FortiGate Firewall V6.4

15. Lecture-15:Configure Virtual Wire Pair in FortiGate.

Related to the interface is the virtual wire pair. "Pair means pair." Definitely an English pair. And Virtual Wire, I told you,basically does what a bridge does. We call them transparent as well. In Transparent Firewall and Cisco terminology,we call them rewire. We use them here as well. We recognise the student who took the class. So Paul wants to call them "virtual wires. By the way, V Wire is not a virtual wire; we wire. And here we call them "V-wire pair" and "Cisco." We call them transparent firewalls. What is a virtual wire pair, in essence, either bridge? There is no IP address configured on this port. Whatever you want to pair them with only requires two interfaces. Keep in mind, not more than two,not less than two, it's basically bridging. So there will be no IP address on port one and port two. And you can use the same subnet on both sides. The same concept that we discussed in Cisco SFR one, which is in Square SFR, we don't have the same concept in Palo Alto Firewall. We call it V-Wire. So you know this terminology for those that are new. So let me give you this, like a bridge basically. So this firewall will do nothing here. We are using the same subnet and the same subnet in this side.We will not use a firewall to assign different subnets to router interfaces. When you assign the same IP address, we will give you a lab error, the same casino firewall,but you can configure the firewall as a transparent mode. Okay, so they pair them Basically, I want to combine PC One and Server One into one subnet, and you can assign the same policy and everything. But it's like a transparent one. Suppose any organisation said, "Don't change my subnet, just plug and play something." So you can put this virtual wire to use for something else. Okay, so how to do it? So let's go to the lab and let me remove this one. I will use the same for all of them because it will take time to boot up. And from here, let me take one web term as a client on one side and one toolbox as a server on the other side. You can use any router switch if you don't know this one, so you can use anything. Let me connect this one to port two. OK? And let me connect port three to the server. Okay, so now I need to assign the same subnet on both sides. Normally, we assign different In this case, I will assign the same subnet. So right click on the PC Remove the hash from the configuration of auto start. Okay, and suppose I let you assign one here. I don't care about gateways because they're not required for any gateway. So forget about that. 10. One is my IPon this side, and right click here to edit configuration,control A, control B, and let's suppose eleven. So one and eleven are on the same subnet, with the same everything. Okay, it's better that I can. Let me add this. So let me type the IP: 192-1680 One IP on this side and the same subnet IP is here. Only the last digits exchange, which is eleven. It will not work by default because it is not configured as a V wire. So what we can do is use ports three and two. So let's go there. First I need to remove it because it's already in use. Again, deleting is not available. So first you have to go there referencing Click on this reference. Okay, remove the reference. And now you can delete this one. Click and delete is available. Now these two ports have been released. It's not used for any other purpose. So two and three are available, which is down. Okay, there is no use. So click on create, and there is a virtual wire pair. Click on that one. Give it many names. Suppose we wire a pair. I think you can click on this icon and choose not to, I think.So let me see two and three. Choose two and three and click okay. You can click the VLAN as well. So if I go down, here is a virtual wire. If I click on plus, you will see Vwireis. Virtual wire pair is the name and type. There is no IP address. Configure codes two and three are taking part. So what does that mean? It means I want to bring these two PCs together to work. Do you think it will work? Let me see. If I click here and let me type one ninety-two, one sixty-eight, zero eleven, which is the IP address of this one. because this is a web server, FTP server, and SNMP server. So many servers are here, but they're not reachable. If you say, maybe the server is down. So let me ping it. It will not work because we need to do one more thing. So if I say ping, one ninety-two, one sixty-eight, and one eleven, So it's not pingable. So how do they bridge them? Now we need a policy. Let's go to policy. Normally, we do policy from here. from the fundamentals class We know IP for policy because it is implicitly denied. That's why the traffic has been denied. And now let's make something new. Do you think this is an available incoming interface? No, two and four are not available here. It means something is wrong. Either this policy will not work with the V wire, Yes, because there is nothing available to be allowed for, I need an ingoing and outgoing interface. So my interface is two and three, which is not visible here. So for V-wire, you have to enable a new policy feature which is not available. Here's what you can do. Go to the system and there is feature visibility. Most of the stuff is not available by default. Go here and enable it. By the way, it should be NWF. Okay, And there should be something related to policy. This policy, which we are using, has only four policies visible. So this is one policy advanced option and you can see the configuration as well. Click on this one and apply. Now you will see the difference if you go to policy and object. Look at the new policycam IP for virtual wire pair policy. So it means that policy is not made for the virtual V wire. When you enable the policy advance option from the system, it's now available. So click on this one now and create a new one the same way. Give it any name you like. Suppose it says V-wire any name, they say virtual wirepair, which direction you want to go from two to three, traffic will go, but return will not be allowed. If you click on this one, from three to two will be allowed, but from two to three, you got my . From 3 to 2, traffic will be allowed from this way, but this way traffic will be denied, and it's up to you which one you want. But in my case, I will say no in both directions. Okay, and who is the source? So forget about this. I will always say who is the destination for anything, services for anything except and all sessions so that I can see the traffic. That's it. So rather than using that policy, I created a new policy method and there is no traffic. Now you will see it has to start now for toll C and up. Hopefully the ping will start to work. Let's see if I assign this IP, the same IP, let's see if it has to be reachable. Yeah, so 100:11 is reachable. Okay, now I can see and, for some reason, let me see the ping. Now the ping will also work. Okay, and you can see there are no bytes if I refresh from here. Sorry,there is no better way to refresh from here. Now you will see the traffic. It's fitting that this policy is 21.48 MB. You can see the rules. Okay, and now you can verify it from here as well. Okay, after a while, it will come here. So no one is going there. Also, the destination is 00:11 for TCP and ICMP. Protocol for Internet Control Messages Messages Okay, and all sessions can be verified as well. Logs and forwarding in traffic can both confirm this. So after a while, you will see this as well. Okay, so it means now it is working. So basically, we bridge them as a transparent subnet if you require such things. So you can use a virtual wire pair. Okay, let me see if I missed something. So that I can enable it here, we will create a policy system. And now we go to your work.

