7.1 Ent

Deliverable 1

fw01 commands backup

set firewall name DMZ-to-LAN default-action 'drop'

set firewall name DMZ-to-LAN enable-default-log

set firewall name DMZ-to-LAN rule 1 action 'accept'

set firewall name DMZ-to-LAN rule 1 state established 'enable'

set firewall name DMZ-to-LAN rule 10 action 'accept'

set firewall name DMZ-to-LAN rule 10 description 'wazuh agent comm with wazuh server'

set firewall name DMZ-to-LAN rule 10 destination address '172.16.200.10'

set firewall name DMZ-to-LAN rule 10 destination port '1514,1515'

set firewall name DMZ-to-LAN rule 10 protocol 'tcp'

set firewall name DMZ-to-WAN default-action 'drop'

set firewall name DMZ-to-WAN enable-default-log

set firewall name DMZ-to-WAN rule 1 action 'accept'

set firewall name DMZ-to-WAN rule 1 state established 'enable'

set firewall name LAN-to-DMZ default-action 'drop'

set firewall name LAN-to-DMZ enable-default-log

set firewall name LAN-to-DMZ rule 1 action 'accept'

set firewall name LAN-to-DMZ rule 1 state established 'enable'

set firewall name LAN-to-DMZ rule 2 action 'accept'

set firewall name LAN-to-DMZ rule 2 destination address '172.16.50.3'

set firewall name LAN-to-DMZ rule 2 destination port '80'

set firewall name LAN-to-DMZ rule 2 protocol 'tcp'

set firewall name LAN-to-DMZ rule 3 action 'accept'

set firewall name LAN-to-DMZ rule 3 destination port '22'

set firewall name LAN-to-DMZ rule 3 protocol 'tcp'

set firewall name LAN-to-DMZ rule 3 source address '172.16.150.10'

set firewall name LAN-to-WAN default-action 'drop'

set firewall name LAN-to-WAN enable-default-log

set firewall name LAN-to-WAN rule 1 action 'accept'

set firewall name WAN-to-DMZ default-action 'drop'

set firewall name WAN-to-DMZ enable-default-log

set firewall name WAN-to-DMZ rule 10 action 'accept'

set firewall name WAN-to-DMZ rule 10 description 'Allow HTTP from WAN to DMZ'

set firewall name WAN-to-DMZ rule 10 destination address '172.16.50.3'

set firewall name WAN-to-DMZ rule 10 destination port '80'

set firewall name WAN-to-DMZ rule 10 protocol 'tcp'

set firewall name WAN-to-LAN default-action 'drop'

set firewall name WAN-to-LAN enable-default-log

set firewall name WAN-to-LAN rule 1 action 'accept'

set firewall name WAN-to-LAN rule 1 state established 'enable'

set interfaces ethernet eth0 address '[10.0.17.124/24](http://10.0.17.124/24)'

set interfaces ethernet eth0 description 'WAN'

set interfaces ethernet eth1 address '[172.16.50.2/29](http://172.16.50.2/29)'

set interfaces ethernet eth1 description 'DMZ'

set interfaces ethernet eth2 address '[172.16.150.2/24](http://172.16.150.2/24)'

set interfaces ethernet eth2 description 'LAN'

set nat source rule 10 description 'NAT FROM DMZ to WAN'

set nat source rule 10 outbound-interface 'eth0'

set nat source rule 10 source address '[172.16.50.0/29](http://172.16.50.0/29)'

set nat source rule 10 translation address 'masquerade'

set nat source rule 11 description 'NAT FROM LAN to WAN'

set nat source rule 11 outbound-interface 'eth0'

set nat source rule 11 source address '[172.16.150.0/24](http://172.16.150.0/24)'

set nat source rule 11 translation address 'masquerade'

set nat source rule 30 description 'NAT FROM MGMT to WAN'

set nat source rule 30 outbound-interface 'eth0'

set nat source rule 30 source address '[172.16.200.0/28](http://172.16.200.0/28)'

set nat source rule 30 translation address 'masquerade'

set protocols rip interface eth2

set protocols rip network '[172.16.50.0/29](http://172.16.50.0/29)'

set protocols static route [0.0.0.0/0](http://0.0.0.0/0) next-hop 10.0.17.2

set service dns forwarding allow-from '[172.16.50.0/29](http://172.16.50.0/29)'

set service dns forwarding allow-from '[172.16.150.0/24](http://172.16.150.0/24)'

set service dns forwarding listen-address '172.16.50.2'

set service dns forwarding listen-address '172.16.150.2'

set service dns forwarding system

set service ssh listen-address '0.0.0.0'

set system host-name 'fw01'

set system name-server '10.0.17.2'

set zone-policy zone DMZ from LAN firewall name 'LAN-to-DMZ'

set zone-policy zone DMZ from WAN firewall name 'WAN-to-DMZ'

set zone-policy zone DMZ interface 'eth1'

set zone-policy zone LAN from DMZ firewall name 'DMZ-to-LAN'

set zone-policy zone LAN from WAN firewall name 'WAN-to-LAN'

set zone-policy zone LAN interface 'eth2'

set zone-policy zone WAN from DMZ firewall name 'DMZ-to-WAN'

set zone-policy zone WAN from LAN firewall name 'LAN-to-WAN'

set zone-policy zone WAN interface 'eth0'

---

Edge01 Network Adapter Settings:

DHCP01 Network Adapter Settings:

ngix01 Network Adapter Settings:

Traveler Network Adapter Settings:

---

Changed Nginx hostname

Changed DHCP hostname

Changed edge01 hostname

commit save was run after changing hostname on VyOS

Changed traveler hostname

---

Added sudo user to DHCP

Added sudo user to Nginx

Added Administrative user to traveler

Added sudo user to edge

vyos@vyos-rtr:~$ configure

vyos@vyos-rtr# set system login user jsmith full-name "John Smith"

vyos@vyos-rtr# set system login user jsmith authentication plaintext-password examplepassword

vyos@vyos-rtr# set system login user jsmith level admin

vyos@vyos-rtr# commit

vyos@vyos-rtr# save

---

Set edge01 IP addresses

Set DHCP IP address

Set nginx IP address

---

Deliverable 2

---

Deliverable 3: