Bootstrap a New Firewall

0:00Hello and welcome. My name is Keith Barker, and it's a pretty common fact that

0:04most people know

0:05that if we have a firewall, like a Fortigate firewall that's properly

0:07configured and in our network,

0:09that goes a long, long way towards improving our security on that network.

0:13However, it's also

0:14pretty common. Now is it if we get a brand new firewall and we never take it

0:18out of the box,

0:19or if it's a virtual machine, we never deploy in our network, those firewalls

0:23are not doing too

0:23much to help. So to that end of getting a firewall deployed and put into our

0:27network,

0:28in this set of videos, I like to walk you through the bootstrap process for a

0:32brand new firewall,

0:33which will involve wiping the config and then walking through each and every

0:37step of getting

0:38that firewall placed in our network and setting up what's known as the

0:41management plane so you and

0:43I can connect to that firewall for further configuration.

0:00In this video, we're going to take a big picture look at what we intend to

0:02accomplish in this set of videos.

0:04And I just want to talk about a few prerequisites that are presumed as part of

0:09this course.

0:09So as far as the prerequisites go, there are a few topics that are presumed to

0:14be known

0:14by an individual like yourself who is taking this course. One of those items

0:18would be an understanding

0:19of the TCPIP protocol stack or protocol suite or the IP suite, whatever you

0:23want to call it,

0:24regarding IPV4 and IPV6, at least the basics of how IP addressing works. So if

0:30the IP protocol

0:31and IP addressing is a brand new topic, you've never seen it or taken a look at

0:34it before, I would

0:35encourage you to make a note and take a peek at some other associated or entry

0:39level courses

0:40regarding those fundamentals. Another topic you should already be basically

0:43familiar with is the

0:44concept of a virtual local area network or as its friends call it, AVLAN, which

0:49is a layer

0:50two broadcast domain. And most of the time we have one VLAN, which is a layer

0:54two construct,

0:55we're also going to normally associate with that VLAN, a single IP subnet or IP

0:59network. So VLANs

1:01are there too. And the actual IP addressing involved is layer three. And

1:04normally this is a one-to-one

1:06correlation. So if we have a layer two VLAN, that's called VLAN 10, for example

1:10, it's also very

1:11common. We'd have a subnet such as 10 dot 10 dot zero dot zero, they slash 24-

1:15bit mask associated

1:17and being used in that VLAN. Again, this is layer two, this is layer three. It

1:21's also presumed at

1:23this level of training at the professional level that you have a basic

1:26understanding of how a firewall

1:28operates and more specifically how a 48 firewall operates. So in this topology,

1:33I have four firewalls,

1:35I got one here and here, one here and one here. And as I mentioned, it's

1:38already presumed that

1:39you have a basic understanding of what a firewall does and how it operates. And

1:43once again, if you

1:44don't yet have that knowledge regarding any firewalls or a 48 firewall, there

1:48is other more entry level

1:50courses you can take to help provide that basic understanding of what the

1:52firewall does. So now

1:54that housekeeping is out of the way, let me clear off the screen here and let's

1:56chat about what

1:57we're going to accomplish in this set of videos. Number one, I want to do a

2:01factory reset on the

2:02firewalls. We'll start off with this one right here. This is going to be our

2:04headquarters firewall

2:05one. Let's imagine this is our headquarters site right here. And we're going to

2:08take this firewall

2:09right here and just do a factory reset. Now, there are several different

2:13options for a factory

2:14reset. And one of those will simply wipe out the entire configuration. Now,

2:17even if we do a factory

2:18reset, if this firewall has already been registered with Fortinet and has an

2:23active license, the license

2:24will still remain, even though the entire configuration based on the factory

2:28reset we do,

2:28will be wiped out. And I want to walk through that with you because I want to

2:32take this firewall

2:32and walk you through every single step involved in getting this up and put on

2:36the network so we

2:37can manage and work with it. So as far as getting the management working, we're

2:40going to set up

2:41the management plane. And a good question might be, well, what exactly is the

2:44management plane key?