16. Lecture-16:Administrative Access in FortiGate Firewall.

What is administrative access? On the same interface, you can restrict something, limit a protocol, or allow something so that the administrator can access it from any router for administrative purposes. So we are using administrative under every interface. You will see, like in a normal firewall, there is a special interface for management. But here you can enable, by the way, PaloAlto. We also enable management online as well. So here, under every interface, if you want to enable any administrative access, right now you can only access this firewall by this port number one via administrative access. That's why I'm here. Let me remove that one inside if I want to enable it. I'm connected here at zero slash two, four, two. So let me remove that virtual wire first, because it's used in reference. So click on reference first. Remove the reference. It has been used once in the policy and the other one is here. So you have to remove all the references. Then you can delete it from here. Keep in mind, I'm repeating, you will face this issue. That's why I'm saying where is the interface being released or not yet? It's been released that two and three are no longer in use. Let me put in any IP. So my inside IP is in this subnet, okay? So let me assign 192-1680 to 124. We know how to assign this one, and let me say this is my land, okay? and allowed ping-limit ping. By the way, it's okay, just zero, and let me make one small change here. Edit the configuration and put this 100 as a gateway. And because I won't change it, you have to stop, okay? And start. That's it. So it means my IP is here at 100. Now let me show you the administrative access. Do you think I can access this firewall just like this? When I access this firewall graphically,this is the IP 11420 six.Let me check it out. So I'm typing 100 here. No, I can't ping it from my internal network. Ping 192, which is my gateway, even though I cannot ping. Graphical access is a different thing. Can I tell you about the internet? Can I SSH? Can I do anything? No This is called "administrative access," which is shown here. This one, because on board number two, there is no administrative SSL out. Nothing. You're showing nothing when I click here. So what you want to do on this interface is gain administrative access You want to allow https, which means graphically some minute access like this. You want to allow ping. So let me allow ping. At least now I can ping. Before, it was not ping able.Let's start now. Before it was not working; now it is, and before it was not accessible. Now it has to be accessible https,because I need to allow Http. Https is through license, but it's not showing Https, so it has to forward me to Http. By the way, let me type. It will give an error because there is no license. As a result, without a license, it will not be accessible via HTTP. If you have a license, then it's allowed, so HTTP, but it's not accessible due to this licence issue. Don't worry, there is no HTTP showing. It will show you on one interface but not on the other due to licence restrictions. However, you can still do it. So Ping is working on SSH if you want to enable SSH. So now you can SSH to this system again. Yes, I have a question. Suppose you go to the command prompt and allow HTTPS. Basically, HTTP is not working on this for a while until you have a valid license. because you are using a 14-day license. So that's why on a 14-day licence they limit something. One of them is that HTTPS cannot be obtained. Suppose I'm logging here. If I try to Https, okay, it will give me an error, but next time, let me remove this one. In the next class, I will provide the license, and then I will show you how it will work. Let's say secure connection says the issue is due to license. When I get the license, I will take it by Https. So this is just a limitation. Don't worry, I will show you in the next class. I already requested a license, but I will take the next class so that I can save some time. It's only for 60 days. So what I was saying is, yeah, so administrative access is what you want to allow on this specific interface, so the administrator can access this device. Now let's see what those things are. The first is Https, which stands for Hypertext Transfer Protocol. Secure means it's a secure way, which I will show you in the first class. Another one is the HTTP hypertext transfer protocol. This is unsecured. Another is the Pink Packet Internet group. And this is a utility where you can test your devices just to send an eco reply. FMG means 40 managers. The 40 manager is just like Panorama in Palwal to Farwal. I will give an example of that one. Either, like in Cisco SF, we have FMG, sorry, FMCA, to configure many devices from one centralised location. So here we have FMG, which means four key managers. Finally, in one lecture, I will show you how I will configure three tickets for one spot. Same. You will find Capwap. This is for wireless. Suppose you are using 40-gate wireless capability on one device, so you can configure this one. The SSQ XSPone uses this protocol SSH stands for Secure Shell. This is the method for securely configuring any device via CLI. OK, SNMP: Simple Network Management Protocol. We'll do it again for management purposes later in the course. Token FTM 40 40 tokens are similar to this one; you can use 40 tokens to enable that feature as well. 40 token and FTM and FMG mean 40manager access, so this is also related to administrative access 40client telemetry if you are using that method. which is to communicate between 40 clients and 40 gates, which is not available, and some of them you will see here. That's why I'm showing you all I told you about Secure Shell, which uses port number 22 for management purposes. We're using this protocol, which is TCP-based and uses port number 22. SNMP is a simple network management protocol that uses port numbers 161 and 162 for the trip, as we'll see later in the course. So this is called "administrative access." It means that I can now do ping, which was previously impossible. Lane can connect to this device via HTTP. If you want to SNMP either on thelane, you are connected to 40 managers, so you must allow this one, or it will not work at the end when we do 40 managers. So this is called administrative access, which you want to give like reads, as well as the radius protocol, which we are using for authentication, and these protocols are called administrativeexcess until you are not allowed. It will not work, okay?

