Network and Security Refresher

0:00In the last skill, we went over a bunch of networking basics. Just to make sure everybody's on the same page, we got a good understanding and foundation of networking and some fundamentals. Now, let's start this skill off with a nugget looking at our topology and talking about traffic flow because we're going to use a certain topology in this course. So let's take a look at it. And here it is. So this is our topology. Over here on the far left, we have our HQ, our headquarters office, and then on the right, we've got site A. So say branch office, if you will.

0:36So what are we going to do with this? Well, we have two different networks here that are HQ in our site A. And we have on our HQ, let's start here, we've got our security gateway here. That's going to be our firewall. And then we've got an SMS server that's our security management server and we 're going to use that to centrally manage our two security gateways that we have here because we also have one over here at our site A. So that's great. Well, what else do we have here?

1:07Well, if you'll see up here at the top, we've got a DMZ in our headquarters. So that's our demilitarized zone, a separate network. And that's where we have a Linux web server. We're going to stand up. And then we also have on our standard LAN at the HQ office. We have a Windows host and our Windows host. That's where we are going to install and be using our smart console from. So that's why we're using this Windows box here. And we'll from the smart console, connect into the SMS and from the SMS manage our gateways over here.

1:43All right. So let's see, what else do we have over here on our site A? We do have a Linux host over here. And that's simply so that we have something that we can run connectivity tests out from and verify. And we'll end up setting up a VPN between these two security gateways that will provide us an encrypted tunnel over which we can communicate between the offices. So this is our lab for this course. Now there's one more thing I want to talk about before we move on.

2:13And that is the idea of traffic flow. And that's because there's two different ways that traffic really flows in our environment. So we're looking at our traffic flows here and we're going to use a couple different terms. Now let's focus on the HQ office here. So with the HQ office, we have our Windows host down here. And if this Windows host, I'm going to put another host over here. Let's say we had another host. There we go. And if our Windows host here wanted to talk to the other host and vice versa, this is known as East West traffic flow.

2:52East to West. And really what that means is it's internal traffic. So it's going across our internal network between devices on the inside of our network. Now if we were to switch that up a little bit and let's say we wanted to go out to the internet and our Windows host here, well, it's sent its traffic across the network and out to the internet. Okay. So this is known as North South traffic flows. So that's when we're going out of our network and coming back into the network.

3:25So someone out here on the internet wanted to access our web server and they came across the internet through a security gateway and up over to our web server. Well, that again is North South traffic. It's entering our network and it's leaving our network. But when it comes to internal traffic, that's known as East West traffic. Okay. Super. Okay. Let's just break up the idea of learning new topics and doing some review and stuff with looking at the network we're going to be working with in our environment. And of course, we're going to build this out.

3:56And we're going to do so in even G and actually in the next now, we're going to start talking about net. That's our network address translation and the role it plays in our networks. And we're going to focus on specifically two types of net and that's hide net H IDE like playing hide and go seek. That's our hide net and then our static net. Those are the two types of net supported on these checkpoint security gateway. So I'll see you in the next nugget.

0:00Let's talk about network address translation or net and the fact that you know what it's pretty darn important It allows us to change our network addresses and there are times that we need to do that for example Let's say you're on a device here on your computer and you have an address of 10.10.45.12 And you're on your network connected to a switch over here and then over to Your firewall put over here. We'll put a this is a security gateway here firewall and it's connected out to the internet Well, we know that this is a private IP address and we know that because of the RFC 1918 that request for comment has become the standard for private IP addresses and basically just IP addressing because Not only does RFC 1918 define our private IP address ranges That's our private IPs have which this is one of them. It also defines Some standardization for NAT which is important absolutely because that's what we're talking about here So we know if I have a private IP address here on my machine that I cannot be

1:15routed across the internet I've got to have a public IP to go across the internet So we have a public IP. Let's say it's 104.32.16.8 Okay, and that's on the when interface or outside or external interface of our security gateway So when our traffic comes across it needs to be knatted Right here, okay, so that our source IP changes to a public IP so it can be routed across the internet Well, that's one roll that net plays in Networking it allows us to use private IP addresses on the inside, but still be able to gain access to the internet And that's one example of where we would use NAT So let's talk about Checkpoints security gateways and the two kinds of NAT that they support the first one is called hide NAT, okay pretty straightforward as far as seeing that it's a name and then two static NAT Okay, there we go. Those are the two types of NAT that the security gateway support and we'll be configuring them a little later on So let's start with taking a look at hide NAT. So that's what we're looking at here hide NAT What is that? Well, it's what we just talked about the example I talked about

2:30where we had our computer over here with a 10.10.45.12 Something like that connected to a switch up to a security gateway and we had the public IP address that Connected us to the internet and we wanted this public IP address up here and so when our traffic comes across the network And it's headed to the internet. Well this hide NAT over here what it does is it translates or exclates translates our source IP address And it does so by replacing This private IP address with a configured public IP address so it can go across the internet and be routed and then the Return traffic will come across and be un-natted if you will and then sent back over to the original source Which was our workstation over here?

3:22So this process is known as hide NAT in the checkpoint realm and the name hide NAT makes a lot of sense because what you're doing is you're hiding Your private internal IP address behind your public IP address. So it actually makes sense now other vendors call it other things like NAT overload. I Know Cisco uses NAT overload. There's like many 2.1 NATing does the same thing or Pact port address translation. That's another name for it. So all these three things here are the same name for hide NAT So if you're familiar with these terms over here. It's the exact same thing pretty straightforward Now when using hide NAT we can use two different types of IP addresses on the security gateway here and here's what I mean We can configure it to use the IP address on the interface the configured IP address, okay?

4:22Or we can use a virtual IP address So we don't have to use this IP address that's on our when interface. You can Doesn't hurt anything, but you could also if you had other IP addresses You can put those in there like 102.43.12 Dot 10 is another address that your organization might have So what you could do is assign that as a virtual IP and Then your net translations for hide NAT will use that IP address instead So you don't have to use the way in IP on your security gateway. You can use what's called a virtual IP address Now something else to keep in mind is this is very important that hide NAT and we're talking about hide NAT We are only translating Outbound net traffic so when we create a hide NAT rule or turn it on really What that is is it only affects traffic going out to the internet now?

5:21Yes, the response does come back through and get unnatted, but here's what I mean We're only translating traffic headed outbound to the internet. That's different if I had a web server on my network over here And I wanted people to be able to net into it that's different that does not happen with hide NAT Hide NAT is put this down here outbound Traffic, okay, and that is key to understand because the next type of network and talk about which is static net is Different it's for inbound and outbound traffic whereas hide NAT is really for only outbound traffic There you go. That's your hide NAT. So of course next up is that's right. That 's our static net now static net is When we configure a net rule that maps one of our internal hosts To a public IP address, okay?

6:20So let's go ahead and see how this works. So here is our security gateway and let's say we have over here our DMZ and in it we have a web server There you go and there is our connectivity and then of course we have connectivity out to the internet So with a static NAT configuration. Let's say this was 10.10.10.100 as our web server What we would do is come in here and create a NAT rule and Actually, it would be a static NAT rule and what we would say is map 10.10.10.

6:5510.10.10.10.10.20 And we would define whatever public IP address we wanted to at this point So maybe that's it, but we statically configured that Okay, so that this always Nats to that and vice versa So this is for outbound traffic and Inbound traffic So this is different from our hidenet which was outbound only this is for in and out So in this instance if someone was to be out here on they want to visit our web server and they go to this public IP Address down here. Well, it's going to be translated when it hits the firewall It's going to be translated to this so the firewall knows then to go ahead and This depends on our access control list with our firewall filtering rules Of course, we've got a lot all that to happen But at this point we're just looking at the NAT layer of what's going on?

7:56So there you go folks That is our static NAT and our hidenet which are the two types of NAT supported on our checkpoint security gateways In the next nugget we're going to talk about Stateful firewalls versus packet filtering firewalls How they're different and what our checkpoint security gateways. So I'll see you there shortly send that traffic through there and of course

0:00Would you believe that not all firewalls are the same? That's an absolutely true statement. And it's for vendor to vendor and technology technology. And let's talk about this. So over time, firewalls have changed quite a bit. So in the early days, we just had what we called a firewall. And we would create rules and it would filter traffic based on those rules. And this is known as simply a packet filtering firewall.

0:30And that's because it would inspect every packet going to and fro against our set of rules. And you might think, well, don't they still do that today? And the answer is yes, they do, but they do it in a smarter way. So we see these firewalls today. And we see that as they get newer, we get new technologies. We have not only packet filtering happening, but that has branched out to things like intrusion prevention systems and email filtering.

1:02And like any virus and anti malware add ins and sandboxes and all kinds of things like threat protection. And it goes on and on. So when you take all of these wonderful features and you tie them into a firewall, usually in a modularized kind of state, you end up with a next generation firewall or N GFW. And that's exactly what the checkpoints security gateway is. It's a next gen firewall. So let's talk about packet filtering firewalls versus stateful firewalls.

1:39Now packet filtering we just talked about. And that was the idea that you had a firewall and you created access lists or access rules. And you would say what was permitted outbound and was permitted inbound. And as that traffic flows through your firewall, all the packets are inspected against those rules. So it was a little rudimentary. And it is because it's not really watching the state of the communications. The state is very important.

2:09Think about the TCP three way handshake. When we have our our send our send act and then our final act and that's our handshake right there. Well, we can watch this. We can see is a session established or not? So has the handshake happened and his data being sent back and forth because a stateful firewall, well, it watches that. So let me clear this a little bit here. Let's take this out of there and this and let's go with our firewall.

2:40Now what we did, we just upgraded to a stateful firewall. Okay. Now what this does is you do create your access control list, but works a little bit different. I need to create one access control list allowing traffic to go outbound. Okay. So it goes out and it does whatever it wants to. It visits a web server, let's say. Well, the firewall knows that there should be a response coming back from that web server. And it knows that that response is going to go back to the original host here on the inside of the network.

3:15So what's going to happen is our stateful firewall is going to create an access control list here, a rule allowing this response to come back through the firewall and it will do that force automatically. And then once that traffic is finished flowing through in the session as ended, well then it disables the access list that created for that traffic to come back through. That's pretty cool, right? Because that means I as an administrator create one rule to allow traffic in both directions.

3:47Whereas if I had a packet filtering, my packet filtering firewall, I would have to create a rule for my outbound and a separate rule for my inbound. Ah. So what we see is we're using a little bit of session analysis and intelligence to create automatic rules that are only good for a few short seconds while that traffic flows. And then that rule that was put in there by our stateful firewall is removed like we saw. So that is very handy. Lows us to filter traffic with less rules.

4:19So it makes your administration easier. One of the other benefits of stateful firewalls is back to our handshake down here. Well, what is a common type of attack is called a sin flood. And this is a denial of service attack. And what it is is an attacker out here, let's give him some angry eyes, er, we 'll go out and send thousands upon thousands of sin connections to a target.

4:51And it could be your firewall that's like, well, when a sin is sent, the destination will send a sin act in response, you know, as it should. So what happens is the attacker does not send a final acknowledgement. It just doesn't happen. And that's on purpose because this is a half open session. What's going to happen is whatever is over here, if it's your firewall, it's using resources to keep this half session open while waiting for that acknowledgement. Now if this happens once, it's no big deal or twice or ten times.

5:24But when you're talking thousands of times, all of that adds up and the idea of the sin flood is to use up the resources of your device down here so that nobody can use it. So really it takes your device offline. Well with a stateful packet inspection firewall, it can see that that's happening and it can then prevent it. It can just block the bad guy and not let that happen. So that's another great feature. Now let's make a little bit of room because I want to talk about the checkpoint and kind of some of the intricacies as a stateful firewall that it has.

