CloudLabBox
Try the free demo

Firewalls and VPNs lab 12 of 16

One policy four firewalls - ASA FortiGate PAN-OS and SRX

Write one three-zone security policy (inside, DMZ, outside) in four dialects: ASA security levels and interface access lists, FortiGate interface-pair policies, PAN-OS zone rules with App-ID, and SRX zone-pair policies. One test router, with a VRF on every zone, proves each rule from the outside.

Run this lab

It needs Standard: its 5 nodes are set to 7 vCPU and 14,336 MB in total.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 12 - One policy four firewalls - ASA FortiGate PAN-OS and SRX

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 7 vCPU and 14,336 MB together. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 120 minutes
Nodes need
7 vCPU, 14,336 MB
Smallest plan
Standard

The scenario

Morwenna Group runs four firewall brands after a string of acquisitions, and the auditors want one security standard on all of them. Each firewall has the same three zones, and TESTER plays every host: one interface, in its own VRF, on every zone of every firewall. Write the standard on all four and prove it from TESTER.

ZoneASA (k=1)FortiGate (k=2)PAN-OS (k=3)SRX (k=4)
inside 10.k.1.0/24Gi0/0 inside (100)port1ethernet1/1 zone insidege-0/0/0 zone inside
DMZ 10.k.2.0/24 (server .10)Gi0/1 dmz (50)port2ethernet1/2 zone dmzge-0/0/1 zone dmz
outside 10.k.3.0/24Gi0/2 outside (0)port3ethernet1/3 zone outsidege-0/0/2 zone outside

The standard (the DMZ server is 10.k.2.10, and its service is telnet, TCP 23, standing in for a web application):

#FromToAllow
S1insideDMZping and telnet
S2insideoutsideanything
S3outsideDMZ servertelnet only
S4DMZoutsideping only
S5everything else (outside to inside, DMZ to inside)nothing

TESTER's telnet server accepts the connection and then closes it with "Password required, but none set": that message proves the firewall let the connection through.

What you’ll practise

  • Translate a written policy into each vendor's model: security levels and ACLs, interface pairs, zone rules, zone pairs
  • Know each vendor's default: what passes before you write a rule
  • Use App-ID applications on PAN-OS and predefined applications on the SRX
  • Test allowed and denied flows the same way on every firewall
  • Read each vendor's hit counters to prove which rule matched

The tasks

  1. Learn the defaults
  2. ASA: security levels plus access lists
  3. FortiGate: one policy per interface pair
  4. PAN-OS: zone rules with applications
  5. SRX: zone-pair policies
  6. Prove the standard

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of One policy four firewalls - ASA FortiGate PAN-OS and SRX5 nodes, 12 links. Every link is listed as text below the diagram.TESTERA-FWF-FWP-FWS-FWGi0/3port1Gi0/4port2Gi0/5port3Gi0/6ethernet1/1Gi0/7ethernet1/2Gi0/8ethernet1/3Gi0/0Gi0/0Gi0/1Gi0/1Gi0/2Gi0/2Gi0/9ge-0/0/0Gi0/10ge-0/0/1Gi0/11ge-0/0/2
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • TESTER Gi0/0 to A-FW Gi0/0
  • TESTER Gi0/1 to A-FW Gi0/1
  • TESTER Gi0/2 to A-FW Gi0/2
  • TESTER Gi0/3 to F-FW port1
  • TESTER Gi0/4 to F-FW port2
  • TESTER Gi0/5 to F-FW port3
  • TESTER Gi0/6 to P-FW ethernet1/1
  • TESTER Gi0/7 to P-FW ethernet1/2
  • TESTER Gi0/8 to P-FW ethernet1/3
  • TESTER Gi0/9 to S-FW ge-0/0/0
  • TESTER Gi0/10 to S-FW ge-0/0/1
  • TESTER Gi0/11 to S-FW ge-0/0/2
Nodes in One policy four firewalls - ASA FortiGate PAN-OS and SRX, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
TESTERCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
A-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
F-FWFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
P-FWPalo Alto Networks VM-Series (PAN-OS)paloalto-11.2.52 vCPU, 5,632 MB
S-FWJuniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 12 - One policy four firewalls - ASA FortiGate PAN-OS and SRX and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.