17. Lecture-17:Configure DNS & DNS Server In FortiGate.

In theIn the initial working lab,lab, we configure DNSfirst, then first, then we configure interfaces,and finally and finally we move to DNS. DNS. So,So, what is DNS? DNS? DNS means domain name system oror domain nameserver. These. These are the evaluationsevaluations of DNS. DNS. Basically,Basically, DNS is a larger where there are many computerscomputers and many serversservers in the world,world, but thereare 13 are 13 DNS serversservers throughout the world and you canfind those find those 13 DNS serversservers I'm talking about. They. They're allnot limited not limited to the organization,organization, so don't be confused.confused. I'm just givingjust givingyou the you the overall story about DNS. DNS. So there are 13 DNS servers in the world, the majority of which are located in the United States. These thirteen DNS servers begin with this one and have the following root names: bcdefghijklnm the replication of the servers in the United States and Japan, in London, and so on. So there are 13 DNS servers in the world, the majority of which are located in the United States. These thirteen DNS servers begin with this one and have the following root names: bcdefghijklnm the replication of the servers in the United States and Japan, in London, and so on. So whenever you want to buy any server like YouTube.comlike YouTube.com, I'm typing Youtube.com,Youtube.com, so whenever you wantto buy to buy any domain name,, this name willbe checked be checked in these 13 DNS servers. servers. Does somebody reserve this name or not? not? Okay, so then they will allow youto use this domain to use this domain name and basically this Youtube.comIf I go If I go to CMD and Nslookup and www.com behindbehind Youtube.com, how many IPS are working? working? Some are iPAX, while others are supposed to be if I type IPenter here to open Youtube.com. Some are iPAX, while others are supposed to be if I type IPenter here to open Youtube.com. Yeah, but whyis Google is Google open Google?Because YouTube is working under Google now,, some of the IPS will open what is calledGoogle most Google most of the time,time, so if I go back, maybecheck any check any other IP,IP, so this is also under Google. Google. It's better to give you another example of Facebookbecause with because with this one you will be confused,confused, so Nslookupand let and let me type Facebook.com. This. This is Facebook.com IP andlet me let me type this here so it will open Facebook.com. Facebook.com. So,So, ratherthan having than having to memorisememorise an IP address, , It's better to useto useFacebook.com because Facebook.com because everybody knows who is doingall this all this stuff,stuff, so convert IP to name and nameto IPB to IPB 13 DNS server,server, which is located throughout the world,world, so it's basically like a phone. You. You save my name by maybe a motherlyinstructor or something,something, so when you're diallingdialling my name Basically,Basically, you are not diallingdialling my name behind mymy name. name. You are diallingdialling my number,number, but forease of remembering, ease of remembering, give them the name. Why do. Why do you give them mine? them mine? You can say directly zero, zero nine,nine, doublesix, and six, and say my number no. It. It's not possible fora human a human to remember so many numbers MaybeMaybe you willremember some remember some of the good guys. They. They can memorisememorise many numbers. numbers. Idon't even don't even know my father's phone number. number. I give them the name because it's very difficultto remember to remember your brother and all those guys'guys' phone numbers. numbers. So,So, DNS is like a phone number. number. So it will save name to IP and IP to name,name, OK? OK? And whenever you want tobuy a buy a domain,domain, they will check there. there. A phone number, for example, cannot be the same. A phone number, for example, cannot be the same. SupposedlySupposedly in one city,city, so they are checking here. here. Now this DNS is being divided thisthis way,way, the whole domain name. name. The last oneis the is the root. root. We call them roots. roots. There is a dot,dot, by the way. way. At the end of this.org there is a dot,dot, by the way. way. Nothing will change if I type something out. Nothing will change if I type something out. It's open everything. everything. There is a small dot which is hidden. hidden. We call them roots. roots. You will say no, you can type anything. It will work. work. Now let me type comma. It. It will not work. work. The only thing is,is, there is adot,adot, which we call root. root. There are net.comThere are net.com, org, and megov. There are. There are so many top level domain.In this case, this is.org and if Iopen Youtube.com, this is aa commercial. commercial. Thereis a.org is a.org organization. organization. I have one for personal use, as well as many others for organisations and the government. I have one for personal use, as well as many others for organisations and the government. The first is government. The first is government. ItIt is like a network.com commercial. commercial. So this is calleda top-level a top-level domain. domain. After theAfter the dot,dot, which is the hidden dot theory, theory, Then there are second level domains, such as this one. Then there are second level domains, such as this one. This oneis a is a server. server. This isa second-level a second-level domain. domain. In this context, we refer to them as URLs. In this context, we refer to them as URLs. httpserver.org OkayOkay, keepin mind in mind there is one otherother thing as well. well. After this top-leveltop-level domain, the country'scountry's name Whenever you are in any country,it will show you that one. one. Suppose if I go to Google.com, Google.com , Google.com I doI don't need to show me or not okay. . becausebecause I'm using another weather report. report. They will type "SA." "SA." So if you visit bydeposit, it deposit, it willtake you take you from thethe UK. UK. It will showyou the you the UK because I'm notin the in the UKSo, they So, they will makethem in the them in the UK, USA,USA, and so on yeah.So by countries also,also, because I'm in Saudi Arabia. Arabia. I can onlyI can only take this one because it's the correct one. one. At theAt the top level,level, thereis a is a country name as well. well. And subdomainssubdomains can be like FTP,www, or, or any subdomain as well. well. Suppose if you go to Google,they have a subdomain mail. mail. If I type here, mail government SA If I type here, mail government SA Maybe mail or something, I forgot about mail and Maybe mail or something, I forgot about mail and ThereThere is another mail or mail. mail. Anyway, something like this one. one. So this iscalled a called a subdomain. subdomain. Okay? Okay? This is all about the URL, okay? okay? So let me show you. you. I was telling you something, yeah. yeah. So thisis a is a fully qualified domain name. name. We call them FQDN. Okay, , This is aThis is a fully qualified domain name. name. And altogether,altogether, we call themURLs as URLs as well as the source locator. Okay? Okay? So this is DNS and 13 DNS all over the world. world. This is the story now coming to local DNS. DNS. In every organization, you cancreate your own create your own local DNS as well. well. Let me showyou the you the local DNS. DNS. If I go to my server andshould go should go to DNS, is there any DNS? DNS? Okay, this is my local DNS and server. server. Thereis a is a forward lookupzone, a reverse lookup zone, zone, a reverse lookup zone, and aa forward lookup zone. zone. Normally, we