6:02So let's talk about this real quick. Now on this checkpoint security gateway that we're going to be working with, the state of the session is stored in the state table. So this session information right here that we've been looking at and here, that is stored on the security gateway in the state table. So that can always be referenced by rules and by the inspection that's happening. Now the inspect engine, so let's put that up here. The inspect engine is what's responsible for performing stateful packet inspection.

6:37So that is your inspect engine that takes care of your stateful inspection. And then all that state information is stored in your state table. All right. Super. Moving on, we got one more topic to cover here. We're talking about types of firewalls and that is multi-layer firewalls because traditionally firewalls worked at layers three and four. That's traditionally because here we have our network information. Here we have our TCP and UDP information. So that's generally what we were filtering on.

7:08We were filtering by IP addresses, port numbers, protocols, those types of things. That as time goes on, we get new features and we get what's called a multi-lay er firewall. And a multi-layer firewall really is also known as an application layer firewall because it can read all the traffic up to and including the application layer where apps are. So really we're looking at filtering with all of these layers. But what does that really mean if I can filter by the network layer up?

7:42So honestly, the greatest feature that we get from this is application insights and the ability to filter applications themselves. And that's why it's also known as an application layer firewall. So that means we can see all the traffic that are coming and going and not just the network information like we did with the older type firewalls, we can see it all. So that's great because that means that we can do a couple things. We can actually decrypt HTTPS traffic.

8:14So in the past, we couldn't do that. And so all you could do is filter by really IP addresses, protocols, port numbers. But now we can decrypt that HTTPS encrypted data. We can inspect the data to make sure it's not malicious. And then we re encrypt the your HTTPS data and send it on down to you as it's coming in. And come from the internet coming into the firewall decrypts. It does its inspection, make sure it's safe. Then it'll re encrypt it and send it down to the workstation.

8:46So that's pretty handy. Another great feature is simply app filtering. So we can create rules to prevent certain applications from being used. And this is lots of applications, things like Facebook. But not just Facebook in general, you can block individual applications within it. So there's like games and there's chat and there's all kinds of other features. And it's not just Facebook. It's all the applications that are out there.

9:16It gets very granular. And what's great about these is they're generally grouped together in labeled groups. So it might be a group that has a name of business related. Okay. So you could have financial applications like Salesforce CRM and there might be accounting applications in there and things like that. And there will be one for news and there's one for gambling and one for sports and one for social media. You see where I'm going with this.

9:48We can actually block a lot of these things by their group that they're in. So if we want to block all the social media for everybody except for maybe the marketing department or we want to block sports for everybody because we want to keep productivity up. You know, those kinds of things. So this is where we can actually filter individual applications, which is super helpful. In a business environment. All right. So that wraps up talking about different types of firewalls. And really the big takeaway is the idea of a multi-layer firewall, an application layer firewall, and then a packet filtering firewall versus stateful, which watches the state of the communications and makes decisions based on that.

10:26All right. Super D-Duper. Up next, virtual lands. We get to take a look at VLANs and what they are and why we use them. So I see you there shortly.

0:00So we're starting off with network segmentation and this is the idea that we take a large network like this That we see down here and we're going to break it up into something that we call sub networks or short for that is Subnets, okay, and the idea behind that is we want to isolate Devices that are similar to each other and this is why if we take let's say we put our servers over here in this subnet And we put our workstations over here in this subnet and we put publicly accessible servers In this subnet and maybe who knows we put like printers in this subnet Sure, why not well the idea is these can all communicate with each other, okay both ways and That's what we want we want everything to be able to communicate however the idea behind having subnets is that between each of these we can put security services here and so really what we're talking about is we can put security rules in between all of these and When we put these security services in place it allows us to put rules in there

1:15saying what can access what now And an example of this is do our workstation users down here? Do they need to access every open port on all the servers up here? Well the answer is probably not they need to access a handful of ports on a handful of servers and Then when it comes to these publicly accessible servers over here, do they need to access our internal servers? Well, maybe but again only on a couple of ports most likely So you see where I'm going here when we break these up into smaller network segments Then we're able to control the security in between each of them So for example over here we see our publicly facing servers So these would be things like web servers and app servers that our customers are using Well, if they can come in from the outside and access these We don't want those on the same network as our internal servers down here Because then if one of these was to be compromised over here It could try to jump over and Compromise one of our other servers or all of our other servers as well so we can put security rules in between these to help protect against that So that's why we do network segmentation So now we know why we do that the next question might be how do we do that?

2:28And we do so using virtual lands and those are called VLands and that's because if I didn't use some type of Virtual let's key word here virtualization in here and I wanted separate networks I'd have to have a switch over here for my servers to be connected to and I'd have to have a switch over here for my Workstations to be connected to and one for my public servers So I have some servers over here that are publicly accessible and then if I had a switch over here for Maybe printers could be maybe I have a switch over here that's connected to servers that contain Intensive data so you'll see I have to put switches on all of these and that's additional network equipment to plug these in And if I have them in different areas of the building that I need more and more of them Well, that just really isn't very efficient So let's go ahead and clear this off and see how we can make this more efficient and it's really through the use of the VLands that I mentioned and the way this works is if I have a switch over here There we go, and I've got all these ports on it and we'll just do these quick little ports here and I start using VLands now VLands use something called tags or tagging so they

3:46add tags to our data and the way this works is within the Layer two of our OSI model data link layer within the data that's called frames here a piece of that data is a VLAN ID And that goes right in there so as this data traverses this piece of network equipment, which is a switch It knows what VLAN it's a part of so what these VLANs are virtual lands and What we do is if I had let's say I wanted this to be VLAN number 10 and I wanted this port and this port and this port and this port all in VLAN 10 Well then anything I plug into these let's say servers for instance So I'll put a little server down here. Well the servers can only talk to other servers that we have plugged in here And if I used maybe this port and this port and a whole bunch of these ports maybe for workstations We'll call this VLAN 20 and there's going to be for your general computer work stations They can only talk to each other at this point So we've isolated them Virtually that's the keyword their virtual because we see it's one physical switch And if I wanted to do this without VLANs, I'd have to have a separate switch for each of these and again

5:02Let's just not efficient so we can do this by creating virtual lands and we can tag our data And that's how the switch devices know what data goes on what VLAN is pretty straightforward actually and it's pretty Simplified and easy to understand and use now What if I did want the servers to talk to my workstations or vice versa? Well, what would happen is these switches they plug into a network core of some sort and really it's going to be something that provides routing To the data and this happens at layer three of the OSI model that's our network layer and what happens is these all get passed up To the router or it could be a multilayer switch that provides routing functions or could be a firewall that provides routing functions It's whatever device provides the routing for the network So when that data gets up there it sees that there is a VLAN 10 and it has an interface for that and it might be a virtual interface Not a physical and necessarily it sees if there's a VLAN 20 and then what I can do is I can create rules that allow 10 to talk to 20 and Vice versa and I could say only on port 80 or port 53 or port One 10 whatever it is that I want them to talk to or I could say all ports if I

6:21wanted to Doesn't matter but I create security rules that allow them to communicate with each other and that goes back to How we saw that we could provide security rules in between each of our subnet or subnetworks and that's how we create subnetworks We use VLANs or virtual lands and VLANs Tag their traffic like we saw here with a number and that's how the network devices know what traffic Belongs to what VLAN. All right that wraps up our network segmentation and VLAN s next up We're gonna be talking about virtual private networks or VPNs in the next nug get. So I'll see you there shortly

0:00All right VPNs, what are they? Well, they are a virtual private network. Now let's dissect that. So virtual, okay, got that. So it's not necessarily a physical connection. It's a virtual connection. It is private. That's good because we like privacy. It helps us to ensure confidentiality, which is part of our CIA triad and it is a network to allows us to communicate. So what it does is it allows us to securely connect networks and devices across insecure networks. So if I have a network over here and a network over here, let's say A and B and both of them have an internet connection. There we go out to the internet. Well, the internet itself is insecure, okay, because it's the wild, wild west of networks out there. It's owned by lots of different organizations and companies and it's just not secure. It's not your private network. So wouldn't it be great if there was a way we could create a kind of tunnel that goes across the internet and connects these two networks together. And in this tunnel, nobody can see