2:45And that's a good question. So let's imagine we have this firewall right here

2:48already configured.

2:49And let's also imagine we have this little PC right here that's connected to

2:53this network.

2:54So on a good day, when this user is going up to the internet, for example, so

2:58they forward traffic

2:59to their default gateway, which this case would be our firewall, which would

3:02then route it out to

3:03an internet service provider like ISP or ISPB. And that would lead out to, for

3:07example, the rest of

3:08the internet, let's say this client right here is going to server one. So

3:12behind the scenes,

3:13this client makes a DNS request to resolve the IP address behind server one,

3:17then forwards the

3:18packet to the firewall, who then makes a routing decision, forwards it to the

3:21ISP, who then forwards

3:22it in the direction of that server, is how it finally reaches that server. Well

3:25, that flow of traffic

3:26from this user going up to that server, that's referred to as the data plane.

3:31So think of the data

3:32plane as the user data plane, we're carrying user traffic, basically normal

3:37functionality for

3:38a network from a client, out to a server, and the return path. And that is the

3:41data plane. However,

3:42when we manage a firewall, for example, if you and I are sitting, let's put

3:47another computer out here,

3:48I'll straw one right here, and let's say this is our management PC, and you and

3:52I want to connect

3:53to a firewall for the purpose of managing that device, that concept, that idea

3:57of us connecting

3:58to this firewall for the benefit of managing it, we are using the management

4:02plane. So we could be

4:03using the same exact networks involved for the data plane, for example, over

4:07this 10.120 network

4:09for the data plane, as well as the management plane. And the reason I mentioned

4:12the management

4:13plane is because in this set of videos, that's what we want to get to, we want

4:15to make sure we have

4:16this firewall, where you and I can sit at a device on the network, and remotely

4:21connect to it via

4:22IP, and that connectivity once again would be logically over the management

4:25plane. So we need

4:26the management plane up and running an active. So for this firewall right here,

4:29which is going to

4:30be called HQ firewall one once we configure it, we're going to have our

4:33management plane address

4:34on this firewall of 192 168 dot one dot, and let's use 51. So every IP address

4:41we configure on this

4:43firewall is going to end in dot 51 based on this design here. So this firewall

4:47right here has a

4:48dedicated port, it actually is labeled mgmt. And what we can do is take that

4:52interface that port

4:54and assign it the IP address 181.51. And then that allows you and I to connect

4:59to that

5:00management plane IP address for management of that box. So we can connect via

5:04HTTPS, or we can connect

5:05via SH or another protocol, if we allow it, I'll walk you through that as well

5:09as part of the bootstrap

5:10process. So we want to verify we can get to the address via the command line

5:14interface or CLI,

5:15as well as through a browser interface, which is known and loved as a graphical

5:19user interface,

5:20or interacting with and managing the firewall. So we want to make sure they

5:23both work as part of

5:24the management plane access to this device. Now there's one other wrinkle. And

5:28that is this,

5:28if we assign this IP address 181.51 to the management interface on this

5:33firewall, the firewall is not

5:35going to know by default, how to route out to the internet. And the reason that

5:39's important is because

5:41as far as setting up the licensing and registering this firewall and getting it

5:45activated, it needs

5:46to talk to the Fortinet servers in the cloud. So that also is going to involve

5:50setting up a

5:51default route. So a default route, I call it the Obi-Wan Kenobi route. And it

5:55basically goes like this,

5:56this firewall, which is routing packets, then forwarding packets based on the

6:00policy, as it

6:01makes its routing decisions, as it looks at its routing table, if there isn't a

6:05more exact match

6:06based on the destinations IP address we're trying to go to, it'll fall back and

6:10use the default route

6:11as a last ditch effort. So like, help us Obi-Wan, you're our only hope or

6:14something similar to that.

6:16So here on the internet in my lab environment here, I have two service

6:20providers,

6:20ISP A and ISP B, and the IP address of the service providers, it can be .1 for

6:26each of those. So off

6:27of the WAN one interface and WAN two interfaces, it wants to be the firewall

6:31all set up, including

6:32the data plane. So it has the ability to route and forward traffic for users.

6:36And we'll do that part

6:37in the next set of videos. We'll also need to set up default routes. So this

6:40firewall knows how

6:41to forward traffic in the correct direction. However, until we get the data

6:44plane up and running,

6:45we also need a default route for the management plane. And that's so this

6:49firewall, even without

6:51its data plane interface is set up and running, we can still have this firewall

6:55connect out to the

6:55cloud. So in my topology here, the management network is 192.168.1 with a 24

7:01bit mask and the

7:02management IP address, as we just discussed a few moments ago, is going to be

7:05192.168.1.51.

7:07So I'll put .51 is the last octet there. And the default route that we want to

7:12set up that allows

7:13this firewall from its management interface to connect up to the internet. In

7:17my topology,

7:18that default route is at .1 on the 192.168.1 network. So as we set up the

7:23actual management

7:23plane, so we can manage this device. We're also considered a default route that

7:26says the next top

7:28is 192.168.1.1. So that device there, 192.168.1.1 is doing that or pat

7:34effectively address translation

7:36to allow the traffic from this firewall to go out to the internet. So as we

7:40clean up our objectives

7:41here, our objectives are simple. And that's this. We want to do the factory

7:44reset. We want to set

7:46the management interface with this IP address, verify we can reach it from the

7:50CLI with SSH, for

7:51example, as well as with the browser using HTTPS and then set up a default

7:55route so that this

7:56firewall via its management interface has the ability to reach out to the cloud

8:00. So with that in

8:01mind, join me in the next video as we take a look at what the physical hardware

8:06looks like for

8:06this firewall, which we will be calling HQ-FW1. And then we'll proceed to do a

8:11factory reset

8:12and continue down the list. So when you're ready, I'll see my friend in the

8:16very next video.

0:00So our first step is to perform a factory reset.

0:02Now this step would not be required if we just open up the firewall from its

0:06box and placed in our rack.

0:08However, because I have done some initial configuration here on this firewall,

0:11I want to do a factory reset so you can see what it looks like from square one.

0:14Also, before we do the factory reset, let me give you a physical look at what

0:18this firewall actually looks like.

0:20So for that, let's use the datasheet for this firewall.

0:23This is a 4 to 8 100 F series.

0:26So I've got one of these bad boys which can do all the bells and whistles and

0:29all the features,

0:30has the licensing ready to go.

0:31And I also have some smaller firewalls like 60 apps that we'll be using as we

0:35proceed through this course together

0:37to build our full-blown network.

0:38Also, let me show you the actual interfaces and ports we're using initially

0:42for the initial bootstrap and initial management plan configuration on this

0:46firewall.

0:47So here's the initial ports we're going to be using as we set up the management

0:50plan.

0:50There is a literal interface here called MGMT on this model.

0:55Now other models may not have a dedicated port.

0:57We can just allocate another interface and use it for that.

1:00But here we have a dedicated interface that we can use for management access.

1:04And as I mentioned, it is literally called MGMT for management.

1:08Now the other port that we're going to be using in the initial bootstrap here

1:11is this port right here, the console port.

1:13So for my management PC, I have a literal console cable that goes from a USB

1:18port here to that console port.

1:20And then we can use a terminal emulator like Secure CRT or Putty or something

1:25similar to that to interact with the command line interface for the Fortigate.

1:28And one of the benefits of having that console access is that if we wipe out

1:33the entire configuration, for example, of existing IP addresses and everything

1:36else is there,

1:37we're still going to have access to that console port via that serial cable

1:40connecting us over there.

1:42So one of the key points here is you'd want to, on your model of firewall,

1:45identify what the default speed is.

1:47For example, is it 9600 bits per second because that's what we want to set the

1:51terminal emulator for on the serial port.