enter the name and the reverse lookup zone. Normally, we enter the name and the reverse lookup zone. We areputting in putting in IPSbecause, as because, as I told you,you, DNS isbasically keeping both the record, your phone number and name. name. So,So, IP address and domain name. Okay? Okay? So there are two locations. locations. By the way, I need to configure one quickly. quickly. So let me quickly give them aa zonetest because test because I need to show you something there inside. inside. Just create a test here. Yeah, it's come up. It's okay. okay. Now,in the in the reverse lookup zone,you have you have toput the put the reverse thing. Okay? Okay? And I don't know what my IP isIP is, so you get this one. one. It's coming here. here. So this is local DNS by the way. Even in. Even in inlocal DNS, you will find those 13 DNS as well. well. Startup Authority ThereThere is one place to showyou those you those 13 servers where I can find thisthis place to show you 13 DNS servers. servers. So it should be like here. Maybe let me. Maybe let me go there and there areare 13 DNS. DNS. Those 13 DNS servers we've been talking about Those 13 DNS servers we've been talking about Also available on a local DNS server aswell, by well, by the way, is not showing me here. here. Let me find out. Maybe. Maybe I forgot this name. name. The serverThe server should be here. here. Those 13 DNS servers,servers, for somereason, are reason, are not showing me here, those 13.So maybe I forgot toput it in put it in the proper place. place. Let me check here. here. It should be here,here, by the way,maybe because I just configured this one. one. So it's not available. available. It has to be here, byby default,default, whenever you configure it. it. So let me quickly configurethis to this to 192-1688. 192-1688. Let me give them anything. anything. Okay? Okay? And let me check. check. They're not showing up here for some reason. They're not showing up here for some reason. It's okay, it's not here. here. Anyway, let's go here now. now. So you can configure your local DNS as well. well. Sorry. Sorry. inin Windows ServerServer 2003, Server 2008, Server 2012, Server2016, and 2016, and Server 2019 and also in Linux as well.Soin the in the local DNS there is a record. record. A record is basically anan IP four. four. If I go back there, let me showyou. If you. If I right click, there is arecord for record for NewHost. NewHost. Okay, suppose I givethem a them a name test,test, sorry, ABCSupposeand an and an IPaddress of address of 109 21688. One supposes. One supposes ETRmeans pointer,pointer, which is the opposite one here. here. So if you say "say "click here," here," it willcreate a create a host name here. Okay? Okay? This is the host name,name, which is a record. record. TheThe record is for IP four. If you want, , For IPV six, suppose ABCD. This. This time youyou type IPV six, suppose 2000 double one. one. So this is four IPV sixes four times and one IP four. So this is four IPV sixes four times and one IP four. They are referred to as records, and they will generate a pointer automatically. They are referred to as records, and they will generate a pointer automatically. Thisone has one has the pointer and click, so click, so that's why it's not created. Okay, , So what you need to do isto record to record if you want to configure anything. anything. So now I can ping ABC by name. name. As a result, DNS will combine them into a single one. As a result, DNS will combine them into a single one. Suppose you want to ping eight one.So this method we use here for a record isis IP 64 and there is another thing. thing. CNAME c nameis a is a canonical name;name; it's like an alias name. name. Either we call them what iscalled a called a nickname. nickname. So you can nickname whatis a is a nickname. nickname. By the way, Facebook'sFacebook's original name is this one. one. Let me give you YouTube. YouTube. Either Google, Nslookup, or www.google.com. or www.google.com. You know,know, Google'sGoogle's ownname is name is this one for searchsafegoogle.com. searchsafegoogle.com. This is the original name of Google. Google. But we know Google.com by itsits alias name. name. And this alias name isbasically a basically a CNAME and DNS. DNS. So in DNS, they say Google.com, and we all know what that means. So in DNS, they say Google.com, and we all know what that means. We know Google. Google. Because theBecause the original name of Google is this one. one. So I can do this one. one. My DNS is also local DNS. My DNS is also local DNS. If I go there and right click,click, thereis a is a new area either CNAME canonical name oror nickname. nickname. Let's say I want to give my nickname. Let's say I want to give my nickname. Suppose www. www. And what is the fully qualified domainname I will take from test.com? ABC. ABC. So ABC can be called www.abc.comwww.abc.com as well. well. Now, this is a CNAME. CNAME. The original namewas the was the ABC test. test. But I can ping and I cancall and call and I can do anything by this name. name. And these things, who isis going to do thesethese for me? me? DNS again,again, DNS. DNS. If somebody typestypes www, it means ABCtest,ABCtest, and ABC test means 182-1681. 182-1681. That's why Google's's own name is this one. one. However, we are familiar with the alias Google.com. However, we are familiar with the alias Google.com. www.google.com. www.google.com. So DNS did this as well as CNN. So DNS did this as well as CNN. We can do it. it. Anotheris the is the MX record. record. In DNS,DNS, we can do mail exchange for email purposes. purposes. If I go back and show you quickly, , So if you right click, there is aa mail exchange for email addressesaddresses etcetera. etcetera. You can use this method as well. A PDF I'll show you where the pointer is. I'll show you where the pointer is. This is the inverse of the name. This is the inverse of the name. You can put thepointer in pointer in as well. namename server. server. I'll demonstrate. I'll demonstrate. This will be thethe default. default. Thisis a is a DNS zone detail. detail. The mainThe main zone deterrent will be by default. default. And thereis the is the Startup Authority. Authority. It will showyou the you the full detailsdetails of the DNS. DNS. Let me go back and show you quickly. quickly. These two entriesentries you will find by default. This one. one. Startup Authority If youclick on click on Startup Authority, it will showyou all you all the details:details: response, refresh and retry, expiry, TTL, TTLvalue, and value, and all the things related to this DNS. DNS. It will show you the detailsdetails andthe name server will the name server will just show you the namedetails of the server you details of the server you are usingfor a for a fully qualified domain name. name. Okay, so these twoentries are entries are also there and I'm showing you'm showing you all theentries. Why am entries. Why am I showing you this? this? Now I'm coming to our own DNS and 40gate firewall. That. That was the story of DNS inquick way in 40 gate firewall we configure DNS. DNS. It's important,important, otherwise your 40 gate will not work. work. Not allNot all 40 gatesgates will work,work, butyour system your system will be unreachableunreachableto the to the internet. internet. So, if I log in as admin one, two, or three, how can we configure? So, the last time we configure a smart topology, we configure DNS. So, if I log in as admin one, two, or three, how can we configure? So, the last time we configure a smart topology, we configure DNS. So withwith DNS,DNS,why do why do we need this one? one? So, if there is a