1:16inside of it. This is all encrypted data. So it is confidential. It's private. Well, that's what a VPN is exactly. It allows us to create a connection between networks across an insecure network. Hey, that is pretty darn awesome. So let's take a look at how this works. All right, our VPN here, what we have is we've got network A over here and network B over here and of course the internet here. And what we could use is a VPN router or a firewall that has VPN services on it. We need some type of appliance that does VPN stuff, okay? We need one at both ends .

1:59Then we go ahead and we configure them to talk to each other and to set up a VPN between them. And then we end up with our VPN tunnel that goes between the networks. So we can then communicate across the tunnel and that data is secure. It maintains its confidentiality. So again, we can work to ensure our CIA tried there. And that is a network to network VPN. But we also have something called a client to network VPN. And that's where we could have someone down here on a computer or a laptop or something. We could say a teleworker and this teleworker could have a VPN client software on their computer and they fired up .

2:44They put in their credentials. And what it does is it goes out and it talks to a VPN router or such. And it creates a tunnel between the computer itself and the VPN device on the network. So that means all the data that's going from this computer to this network over here, all of it is encrypted. So this teleworker could be at a coffee shop or they could be at some airport Wi-Fi or working from home. Doesn't matter. They could be anywhere and they have a secure encryption back to their home office network. And that is pretty darn cool.

3:25Now when it comes to VPNs, there's a couple of protocols. There's actually several protocols that are used to make this happen. We're going to talk about two of them. These are the most common. The first one is IP sec and that is IP is in layer three of the OSI model or IP addresses, IP security. And that is a very common protocol used for network to network VPNs. Probably the most common actually. And then there's SSL TLS VPNs. And if you go and visit a secure website, you're using SSL TLS to encrypt your communications with the secure website.

4:10Well, we use that same protocol oftentimes for a device to network VPN. And that was where we saw our teleworker connecting into their home office network. And that was over a remote access VPN. And oftentimes those will use SSL TLS for their protocol. But they can also use IP sec absolutely. But it's just more common nowadays to use SSL TLS. So here you go. Those are a couple of the common protocols we use to create VPNs. And what VPNs are, how we can secure our communications between networks across untrusted networks. And that's actually how we'll secure our network communications between our HQ site and our site A once we get into the lab. Well, that wraps up our VPNs. Next up is Intrusion Prevention Systems or IPSs. So I'll see you there shortly.

0:00Let's talk about intrusion prevention systems or IPSs. So what are they? Well, Internet Shell, an intrusion prevention system or IPS is a system that, well, it analyzes network traffic and if it's malicious, it will block the traffic. It's pretty much that simple. So let's talk about how they work. How do the IPSs work? Well, IPSs themselves have a database of known malicious traffic.

0:32Okay. And that is key there, the known part. Known, so I'm going to put that right there. And then we'll put over here, malicious data. And this known malicious data has a signature to it. And it's what that data looks like to the network, as it goes across the network. So our IPSs, they have this database here, of known malicious data that's known as signatures.

1:02So they have a signature database. And it's very important that we understand this part right here. Known. Yes. So IPS is block known malicious data. Now, if it's a new type of attack that hasn't been identified yet, so it was something we call a zero day, well, then your IPS really probably isn't going to block that. Unless it has the ability to use heuristics and look for traffic patterns, not just signatures. So it just depends on what type of IPS you're dealing with.

1:35Now, another key thing about this is that this database here has to be kept up to date. Very important. It will check for updates multiple times a day because new signatures are bringing a release by vendors multiple times a day. And the sooner you get those updates, the better off you're going to be, because if you stop doing those updates, like maybe you stop paying for a subscription for updates, well, then your database over here has old data in it. That old known data and all the new knowns and the new signatures from the new types of attacks, well, you're not going to be protected against those.