1:53Another single Fortnet firewall, aka the Fortigate Firewalls, are going to have

1:58the exact same speed by default.

1:59So look at the documentation for the model you have and then use that

2:02appropriate speed set up for your terminal emulation on your serial port or on

2:06modern computers on your USB.

2:07So as far as the physical connections, including the console cable there, let

2:11me draw those out.

2:13So behind the scenes, I have a multi-layer switch and for our purposes here, we

2:18're just going to go ahead and use layer two forwarding.

2:20So this is our switch and I'll put a few ports on this switch here, then I'll

2:24draw our management computer right here.

2:26So there's our management PC that you and I are sitting at and I'm going to

2:29connect us to one of the ports.

2:30So that is a port on VLAN 1 and that is going to be my management network.

2:34So my management PC is connected to one of these ports and this port is

2:37assigned to VLAN number one.

2:39So I'm going to color code that as pink, which is VLAN number one and then

2:43associate with VLAN number one in my lab network is also the IP network of 182.

2:48168.1.0 with a 24-bit mask and that is my management network.

2:53So this management PC has the IP address I think of .2 or something else inside

2:57that IP address range and it's in VLAN 1, the management network.

3:00Let's say we have a few more ports that are also in VLAN 1.

3:02I'll go ahead and label those as VLAN 1 and VLAN 1 and VLAN 1.

3:06So we'd also want to take this management port right here and connect a patch

3:10cable from this port, the management port and connect it with the patch cable

3:14over to a port on the switch, which is also in VLAN 1.

3:16That way the management PC is on the 192.168.1 network and after we configure

3:20this management interface, it'll also be on that 192.168.1 network.

3:24And for its IP address, we decide we're going to use .51 for the management

3:28plane of this 48 firewall.

3:30And over here, it's showing the 100F series, this is showing a 101F. I think

3:34the model I have is literally a 100F.

3:37But in either case, these port layouts are the same.

3:39And as I mentioned before, for my management PC, I've got a console cable that

3:43goes directly to the console port here on the 100F.

3:47So if we lose all IP connectivity, I'll still be able to access this firewall

3:50via the console port.

3:52And then once we have everything set up, we're able to manage this firewall.

3:55In a second set of videos, we'll walk through setting up the data plane, which

3:59will involve physically connecting

4:00the ports for WAN1 and WAN2 to the service provider networks.

4:03So that'll be WAN1 and WAN2.

4:05As well as based on our topology, we're also using port 4 here for connectivity

4:09within our network.

4:10But we'll save those ports and their configuration and the connecting to the

4:13network.

4:13We'll save those for a second set of videos.

4:16Because now we're focused on just the initial bootstrap and initial

4:19configuration of getting this firewall in the network and being able to manage

4:23it via IP.

4:24So from this management PC, once it's all set up for managing this firewall, we

4:28could use SSH with a terminal emulator,

4:30or we could use HTTPS with a browser for interacting with and working with this

4:35firewall.

4:35So now that we've seen the physical interfaces and the ports here, I've already

4:39placed this physical firewall in my rack behind me.

4:42And I've already made the connections to the console port here and also for the

4:45management port connected to WAN1 on my local switch here in my lab.

4:50So with that in mind, let's go ahead and do our factory reset of this Fortigate

4:55firewall.

4:56And do that relaxes the connectivity I have from my management PC or the

4:59console port.

5:00In that way, we don't even have to worry about what current IP addresses are

5:03there.

5:03We'll just use the console connection and we'll tell it to do a factory reset

5:07on the firewall via that console port.

5:09So without further ado, let's head over to my terminal emulator.

5:12Let's confirm we have connectivity there via the console port and then we'll

5:16give it a fresh clean reset.

5:17So here I'm going to be using secure CRT as my preferred terminal emulator of

5:21choice.

5:21And I've got two entries regarding console access.

5:24They're both serial ones at 9600 bits per second.

