I've implemented our baseline policy from the previous slide.
I'm curious to see how well it works.
In the previous video,
we designed a more administrator‑friendly firewall policy that allows
our critical ICMP functionality to continue operating.
Of course,
we still need to continue allowing TCP‑based Telnet
traffic from our original policy.
I'll quickly show you the configuration of the two ACLs I've configured on R3.
Why are there two ACLs?
Remember that we want to filter traffic in both directions.
Because this is not a Cisco‑specific class,
I won't detail all aspects of these commands.
Coming from Globomantics, we permit ICMP echo packets,
UDP traceroute probes, and Telnet.
Coming from Wired Brain Coffee Company, we permit ICMP echo‑replies,
ICMP TTL exceeded and ICMP port unreachable packets for traceroute to work,
and ICMP packet too big unreachables for MTU discovery.
We also have to permit the returning Telnet traffic.
Let's test the easiest stuff first.
We will ping from the client to the server using a regular packet
size to minimize the risk of fragmentation.
Okay, that looks good to me.
Let's use a large packet size now.
I've reduced the MTU in the Wired Brain Coffee Network to
1400 on the far side of the firewall,
so the firewall should allow the ICMP packet too big
unreachable to flow back to the sender.
That looks good.
I see some M codes, which means that we received the packet too big unreachables.
Let's test traceroute next.
We better not see any A codes this time.
Okay, this looks much better.
Devices on the far side of the firewall correctly send the appropriate messages,
as we described earlier.
Finally, let's test Telnet for completeness.
Okay, that looks good.
I can see the prompt changed to say SERVER.
Let's double‑check that our policy works by examining the
number of packet matches on the firewall itself.
In total, we sent 10 ping packets, 5 small and 5 large.
The five small packets generated five ICMP echo‑replies,
while the five large packets generated five packet too big unreachables.
We sent 12 total UDP probes for traceroute.
Three expired before the firewall, three expired at the firewall,
and six expired past the firewall.
Only the last nine will be visible to the ACL counter.
The firewall sees three TTL exceeded messages,
which came from R2, a downstream router.
It also sees three ICMP port unreachables,
which came from the Wired Brain Coffee server terminating the traceroute.
Last, we see a few Telnet packets,
though the exact number varies based on how much traffic is sent in the session.
Let's do some negative testing.
I can use Telnet to spoof traffic that looks like HTTP
by using port 80 for the destination.
If we try to web into the server, we are immediately rejected,
and that admin prohibited unreachable is received.
I think it's a good time to stop talking about this A packet and dig into it.
Stay tuned. It's coming up next.