DNS under network interface, click on DNSdomain name system or domain name server by default, and you can use 40 gate for wall server as a DNS. So, if there is a DNS under network interface, click on DNSdomain name system or domain name server by default, and you can use 40 gate for wall server as a DNS. This is Country's default promptly DNS; normally, we keep two DNS entries. This is Country's default promptly DNS; normally, we keep two DNS entries. If one DNS is not available, the other will work. work. So the one which is first checked,checked, wecall it call it prompted DNS,DNS, and the other is secondary DNS. DNS. And we can give our local domain name justa created domain a created domain name,name, up to eight domainnames. You names. You can give ABC.com ABC.com plus 234-5678 click here plus 234-5678 click here NowNow you cannot give any more. more. So,So, up to eight local domain names. names. If youhave a have a local domain in your environment,environment, you can putit here. In it here. In my case,case, weconfigured it to test.com, configured it to test.com, soif you if you want to give test.com,, click on plus. plus. This is a 40-gate DNS server to convert your IP to name and name to IP. You can specify your own. I did it last time eight and I say one is faster than the other. It belongs to Google. This one is new. I don't know who owns it, but it is the fastest DNS server in the world. This is a 40-gate DNS server to convert your IP to name and name to IP. You can specify your own. I did it last time eight and I say one is faster than the other. It belongs to Google. This one is new. I don't know who owns it, but it is the fastest DNS server in the world. Start with DNS because everyone is using GoogleDNS, which is slow, so you can try one-on-one DNS and see if you want a secure DNS. Start with DNS because everyone is using GoogleDNS, which is slow, so you can try one-on-one DNS and see if you want a secure DNS. So nobodySo nobody can attack you,you, so you can make TLSTLS we discuss another course I think so. It. It's secureway by default is disabled. You. You can enable itto use to use this certificate because TLS requiresrequires a certificate. If you. If you want toenforce it, enforce it, it will all the timeuse this use this certificate. . It will show you those DNS which areare obtainedautomatically, so automatically, so it's showing you hereand the and the DNS server. It will show. It will showyou the you the update here. If. If you mouse over here,here, it'sping but not reachable because you are not reachableThere is There is no internet access,access, so that's why it's a 190 millisecond190 millisecondand the and the last update waswas 1035 I could show youyou acquired DNS is this one,one, which is reachable throughthrough our management interface onon this one,one, so that's why Iwhy I'm showing this one. one. So we can configure DNS here. here. So there you can put primary and secondary and youcan put can put a domain name if you areusing a using a local domain. domain. And also,also, you can use your local DNS entry aswell. This well. This is the way to configure DNS in FortiGate. FortiGate. But the question is, is it possibleto use to use FortiGate for all as a DNS server? server? Just like I created this one hereone here,because this is my local DNS. DNS. So yes, you can go to system,go to features, go to features, and from here enable DNS. DNS. So here I can find DNS. DNS. So let me goto the to the next generation. generation. There is a DNS database,database, asmentioned, with mentioned, with all the details. details. That isyes, it is yes, it is possible to configure TigerFirewall as Firewall as a local DNS,DNS, which is not recommended unlessunless you havea small a small environment, because FortiGateFirewall is Firewall is mostly used insmall organisations small organisations as well,well, because it's one of thebest for best for small organisationsorganisations and easy to configure. configure. So ifin a in a small organisationorganisation they don't havetheir own their own DNS, maybe Active DirectoryDirectory they don't have. have. So you can configure itit for awhile as a DNS server as well. well. On theOn the one which we just discussed, thereis a is a normal DNS entry just like inour system our system to enable this DNS database. Okay? Okay? And now, when you go to network, you will see another DNS server, which was previously unavailable. And now, when you go to network, you will see another DNS server, which was previously unavailable. And here you can see that that you canconfigure this configure this Portuguese firewall as your own DNS server. server. The firstThe first one isthat the that the DNS service is aninterface on interface on which interface you want to enable DNS. DNS. So in my case,because it because it definitely is for Lane. Lane. This is my lane, port number two. two. So I'll just say make a new one, okay? So I'll just say make a new one, okay? And I'd say port number two for Len, and definitely port number two for Lane. And I'd say port number two for Len, and definitely port number two for Lane. Assume that the mode is recursive nonrecursive forwarding to the system DNS. Assume that the mode is recursive nonrecursive forwarding to the system DNS. So,So, what is recursive? recursive? Recursive means they don't know anything; ; they will forward the entry whatever. whatever. Somebody saidsaid that who is server.com? ? So it will forward to the DNS, anotherDNS to DNS to ask them,them, do you know this guy? guy? Non-recursiveNon-recursive means it meansyou have you have everything in your own database. database. LikeLike I have here, I have ABC. ABC. So if somebody is pinging ABC,I will I will replywith non-recursive with non-recursive data. data. Yes, I know everything aboutABCD because ABCD because it's been configured in me. me. So you can use thesethese two metresmetres and forwardforward to systemDNS, which meansmeans we just configure here the system DNS. DNS. Anyway, it's up to you whetherwhether you have enabled it. it. But suppose I say recursive or non-recursiverecursive or non-recursive, whatever. whatever. So my interface is being selected. You. You can createanother interface another interface where it'snot the not the only one. Maybe. Maybe you havea DMZ where a DMZ where you want to use DNS for those people. people. So you can create anew one new one and if you want to edit itto edit it, you canedit it edit it and you can delete it. it. And this isthe recursive the recursive mode recursive.Now coming to the entry database DNS,DNS, thisis the is the interface on which interface I will receive. receive. DNS details imply that I will be asked to provide IP to name and name to IP mappings. DNS details imply that I will be asked to provide IP to name and name to IP mappings. So that port number is port number two. two. But what they will asknow is if now is if thisthing can thing can be configured herein the in the DNS database. database. Create aCreate a new Now it's askingme to me to DNS zone thesame thing same thing which I diddid here locally. locally. What is my zone name? name? This is my lookup zone. What should I. What should I give my name? name? Test theTest the same thing you have to hear. hear. Suppose Isaid "test" said "test" is my DNS zonedomain name,name, thesame as same as which I createdcreated here. here. domaindomain name My domain name is test.com. I gave it to. I gave it to them just randomly. randomly. Maybe acompany or company or something issupposed to be supposed to be local. local. Because test.com is a website, , So let me give thema local a local hostname as name