5:27The other is 115,200 bits per second.

5:30And for this firewall, the default is 9600.

5:33So I'm going to go ahead and double click on that.

5:34That's going out my com three port logically on my computer.

5:37I'll press enter and boom.

5:39There we have it.

5:40So I currently configure this firewall in doing some testing and initial setup.

5:44So I'm going to go ahead and log in as admin and I'll supply the password I set

5:48earlier.

5:48So that we're logged in.

5:49We're going to execute a factory reset.

5:51So we used literally the command execute space and it will type in FA and a

5:55question mark and we have a few options here,

5:58including this option right here, which is resetting everything to their

6:00factory default and do it right now.

6:02There's also options of keeping some basic information such as management IP

6:05addresses and so forth.

6:06But what we want to do is a complete wipe.

6:09So go ahead and use that option factory reset a space.

6:12I'll press enter and it's asking me, are you sure and I'm going to hit Y for

6:16yes and it is on its way to a complete factory reset.

6:20So while it does that, let's also chat about some of the defaults that are

6:24going to happen when this thing comes back up.

6:26So on this platform, the management port is going to have a statically assigned

6:30IP address of 192.168.1.99.

6:35Now the reason that's important to know is that if you're bringing this up on a

6:39network and you have a device at 99,

6:41that's going to be a challenge. That'd be a duplicate IP address.

6:43So one option could be taking our PC and specifying that our network interface

6:47card,

6:47we have the IP address of 192.168.1.something other than .99.

6:52And then what we can do is connect directly to the management port to interact

6:56with it over IP or another option is we could take our blue cable

6:59and that's where we're currently connected and have that connected to the

7:02console port.

7:03And that's what we're seeing right here because we did the factory reset and it

7:06's now starting to boot.

7:06So a couple of pieces of information, this .48100F has 8 GB of RAM.

7:11There's its serial number, which is used as part of the registration for this

7:15device.

7:15And if you have a firewall like this that's already registered with Fortinet to

7:19confirm its licensing and all the rest,

7:20after you do a factory reset, it's not going to reset that licensing info.

7:23It still will remember what licenses it has and you won't have to go through

7:27the registration process again.

7:29So on this firewall, even though we're doing the reset, it won't be required to

7:32do the initial registration because I did that previously.

7:34All right, so we clean off some of this ink. It's now asking us to log in.

7:38So we'll clean some of this up just like that.

7:40And the default login is admin and it has one of the toughest default passwords

7:45on the planet and that is nothing.

7:47So when it has for a password, you simply press enter and then it's going to

7:51force you to set a new password.

7:52So currently this machine is at .99 on the 192.168 network via its management

7:57port.

7:57So from this computer that we're sitting at, we could either connect over via

8:02SSH to the .99 address.

8:04On the 192.168.1 network or just continue as we are with the console port and

8:09the console access.

8:11So just before we actually continue here with some initial configuration, let

8:15me also bring up a command prompt from this computer right here just to verify

8:19our IP address on this management PC and also verify that we can actually ping

8:23and reach that .99 address that is currently being used by default on this Fort

8:28igate.

8:28So here's a command prompt on my management machine and let's do a quick ping

8:33to 192.168.1.99 and sure enough, it is responding.

8:38So assuming I don't have another device at .99 on my local network, we are

8:42actually pinging the firewall with this default IP address on its management

8:46interface which is connected to VLAN 1.

8:49Another option for verifying connectivity is from right here, I could launch an

8:53SSH session over to 192.168.1.99 which is configured on this entry.

8:58So if we double click that, that also looks really good. So I'm going to accept

9:01and save the host key and then we can go ahead and log in.

9:04And again, the username is admin and by default, there is no password.

9:07So this is connectivity via SSH. I'm going to click on cancel there and go back

9:10to the other tab.

9:11And here we are connected via the console port. So I'm going to go ahead and

9:15log in with the username admin.

9:17And then the password is enter, press nothing. And now it forces you to set a

9:20new password which I'll do and now press enter.

9:23And now it's going to ask me to confirm that password so I know exactly what

9:26that is.

9:27So I'll repeat that new password I'm setting, press enter and we are in. So if

9:31we went back and connected via IP to the 192.168.1.99 address, we'll go ahead

9:36and do that.

9:36I'll log in as admin. I'm going to say please save that username, click on OK,

9:39press enter and I'll supply the password as well.

9:42No, it didn't actually prompt me for a password. That's because in this entry

9:45at .99, I already have my lab password already set.

9:48Otherwise, it would have prompt me for the password as well. In fact, let me

9:51just verify that real quick with you by closing that session.

9:54I'll go ahead and create a new session using SSH, click on next.

9:58For the host name, I'm going to put in the IP address, port 22 for SSH. The

10:02username, I'm going to leave that blank, click on next and next.

10:05And for the session name, I'll call this F G at 99.

10:09That way we can see it differently in the entry there. We'll click on finish

10:12and then we'll go ahead and double click on F G at 99 and we'll put in our

10:15username.

10:16I won't say save that username, click OK and now it's asking for the password.

10:20So I'll go ahead and put the password in to be the password I just set a moment

10:24ago.

10:24And I can say save that for future use for that entry and I can automatically

10:27put that in for me for future connections.

10:29So click on OK and boom, we are now logged in as admin.

10:33So here on this tab, which is labeled 9600, we are connected via a serial

10:37connection to the console port of this 40 gate.

10:40And this session right here called F G at 99, we are connected over the IP

10:44network using SSH.

10:45So we don't need two consoles open. So I'm going to go ahead and close one that

10:48's using SSH.

10:49So we'll click on yes there to close it and then we'll just continue on here

10:52with our console connection.

10:54So as far as getting some of the basic information from this 40 gate, we could

10:57do a command like get, system, interface, physical, and press enter.

11:02And then it's going to go ahead and give us one page at a time regarding all of

11:04its interfaces and also shows the IP addresses.

11:07They're so I'm going to hit space and space for one page at a time and then we

11:10can scroll up to see any information that we needed.

11:13So that's all that's interfaces here. So if we scroll up, what I'm looking for

11:17is the interface called management and here it is right here.

11:22So the management interface has a static IP address configured.

11:25It is 192.1 state 1.99. That's the default and it shows the current status of

11:30up, which implies that we have a cable connected from that management port or

11:33to a switch.

11:34It's operating at 1000 megabits or one gig duplex full.

11:38We verified that connectivity using a separate entry using SSH.

11:41So that's how we can see the IP addresses that are currently involved.

11:45If we want to change them because we do, let's take a look at our game plan.

11:48What we want to do is use a management plan address of 192.1 state 1.51 instead

11:53of the default dot 99.

11:55So let's use the CLI and let's change that.

11:57Now we also could connect via the GUI to the current IP address of dot 99 and

12:02change it from there as well.

12:03In fact, before we make the change, this also just verified from the GUI, we

12:07can get to the IP address of dot 99, which is currently in place.

12:10So I've opened up a browser. I've connected to 192.168.1.99 and I have a

12:14certificate warning because my browser doesn't trust the issuer.

12:17So we'll click on advanced and that's getting normal for a brand new firewall.

12:20And then we'll go ahead and click on proceed and then we'll log in as admin and

12:24open the password that I set up the CLI.

12:26And once I've supplied those, I'll click on login.

12:28So here it's going to give us the little wizard to begin some configuration.

12:31So I'm going to click on begin.

12:32So as far as migrating the config, I don't need to because it's brand new

12:34firewall.

12:35So we'll click on later for that.

12:37And then as far as do I want to do automatic patch upgrades, I'm going to save

12:41for now, disable that.

12:42We'll do that later.

12:43We'll click on save and continue.

12:44And then click on the little boxes as I acknowledge that there will not be

12:47automatic updates.

12:48Click on OK.