2:10So up to date, you got to keep your databases, your signature databases, definitely always up to date. Very key, very important. So now that we know what it is, what it does, well, where do we put it in our network? That's the next question. Because there's two ways you can put an IPS in your network. It can be in line, okay, or attached. And they're very different.

2:40So in line means that maybe the internet's here and you've got a connection coming in, you've got your security gateway here, and then you have the rest of your network with devices and such on the network there. Okay, so in line would mean that the wire or cable that the network data is going across must go through the IPS in order to get to the network or that network's segment. And this is very important to understand that an IPS in order for it to block most of the traffic, it has to be in line.

3:19Okay, it can't be simply attached. And I'll show you why here shortly. So being in line, the traffic has to go through this device. So it's at that point, you can say, you know what, this is malicious. I'm going to block you. You're not going to go to my network. And within the checkpoint security gateway, we have the ability to turn on an IPS blade in here. So an IPS that runs in software on your security gateway. Which means it is in line.

3:49And that's what we want. Okay, so the attached, let me show you what that looks like. The attached is generally used not to prevent data, but to collect data. See what's going on to do some analysis. And here's what that looks like. If you have your internet and we had maybe a security gateway over here. And it connects into our network where we've got our hosts. Well, what we would do is I would put the IPS over here. And it's not in line at all.

4:19There's nothing behind the IPS. The traffic still goes through to the endpoint. It's just a copy of the traffic gets into the IPS to be analyzed. Well, in this instance, the IPS can not block that traffic. It just can't because the traffic's already passed through. So it's in this instance that we would only be collecting and analyzing data and not blocking malicious data. And that's really honestly just not the best scenario. So at this point, I want you to understand this there.

4:51But we will not be doing this. We'll just line that out. This is what we're working on. We'll be using the IPS blade within the checkpoint security gateway. All right. So that is your intrusion prevention system and the IPS and the idea that it uses signatures to identify malicious traffic and that is known malicious traffic. Right? And you got to keep those signatures up to date. And we're deploying it in line as an IPS blade within our checkpoint security gateway.

5:25All right. Well, that wraps up this skill, which means it's time for validation. So I'll see you there shortly.

0:00Welcome to Validation! So we've got a few review questions we're going to do here. And starting with question one, what RFC is the best practice guide for NAT? And we did talk about one of these RFCs and it was also the same RFC that defines private IP addressing and that is RFC 1918. That's right, move it on question number two. Here we go, which best describes North South traffic? Is it traffic leaving your network and coming into your network?

0:30Traffic between applications inside your network, traffic between users on the internet and Google or traffic between hosts inside your network. Now North South traffic is the traffic that's leaving your network and coming into your network. It's that top one there. That is the correct answer. Traffic between apps inside your network. That is just your east west and traffic between hosts inside your network again east west. And then this one, this one is a little different. It's going to be a user on the internet and Google. Well, that's all internet base. That's nothing to do with my network.

1:01So it is traffic leaving your network and coming into your network that is your North South traffic. All right, moving on to question number three. Which of the following inspects traffic information and stores it in the state table? We talked about this and the key word is right here. There you go. That's it. It inspects that traffic. That is your inspect engine. That is right. Very good. Moving on to number four. True and false. Here we go. Stateful inspection is better than simple packet filtering because only one rule is required for each connection.

1:36Remember we talked about the difference between a stateful inspection firewall and a simple packet filtering firewall is that stateful. It watches the state and it creates automatic firewall rules for you to allow return traffic coming back. You don't need to create one access rule for a connection. It will allow the other to come back through the response that is. So yeah, that's true. And on to number five or final question. Here we go. Which type of net is supported on the checkpoint security gateway and allows incoming and outgoing traffic?

2:12Now we talked about two types of net that are supported and that was high net and static net. So dynamic and host, that's not even an option in this question. So is it going to be a high net or static? Now high net was only for outgoing traffic. We're looking for net that allows incoming and outgoing traffic. So that's going to be our static net. And that wraps up our validation review questions and wraps up this skill. I hope it's been informative for you and I'd like to thank you for viewing.

2:44[BLANK_AUDIO]