Configuration of DHCP on an ASA Firewall - Part FOUR

[@SLonxxxx]

making it all sound easy and straightforward Greg. Well done for these videos.

[@GregSouth]

Hi @SCMcDonLon - lot of config in ASA setup - hope you managed to get your's working too if you were configuring aswell. All the very best. Greg

[@SanaRahman-ss3uz]

Without a shadow of a doubt, The most concise, clear, and understandable youtube tutorial. You covered very complex aspects and made it look like a walk in the park. Thank you so much Greg! sudo apt-install Greatness

[@GregSouth]

Hi @user-xe5hr5sr2f - Wow, thank you! Glad you found them useful! Thanks for the feedback. Greg

[@davidkuder1294]

This is the best ASA firewall tutorial set I've seen yet. I've searched a lot online for courses like this and you have done the best job at putting all the concepts together. You are a great teacher and this has been very valuable!

[@GregSouth]

Thanks for your words of encouragement David!

[@HiRow369]

Thanks for this wonderful tutorial would like to see more newer videos.

[@GregSouth]

Thanks for the feedback and hoping to make some more videos over the summer

[@michaelgodwin7702]

Okay so, we needed an ACL for outside access to dmz, but it wasn't necessary to ping out of our inside subnet due to our policy-map that checked outgoing ports and allowed response traffic only. Obviously to ping an external network from vlan3 we would be able to without an acl. Fun fun stuff. Thank you greg!

[@GregSouth]

Your welcome 👍

[@SD-mc6gf]

Excellent videos thank you Greg. Just a useful note for people Cisco have now changed the syntax for ASA software versions 8.3 and above so now when configuring an ACL you need to use the NAT address rather than the private address as it wont work correctly🙂

[@GregSouth]

Thanks for feedback- I haven’t tested this with software version 8.3 - much appreciated 👍

[@sumanthreddykarri]

Hey Buddy! Thanks for these awesome videos. They are really helpful!!

[@GregSouth]

Glad you like them!

[@richardmakiya7188]

Excelente video tutorial. Es más claro y limpio que he podido encontrar.

[@camerontape8052]

Hey my man, these have been super helpful for me trying to work through a college assignment. First source I could find that seemed like it's intended audience was humans! Appreciate having the videos broken down into smaller topics instead of one monster video. Would be even better if there were timestamps in the videos to help find specific sections faster.

[@GregSouth]

Thanks for the feedback Cameron - will definitely look into timestamps in the future

[@SergioPorras1963]

Thank you so much Greg! very useful all 4 videos

[@GregSouth]

Glad you like them and thanks for your feedback!

[@asiedudesmond5590]

Thank you Greg, best firewall tutorial ever

[@GregSouth]

Thanks for your feedback @Asiedu Desmond

[@nesrinebelkadi7702]

you save my life teacher , thank you a lot !

[@samiulislamponik1534]

Thanks a lot greg. Beautifully explained.

[@GregSouth]

Thanks Samiul! Glad it helped

[@mr.roulette7537]

Thank you teacher. Appreciate your teaching.

[@GregSouth]

Thanks for watching! Glad it helped @Mr.roulette

[@mr.roulette7537]

@@GregSouth it did help me sir

[@gulyass6385]

Thank you so much Greg. The best ASA firewall. Great.

[@GregSouth]

Thanks Gul. Glad it helped.

[@doggy007ooo]

this was a great playlist. Thanks sir.

[@GregSouth]

Glad you liked it Mohor! Thanks for viewing-Greg

[@phantomxiang]

I have a question. Why we still need the access-list to make ICMP traffic pass? Haven't we already enabled it via policy map?

[@GregSouth]

Hi there, on the ASA, we first create a class map to identify traffic, policy maps to identify actions you are going to take on the traffic and service polices are needed to implement the policy. In our case, we wish to allow ICMP (ping requests) traffic to travel from inside zone to outside zone and then also to allow legitimate icmp traffic to return back - in our case ping replies. Also, important to note we are also going from a higher security level 100 (inside zone) to lower security level 0 (outside zone) . Then later in the exercise (in this video), we create an additional access list to allow traffic from outside to travel to the DMZ zone to one specific server host only. Note: this traffic goes from security level 100 (outside zone) to security level 70 (dmz zone). So initial traffic to dmz server, from the untrusted Ineernet is not allowed by default and this is why we need the additional ACL. So in summary, we are doing two different access control changes. I hope this helps, Greg

[@ziadrassmi]

thank you so much for the explanation, it did really help, a great tutorial!

[@sergeattia2866]

Many Thanks for this lab Regards

[@GregSouth]

Thanks for watching/ listening

[@khadijabou4821]

thank you so much for your work it does really work for me, thanks a lot

[@GregSouth]

You're welcome! Thanks for the feedback @KhaDija BOU

[@calvinfourieza]

Hi, at 3:30 in the video you mention that due to license limitations you can't channel traffic from the dmz to vlan 1. What in licencing is stopping this from working/being implemented?

[@GregSouth]

Hi Calvin, if you configure interface vlan 3, ip address 192.168.2.1 255.255.255.0 and then don't add in no forward interface vlan 1, you will be met by the following error "ERROR: This license does not allow configuring more than 2 interfaces with nameif and without a "no forward" command on this interface or on 1 interface(s) with nameif already configured." Best regards, Greg

[@nasarjavid2308]

Great video I would like to know how can I configure cloud security.

[@GregSouth]

Hi Nasar, I have some videos on AWS and you could check these out as you may find these helpful. Thanks, Greg

[@nasarjavid2308]

@@GregSouth thanks for that Greg your videos are really helpful. Could you provide me with a link to your AWS videos thanks

[@ahmed00777]

Thank you Greg :)

[@GregSouth]

My pleasure Ahmed! Glad it was useful, Thanks, Greg

[@RavindranPillay-nc8el]

Wow so C😎😎L thank you

[@GregSouth]

Welcome 😊

[@juancamilomedinagarzon1375]

hey friend could you help me with my topology it is not working I am doing the same as yours.

[@GregSouth]

Hi Juan, what version of Packet Tracer are you using? These exercises were developed and tested on version 7.3. Thanks Greg

[@elluelelf3358]

which port is the 209.165.200.227 at? or what is it for?

[@GregSouth]

Hi @Elluel Elf, The 209.165.200.227 is a public IPv4 address (that’s chosen in this simulation). This would typically be provided to an organisation from an ISP. It allows for a PC/device on the outside network e.g. the Internet to access an internal server that is located in our case in our DMZ network. In simple terms, it allows people using devices to access our web server from the Internet.

[@elluelelf3358]

@@GregSouth I see, I've understood now. Thanks for the explanation!

[@_MohammadRiajUddin]

How can we access DMZ server from Inside??

[@GregSouth]

Hi Mohammad, if you would like to access the DMZ Web Server from inside host e.g PC-B - add the inspection of HTTP traffic to the policy map and then open a browser in PC-B and put in the IP address of 192.168.2.3 and this should display web server home page. (I walk through how to setup ICMP traffic in the video - it is just one additional statement (inspect http) and this will then work. I hope this helps, Greg

[@jean-lucpicard5510]

Part 5?

[@GregSouth]

Hi Jean! Squeezed it into four videos

[@sachinthakabandara8504]

where is the part 5?

[@GregSouth]

Hi Sacinthaka, I squeezed it down to four videos so that was actually the last one! Hope these helped. Thanks, Greg

[@sachinthakabandara8504]

@@GregSouth yes, i didnt see thanks for this videos

[@bbs8769]

Greg, u r the best mate, well done

[@GregSouth]

Thanks Adam - glad you liked video