as a primary master. master. Any hostAny host name you can give. give. Assume DNS and a contact email address. Assume DNS and a contact email address. Let me give you their@yahoo.com email address in case you want to send something locally. Let me give you their@yahoo.com email address in case you want to send something locally. Sorry. Sorry. So this is the same thing thatthat I diddid here. here. Thispart is a part is a power look up zone. zone. I clicked next and created the zones I'd made here in this manner. I clicked next and created the zones I'd made here in this manner. TTL value This TTLvalue that value that I just showedshowed you here And some,some, somewhere here. here. Test the TTL value for howlong to long to keep this record in answer. answer. So you can watchwatch minute and second.So my zone is ready. ready. Then this is authoritative. authoritative. Either unauthorisedunauthorised authoritative DNS meansbasically that they basically that they will keep all the records. records. It means if somebody requests so,so, they know the record. record. They will answer it. it. Yes, I have this information and no authority over you. Yes, I have this information and no authority over you. It means they don't keep anything. anything. They will ask somebody else. else. mightmight be Google DNS. DNS. Also,Also, I forgot to show youthis one this one type is master or slave. slave. So Master implies that you will place all of the entries on your local DNS detail. So Master implies that you will place all of the entries on your local DNS detail. Your system, your server detailsdetails manually. manually. justjust like Iput it put it here. here. Unlike ABC, perhaps you have a server. Unlike ABC, perhaps you have a server. So give their IP one,, okay, server eleven. eleven. Why isWhy is it not working? working? So let me give them 192-168-1142 hundred. hundred. Suppose swipe createscreates server one, server two, server three,three, and so on. The same thing. The same thing for master.master. I have to putall the entries all the entries manually where I will show you. you. Slave means it will change everything. everything. Look, it has changed. changed. It willbe forwarded be forwarded to some other masterwho will who will have the record just up to you. you. You need a master one. one. So thenin the in the master you have to put all the details. details. And here is the record. record. Create aCreate a new And these are the ones I showed you earlier. And these are the ones I showed you earlier. This is why I was showing you, you, you know,, IP four. four. IPV six is four times a name server. server. I just showedshowedyou the you the canonical name, the aliasname, and name, and I just showedjust showedyou the you the mail server and pointer for IP four and six. six. I'll demonstrate. I'll demonstrate. So that's why now I say IPaddresses are addresses are fully qualified. qualified. They create automatic,automatic, sorry host name,name, host name is server name,name, and IP address is one,,in a in a secureway. One way. One entry has been created just like the one Icreated here SupposeSuppose there is a serverserverand you and you type one,, two,two, again. I made a. I made a mistake one.Two is fine because I use master; try to put all their records this way because someone asked who is serverone, so I will convert them to one; if someone asks for my IP, I will convert them to host name because I'm a master and not authoritative. Two is fine because I use master; try to put all their records this way because someone asked who is serverone, so I will convert them to one; if someone asks for my IP, I will convert them to host name because I'm a master and not authoritative. I have other records. records. So ifSo if authoritative andand I don'thave it, have it, I willfollow it follow it tosomeone else. And someone else. And view means shadow and public shadow means Iwill use will use this DNS locally and public means public people willalso use it also use it to access these details,details, so it's up to youto make sure it's to make sure it's done. done. The view is complete, and the DNS record is correct. The view is complete, and the DNS record is correct. If you don't knowanything about anything about this one,one, you need toknow this know this one DNS server is basically if you are workingin a in a small organisationorganisation and if they ask you that wedon't have an don't have an active directory and we don't have any DNSservers, you servers, you will say don't worry,worry, I will configure 40 gatefirewall as firewall as a DNS server,server, so you can configure 40 The gate firewall can be used as a DNS server for two purposes: locally to keep all records or as a slave to forward to another DNS server. The gate firewall can be used as a DNS server for two purposes: locally to keep all records or as a slave to forward to another DNS server. MaybeMaybe you have another DNS in anotheranother branch or maybeyou want you want to forward them to Google DNS,DNS, so you canconfigure it configure it twoways. From ways. From which interface the detailsdetails willcome to come to you,you, you can configure that interface. So. So don'tworry if worry if you don't know,know, it's okay. okay. And maybe I can ping now because I gavegavethem the them the wrongIP but IP but I willtry to try to execute ping one I think,think, so I giveit to something sorry one dot one dot one,one, so it's pingingone and it will be ping by name as well.well. Idon't know don't know which name I give server one I think,think, so test local local I think II think I need to check,, soI will I will give them this name. name. I give them,them, let me goback to back to whatname.whatname. I give them those DNS entries,entries, okay,okay, so let's see serverone and what is server one? one? Okay,Okay,not a not a test,test, this isa test a test only I gave them,them, solet me let me go back OkayOkay, this is not test control C andlet me let me clear from here,here, so execute ping. What. What is the name? name? Server one des I give them incorrectly, so I need to put them under trashcan one, and who is doing this? Server one des I give them incorrectly, so I need to put them under trashcan one, and who is doing this? If I give anything no, it will notbe assumed that be assumed that if I say six, it will say no. . I don't know six,six, so it's amazing definitely why? why? Because we have configured our 48 forone locally one locally as a DNS to get therecords from records from there,there, now it's not pinging server one. one. If you go there and put six, it willwill look at and say "say "no, unableto reserve to reserve house name." They." They say this DNS server. server. So at least you know the idea ifthis one this one is not fair to you, so please don't minddon't mind, just go through it, not leave it. it. Allow me to return here. Allow me to return here. There is both a DNS forwarder and a conditional forwarder. There is both a DNS forwarder and a conditional forwarder. And there is also thisDNS, where you DNS, where you will also find a forwarder. forwarder. Let me check because I didI didn't configure this one properly. properly. So maybe I will not find itfind it, but let meshow you show you our zone transfer so you can transfer toa specific IP a specific IP andalso a also a conditional forwarder. If. If nothing is found, itit will forward something to another DNS. DNS. Suppose you say eight, okay, so the samething you thing you can do here as well. If. If you want,you can you can forwardto a to a specific DNS and you can configuremany others, many others, I think so, up to eight. eight. This one as well. You. You can configureit to forward it to forward therecord. It record. It is not found here. here. So it will forwardto the to the DNS Forwarder. Forwarder. Yeah, if you have configured DNS in SOSO, itwill be will be a DNS IP, not a system IP DNS entry. entry. Also,Also, you can configure DNS from CLI CLI. We will do this. We will do this in detail later in the course, but for now,let me show you how we can configure this DNS. DNS. One, this onefrom the from the command line. line. So goto the to the command line and say "and say "config system DNS"DNS" and enter. enter. Now you will go to the DNS record. Enter. Enter. So now I mean DNS and set. set. If you don't know anything,just write a just write a question mark.This is completed. This is completed. So I will say "say "set and question mark. Look at it. it. Set primary So yes, I need that one. one. So let me clear the screen. screen. So set primary and set primary. primary. Let me put something else, one, one andset it as set it as secondary. secondary. Let me put thatone down one down as four. four. Four, okay. okay. And thatAnd that means save and click out from here. here. That's it. it. So you can configure DNSfrom the from the command line as well. well. So if I refresh now,you will you will see this will be different. different. Okay, , So let's see here. here. It's 1144 from graphical viewor from command. You or from command. You can change the DNS. Okay, , So this was the story of DNS.

18. Lecture-18:Static,Default,Dynamic and Policy Route Theory.

Today's topic is related to routing. You know, an initial working lab. We have done DNS, which we studied last time,any initial working lab, then we configure the route. So let's go to the route. What is the route? Before going into detail, I need to tell you what routed protocol is. Routed protocol basically means Internet Protocol, which is an international network protocol protocol that sets up rules and regulations. Set up rules and regulations that mean whatever. I'm saying you can understand because we both understand the English language. So this is called a protocol. So when two systems communicate with each other, they have two devices, so they have some protocol which they understand. One of them is Internet protocol, which includes IP four and IPV six. This is what we call a routed protocol. So basically, a routed protocol is like a career that takes your traffic, like email, your file transfer, your web transfer, all this traffic is carried by this protocol,which we call a routed protocol. So basically, this is like a sign-up intersection. It will show you where is the city, how far away is the city,how far away is the hotel, how far away? So, routed protocol is basically what you can say when I take your data from one device to another device. Another protocol is the routing protocol. This is a routed protocol. A routing protocol is basically used to exchange information between two devices and two networks. So then we call it a routing protocol. Routing protocol is like reporting one,reporting two, OSPA, BGP, ISIS, all these come under routing protocol. So you have to configure this routing protocol and it will run the route automatically from one network and will distribute it and share it with the other network. So when they do such things,we call them a routing protocol. But routed protocol means routed protocol is the best for routing protocol. Without routed protocol, routing protocol is not possible. When you go one place, you need something to take you from one location to another location. Okay? So the car, truck, trolley, or whatever, vehicle is like a routed protocol, which carries things from one location to another location, and this thing will travel from one location to another. So every protocol has a different approach. Like Rip will think about minimum hops, OSPF will think about cast, VGP will think about path, and so on. So, other protocols, everybody is thinking differently. Suppose if I have a car and you have a car,and we live together in the same place and we go to the same office, maybe you can go by car and I can go by taxi, maybe we can both go by car, but you approach another way and I'm going to another way. So everybody has different thoughts. So the routing protocol is also thinking differently about how to get to this destination, which we will discuss later. So IP, IP four, IPV six, is your routing protocol, and report one, report two, and OSPF BGP are all your routing protocols if you divide routing. So it's basically three things: staticrouting, default routing, and dynamic routing. By the way, default routing is a subtype of static route, but I can categorise it differently. Okay, then under dynamic has been divided into further categories: interior gateway protocol and exterior gateway protocol. "Interior" means the protocol which is used internally. So this is being divided again into two categories: distance vector routing protocol and length state routing protocol. By the way, there is another one, advanceddistance vector routing protocol, either hybrid routing protocol, or advanceddistance vector routing protocol, but because that has not been supported by FortiGate, EHRP has been open since 2013, but still FortiGate does not support EHRP, so that's why I removed their site. Otherwise, in the interior, we have three categories: distance, vector length, and hybrid. But anyway, here I will focus on the interior gate. We're out of protocol. So it is with our internal protocol. So we are rippingone and repositioning two link states based on the distance vector. We are the OSPF and ISIS files. Here is the only one which is an apath vector protocol, and we call it BGP. So this is the overall map of routing,which has three categories: static, default, and dynamic. dynamic, further divided into interior and exterior. The interior is subdivided further into distance vector and in state. And the exterior is the only one that we know is a PGP. Now, going into more detail, there is connectedroute as well. In every routing table, either isCisco or any firewall, you will see connected route. So, basically, your interfaces with 32, 24, whatever, whatever your interfaces that are directly connected to your firewall, or your device, we call it a connected route. And connected routes are basically the highest priority and also one of the best and most trustworthy routing categories,which we will see a bit later. So this is what we call the connected route. So your interfaces will be connected, which means your connected interfaces will be shown as a connected route on your device. It can be any device. By the way, this concept is similar everywhere; we have a static route. Static routes are those routes which the administrator puts in manually. The next thing we will do is reach that network. It will show you the way. So basically, the static route has no sense. The sense is related to your administrator. The administrator has to decide how the traffic will travel, what the next hole will be, what the next IP will be, and how we will configure. So everything is done manually and when something goes wrong, the administrator has to manually show them another route. Okay, so this will cost them a statically route, but it's been considered easy to configure, highly secure, and requires low resources and low bandwidth, and you can only use them for a small network because the configuration is very difficult for a huge network manually. It's like a headache for the administrator to configure. Suppose you have a huge network of 500 or even 50 routers to configure them.Statically is a headache. If anything