12:49And then as far as the dashboard, I'm going to click the optimal option here.

12:52Click OK.

12:53And then as far as the opportunity to watch the 40 OS 7.6 video, I'm going to

12:57say don't show this again.

12:59But you can go back and look at that later if you'd like.

13:01Click on OK.

13:02And boom, it drops right here under the dashboard to the status page.

13:05Now from here, we could use the navigation over here on the left and we could

13:09go to network and go to interfaces.

13:11And we could change the IP address here.

13:13So there's our management interface and it's current IP address.

13:16Also by default, it's allowing ping, HTTPS and SSH.

13:20And that's how we're connected right now.

13:22So we currently have a connection via HTTPS.

13:24And that's how we're currently accessing this page that we see right here via

13:27our browser.

13:28And we also have access via SSH.

13:30And we tested that from secure CRT.

13:32So if we wanted to change that management interface IP address right here, we

13:35could just double click on that management interface.

13:38And then change the IP address right here from .99 to .51.

13:42So since we're here at the GUI, I'll go ahead and change that to .51.

13:47So now the management IP address once we confirm this will be set to 192.168.1.

13:5151 based on our plan and.

13:54And because this is my management network, I do not want at this moment this

13:58firewall to be acting as a DHCP server on my management network.

14:02So I'm going to disable the DHCP server function on this interface.

14:06So it's not going to be acting as a DHCP server.

14:09And then we'll go ahead and click on OK.

14:11And then I have a warning and it basically says, Hey, dear Keith or dear

14:14administrator, dear us.

14:15You are currently connected to this firewall with this GUI on its management

14:19interface, which is currently at .99.

14:21And you're about to change the IP address.

14:23So when you do that and you confirm it, when you reconnect, make sure you

14:26reconnect to the correct IP address of .51 because the old address of .99 is

14:31about to go away.

14:32So I'll click on OK.

14:34I understand.

14:35And this screen is effectively no longer valid because we are now connecting to

14:39.99 and it's not going to respond because we don't have our firewall running at

14:44.99 anymore.

14:45So I'm going to go ahead and close this browser and I'll open up a new tab and

14:48this time will go to 192.168.1.51.

14:51I still have a certificate warning error because my browser doesn't trust the

14:54issue of this certificate, which is normal on a brand new firewall.

14:58So we'll click on advanced and then click on proceed to continue.

15:01Then we'll log in as admin. I'll put in the password that I set at the CLI

15:05previously and click on login.

15:07And it's once again asking me if I want to continue with the wizard here and

15:10because I've done everything except for the migration, which I don't need to do

15:13because it's new firewall.

15:14I'll simply click on later and boom.

15:16Here is our graphical user interface.

15:18You make that a little bit bigger.

15:19So now here on the left, if we go to the network and we click on the interfaces

15:23option under network and we go to management, we can now see that the IP

15:26address is .51.

15:28Also, we can see here as far as what's allowed on this interface is ping H, TBS

15:33and SSH.

15:34Also, if you wanted to make these changes from the CLI, you could and let me

15:38show you that as well.

15:39So we're going to go back to secure CRT.

15:41So currently I'm still connected via the console port and I timed out.

15:45So the default timeout is five minutes of inactivity.

15:47It's going to cancel your session.

15:48So the old session timed out.

15:50So the default timeout is five minutes.

15:52So there's been no interaction after five minutes.

15:54It's simply going to log you out.

15:55So we log back in as admin press enter put in the password that I said earlier

15:59and it's logging us in.

16:01So now if we do the command get system interface and it's abbreviated sys there

16:05and physical and press enter.

16:07So we can hit space bar to go one page at a time or just enter to go one line

16:10at a time.

16:11So here for the management interface is showing us now .51.

16:15And as far as what is allowed as far as management protocols, if you wanted to

16:19view or modify that, we can type in config system interface and press enter.

16:24And then one of my favorite commands is show and that will show us the

16:27interfaces there.

