This demonstration covers creating zones, interfaces, and network policies.
Zones are a convenient model for configuring and managing enforcement on
the firewall. The default zones include: LAN, WAN, DMZ, VPN, and Wi-Fi. By default
the XG firewall blocks traffic in between zones, until we create explicit
policies that are applied to allow desired traffic. Let's take a look at an
example scenario where an administrator may need to add or configure an
interface. In this example the administrator has been asked to allow
contractors working in the building to connect to an interface which allows for
Internet connectivity. Let's take a look at how to do this on the XG firewall.
Creating a zone is relatively simple. Navigate to network and zones, and then
we'll go ahead and click Add.
We'll give it a name, we'll designate it as either LAN or DMZ type zone, and we'll
specify which services we want to allow from this zone, and once we're satisfied
we'll go ahead and click Save.
Now let's create a firewall rule to allow traffic in between the new zone
and the LAN. We'll start off by clicking firewall on the menu we'll go ahead and
click add firewall rule in the top right, and we'll select user or network role.
Let's go ahead and give the rule a name. We'll select contractors as the source
zone, and then we'll go ahead and set WAN as the destination zone. We'll
deselect match known users and we'll go ahead and select scan HTTP, as well as
Sandstorm.
Here we can go ahead and select any security policies that we want to apply,
and once we're satisfied we'll go ahead and click Save.
Our firewall rule has now been created. Next we'll navigate to network and
interfaces on the menu.
Interfaces are a fundamental networking element on the firewall. They include
both our physical interfaces, as well as bridges, link aggregation, integrated
Wi-Fi networks, RED devices, and other types of network interfaces. Note that by
default port 1 should be LAN, and port 2 should be WAN. The existing configured
ports show us their connection status and IP ranges. Let's go ahead and click
port 3 to configure it. First, we'll specify a zone for the interface, and in
this case we'll select contractors.
Next we'll enter in an IP address and netmask, and we'll go ahead
and click Save. On the confirmation prompt that appears, we'll go ahead and
hit update interface. Next we'll go ahead and bridge two ports together, and to do
this we'll click add interface, and bridge. Let's go ahead and call this MyBridge.
Let's select ports 4 and 5 as the
two ports that we want to bridge together. Both of them are located in the
LAN zone. Let's give the Bridgeport an IP address and netmask. Once that's all
completed, we'll go ahead and click Save. On the confirmation prompt that appears
we'll go ahead and click Add bridge.
Lastly, we would be required to go back to the firewall rules, and create a
firewall rule that allows traffic in between the true bridge zones.
in this demonstration we created a new zone, we configured an interface, we added
a new bridge interface, and we created firewall rules to allow the new zone to
access the WAN, as well as to allow the bridge zones to communicate.