goes wrong, you have to go to every individual device to reconfigure it. Suppose one route is not available. But the good thing about the advantages is that they're highly secure and they're called resources because you've already configured them. So it will not change anything dynamically. It will not require a powerful CPU and RAM. So these are the advantages and details you already know, because we study these and three courses you already know. So this is called a "steady crowd" by default. And for the gate, for all administrative distance, the state route is ten and Cisco is one. You remember? Yeah So here you have to keep in mind the administrative. What is administrative distance? We will discuss this a bit later. So this is ten. Okay, Static route Another thing is the default route. Default route What is the default route? This is the last resort. Because if you configure anything in the routing table, and if they do not find any destination route in the routing table,and if you configure it as a default route, all the traffic,whatever it is, will be diverted to the default route. So basically, as a gate, we have a last resort. If nothing is there, it will go to the default route. If nothing was discovered in your 40 gate, firewall, or other device, So the traffic will go the default route, whatever you have configured. Okay? If nothing is found in the routing table, it will be redirected to the default route. And the default route we configure with it, then we give them the next hop. If nothing is found, our two default routes will be read. Then there's dynamic routing, which is diametrically opposed to static routing. You don't need to configure anything manually. If anything goes wrong, anything goes downautomatically, this protocol will switch over to another path if another path is available. So, dynamically, it will maintain every table and detail. Next, everything dynamically Suppose there are two paths available instatically. We have to configure both paths. If one path is done, we have to tear it down and reconfigure it to show them another route. But in dynamics it's not. It will do it automatically. If one path is not available, it will switch over to another one. So this will be called "dynamic routing." Like reports, one report and two SPFBGP and ISR come under dynamic routing. It's due to updates and everything dynamically, but it requires more CPU and RAM. Okay, And more details we already discussed already.So this is a dynamic route coming to an administrative distance. We call them ads as well. What exactly is an advertisement? The value is between one and 255. The value comes between these two digits, one to 255. And administrative distances such as ranking, such as cricket, ranking football, ranking someone. What is Ronaldo? If it is ranked first? So it means he has many goals and many things to do. So that's why he's been in rank one. So administrative distance is also like a ranking of this protocol, okay? And this protocol? It means a directly connected interface has zero ranking. It means one of the best ones, by the way. Starting with zero, we have our connected interfaces, then static one, under ten, and ranking is best. The less you are, the more you are considered the best and most reliable and trustable, so it means the ranking has been taken into account. Darik interfaces have zero more trustable because that is your interfaces, then static route has ten. OSPF is 1110. The IBGP is 200. EBGP means BGP for external internal and Rip is 120. Okay, so these are 115 for ISIS This is the ranking administrative distance, and we will see in the lab that it's very important for the selection process. Suppose you have the same destination. If you configure two protocols, how far will they decide which one they will take? Because they will check the administrative distance, who is trustable more? You're going to trust your brother or you're going to trust me. Definitely, you will trust your brother because he is closer to you than I am. So that's the issue. Protocol will decide by administrative distance. They will say okay. For the same destination, we have configured two protocols going to the same destination, so let me decide which protocol is the best one. So it will check the administrative distance ranking and the less it will trust and be reliable. Now the question is if the administrative business is the same, maybe administrative business Now, I know you trust more in your brother than in me. It's correct, but the question is, if you have two brothers, how will you decide? Because now they have both come near to you, you have to decide on their priority. You will think about which brother, maybe elderbrother. In our culture, the elder brother, whatever they say, is accepted by them rather than the youngest one. And maybe you prefer the youngest one because of their priority. You say no because he is the youngest one. Let me consider him. So if two protocols have the same administrative distance for the same destination, how will the firewall decide? Then they will check the priority, so the lower priority will be preferred. The priority is between zero and this value So it means if zero is better than one, and one is better than two, and two is better than three, the less will be preferred, so if you have administrative distance similar, then it will check the priority. Now you will think that if the priority is the same, The administrative distance is also the same. Yes, Vinette will check the nexthop IP, which cannot be the same. One of them definitely has to be less IP. The less IP, the better for the next job IP. So these are the two things: priority and administrative distance. Priority is just a variable. The lowest value is preferred over the highest value. And administrative distance is also the least preferred one. Okay, now coming to route metric. What is route metric? A metric means the formula, the techniques, the way, the method by which the routing protocol decides the best path. Suppose we are two friends living together and working in the same office, and we both have a car, but in the morning when we are going to office, he adopts another way to go there to office and I'm going to another way to reach office. Why? Because this is just your mind set up and you are thinking, maybe you will say, I will go by what is called a motorway. You may think that the motorway is the best approach to your office, but the other guy is thinking that GT road is better than the motorway. There will be some traffic, but I will reach it quickly. So this different thinking, everybody's thinking differently about the same thing. So the same protocol is also thinking differently. And this thing we call a route metric, as the administrator decided it can do whatever the administrator decided to go on this way. It will reach on that way if you decide tomorrow no. This one is the best one. So it's a demi thing. Everything is decided by administrators stating we are all connected, with no need for anything. Now coming to OSPF, OSPF is using cost as a basis. Cost is nothing but a bandwidth basis. There is a reference bandwidth and it is divided by bandwidth. So we call them a "cost rate" using hop count. Hop count means assuming it will count how many routers.

ExamSnap's Fortinet NSE4_FGT-6.4 Practice Test Questions and Exam Dumps, study guide, and video training course are complicated in premium bundle. The Exam Updated are monitored by Industry Leading IT Trainers with over 15 years of experience, Fortinet NSE4_FGT-6.4 Exam Dumps and Practice Test Questions cover all the Exam Objectives to make sure you pass your exam easily.