want to do it safely.
Now if you've been watching these episodes in order
we talked about something called a DMZ.
When we talked about a DMZ what we talked about was the type of port forwarding that it would simply
allow anything for the Internet to go to a particular system.
That's a terrible DMZ.
Let me show you what a good DMZ looks like.
So what I'm going to do is I'm going to unplug a couple of cables here and first of all let me throw
in a couple of servers. So I will say I've got a web server and I've got a remote desktop connection
server.
Now these I want to be real Internet servers.
They're going to have public IP addresses.
They're going to be out there they're going to be the real McCoys and you could use any web browser
and get to them.
So to do this we're going to have to do a proper DMZ. A proper DMZ adds some equipment to the situation.
First of all let me get rid of this connection right here.
And what we're going to do is we're going to add is we're going to add, where'd it go there it is, we're going to add another
router.
Now what's going to take place here is actually kind of interesting. Let me use a different color here.
So what we're going to do is we're going to interconnect.
Let me grab one more switch here.
So we still have our connection to our Internet service provider that's not going to change.
But what I'm going to do is this. On the LAN side of this router I'm going to connect it to this switch,
I'm then going to connect my two servers to this switch,
watch, I'm then going to connect the WAN side,
I guess if you want to call it that, of this router to this switch as well.
So what I've done is I've created it's own little unique network ID.
So these two boxes are going to be assigned public IP addresses.
So I'm going to have to call up my internet service provider and I'm going have to pay real money for
real public IPs.
No 192 168's here folks with X finity here in the Houston area.
Something like this.
My own little network ID is going to set me back about 100 bucks a month just so I have static IP addresses
just to give you a feel of what this is like.
So I've got this little guy set up. Now you'll notice that I've got this firewall router here.
I'm going to put F for firewall so we don't forget that.
But these devices are listening on, just to keep it simple, let's just say port 80 because it's a web server
right.
I have to make sure that this firewall is set up in such a way that it allows unsolicited port 80s to
come in.
I mean that's what Web traffic is right.
Because I've got a web server and I need to be able to keep those ports open.
I can put some very light firewall in here.
I can put some denial of service if you're unfamiliar with that keep watch and I've got episodes on
that.
I've got some tools I can place here.
But for the most part this is a very light firewalling.
However we're going to take the LAN side of the second router and plug it into our network.
So now what's happening is we've got two firewall routers, let me put another F here for firewall.
Now this one is going to be a very robust firewall just like we would do if we didn't have the DMZ in
here.
In this case it might be running NAT, it's probably got aggressive firewalling, on top of that it's going
to be blocking incoming port 80 right because I don't have any web servers back here, I don't need any incoming.
Outgoing port 80 if people want to go to Google,
but no incoming port 80. So I'm going to have a very active access control list controlling whatever
I need to do here.
Whereas this one is very very easy and very soft.
Think about the placement of these different devices here.
We've got two separate firewalls routers that have their own network ID with public IP addresses that
have been brought in from our Internet service provider and then behind there we're going to have our
regular you're if you want to do private you 192 168 whatever you want to do back here assuming you're
running NAT, of course.
And this is a very common way that people would have public servers at their own physical location using
DMZ.
Now I might want to add that even in today's cloud based world DMZ still exists. A lot of times you'll
have your web servers and whatever you might want to have, but you might have some virtual machines for management
and such and you literally just dial up two virtualized firewall routers and you can set all this up virtually.
You're going to run into a lot of scenarios on the exam that look incredibly complicated but if you
actually take the time and look at the scenario carefully the device placement becomes rather trivial.
So for example what I've got here in front of me is going to be an intrusion prevention system an IPS
.
We need to plug this in-band in such a way to do a particular scenario.
So let's go ahead and march through this together shall we.
I've got a little set up here for you we can take a look at.
Pretty straightforward set up.
What I have is four computers now I'm running multiple VLANs here and in a real scenario would
say this is VLAN 1,
this is VLAN 2. I'm trying to make it a little bit easier for you by simply taking that out of the
picture.
And the question is going to say something like in order to monitor all incoming and outgoing VLAN traffic.
Where do we place the IPS.
Sorry not an IDS.
IPS.
So this is in line so we can literally pick any wire and just slap it on there and we can get everything
that we need.
So in this particular case if we want to get all of the information that's coming in and out of all
the VLANs we can pick any one of these blue trunked ports.
I did trunking in blue. And we'd be all right.
However for me I'm going to put this right here and this is the nice thing about an in line IPS, I could
literally unplug one cable grab two cables drop this guy in
and you can see I've placed him in line and this is all the traffic coming in and out of the network so
I guarantee you we're going to get all the data from every possible VLAN.
OK so the next thing I want to talk about is the idea of firewall placement.
Now when I'm talking about firewall placement,
it's easy in a lot of places to simply say well put it on the edge of the network.
And that one's easy.
But there are situations where you might want to put a firewall internally
there are plenty of situations where an internal firewall can be absolutely critical to ensure the security
of your network. In this particular scenario,
we're going to talk about an office which leaves a couple of computers available so that vendors can
come in and do whatever work they might need to do. In this particular case,
we don't want the vendors to have access to our private in-house network but we need them to have access
to the Internet as well as some particular shared things that we might need to give them on our network.
So let's watch this in action.
So here we are.
Here's our physical network.
We've got a couple of public desktops that are just sitting there for our vendors to use.
Or you could say that this is a hotel and we've got a couple of computers in the business area that
anybody can walk up to and use, these are internal computers and we don't want people having access to
this.
Now the way I'm currently set up I would need to draw one more line and everybody would be connected
to the Internet and that's great.
But what we're going to do is we're going to add a firewall here and in this particular case what I'm
going to do is I'm going to put a firewall right here. What I'm actually doing is I'm separating this
public network from my actual office itself.
And then if people want to get out there we can make one more connection.
So in order for these folks to be able to get out on the Internet they've got to go through this firewall
which is going to be blocking them whatever they might be doing that we don't want them to do comes
through and then it goes out through our regular firewall.
So when you're dealing with these internal type firewalls like this you'll also get questions that are
going to say well what are they blocking.
And a lot of times you'll be saying things like well we're going to be setting up a stateless firewall
or something like that that's looking for specific ports maybe we don't want anybody running these after
midnight.
And this is where this guy could have a completely different access control lists than the one for our
in-house people to be able to do what we need to do without letting them do what we don't want them to.
All right.
Now the last one I want to talk about is a lot of fun because it's always interesting I get lots of
questions on this one and that's proxy servers.
Let's talk about I've got a situation with a proxy server.
And what can I do with it.
One of the things you're going to run into on the exam
are semantics.
You've got to be very careful sometimes reading a question because it's easy for you to actually think
completely opposite of what CompTIA is trying to get to.
So here's a great example of this as we're dealing with little proxy servers.
So over here I've got a client and here is the internet.
No it's not a flower.
So we've got my client and I've got some kind of server. So I might ask you a question like this: where
do we place a proxy server such that the server is obscured from the client?
Now if you think about that for a minute that means the server is obscured from the client.
We don't want the client to know what server it's going to.
So in that case it's going to be right over here and we're going to treat it as a reverse proxy.
So be careful with terminology because it will absolutely get you on the exam.
So be ready on the exam.
It's going to have tons of scenario questions. These scenario questions are always going to look a lot
more complicated than they are.
But they will make sense.
The one thing I will give CompTIA is when you look at these scenario questions particularly when we're talking
about placing different types of devices on different places in the network if you take the time to read
them and don't get tossed with semantics you're going to do great.