16:28So here is showing us the management interface and also showing the IP address

16:32and here is showing what is being allowed for management access, including ping

16:36, HTTPS for GUI access and SSH for CLI access and all these represent access

16:41over an IP network to the management port.

16:43So if we wanted to modify the IP address or the allowed protocols here on this

16:47management interface, we can just type in edit management and press enter or

16:51use the quotes as well with edit quote management end quote.

16:54And then from here we do a show which will confirm our settings here and then

16:58we could modify the IP address with the set command for example set IP to and

17:02whatever we want the IP address to be or if we want to allow different

17:05protocols or less protocols.

17:06As far as management access, we do a set allow access and then a space question

17:11mark so we can include ping HTTPS SSH and what we would probably not want to

17:15include our insecure protocols like HTTP or telnet which are plain text.

17:20But in a pinch if you had to for some reason, you can enable those as well.

17:24So I'm going to enable ping and HTTPS and also SSH space.

17:28Let me also just for grins, let me enable telnet. So then we do a show. Now we

17:32have those four protocols being allowed on this interface called management.

17:37So because I don't want telnet, I'm actually going to take off the telnet, send

17:40it back to SSH and then we'll do a show to confirm.

17:43And now it's just those three protocols are allowed on this interface. And then

17:46to save the config we're going to type an end.

17:48So if you made changes to the protocols the IP addresses once we exit out,

17:52those changes are now active and running on the firewall.

17:55So let's do a progress check. We did our factory reset. We then verified that

18:00we get to the default IP address of dot 99 via the CLI and also with the GUI.

18:04And then we changed the management IP address to dot 51. And once again

18:08verified, we get there via the CLI using SSH. We also verified we can open up a

18:12browser to that same IP address and verified that also worked.

18:15We also verified that on this management interface, it's allowing and

18:18supporting ping so we can ping it and get a response. It's also supporting SH,

18:21which is for the CLI access over the IP network.

18:24It's also supporting HTTPS, which allows us to use a browser using some form of

18:29SSL slash TLS. However, what's not yet in place is the ability for this

18:33firewall from its management interface to actually reach the Internet.

18:38And to do that, we need to also add a default route, which is exactly what you

18:42and I get to do in the very next video. So I'll see you there in just a moment.

0:00So we just our factory reset. We reconfigure the management plane interface

0:03address on the

0:04management interface itself to .51 and we also verified CLI access with SSH. We

0:09verified the GUI

0:10access via a browser via HTTPS. So those are both done. So our next step is to

0:15configure a default

0:16route. And the reason that's needed is because by itself this firewall does not

0:20know how to reach

0:21out to the cloud which is super important for connecting with Fortinet services

0:25, including

0:25registration if that hasn't already been done. And also doing updates regarding

0:29its definitions

0:30and firmware that can all be done online. So as part of this depth let's

0:34confirm the current

0:35routing in place. And then what we'll do is we'll add a default route. And then

0:38if you need to

0:38get access to the internet go ahead and use the IP address of 192 1.1 as the

0:44next hop for the

0:45default route. And here my lab network that .1 address is all set up with

0:49routing and address

0:50translation to allow traffic from this firewall to get out to the public

0:54internet. So without

0:55further ado let's head over to the firewall. Let's confirm our routing and then

0:58we'll add our default

0:59route. So here at the firewall I have timed out because five minutes have gone

1:03by so I'll log back

1:04in as admin and I'll put in the new password and we are now logged in. So I don

1:08't need to migrate so

1:09I'll click on later and this takes us back to where we left off and that was

1:12the interfaces pane here

1:14in the left navigation under network. So here's our management interface. There

1:17's its IP address.

1:18And there's the three protocols that are being allowed ping HTTPS and SSH and

1:22we're currently

1:22connected via HTTPS. So to view the current routing that is in place on this

1:27firewall if we go to the

1:29dashboard and then under dashboard go to network this is a great way to see

1:33what's in place. So here's

1:34a widget for static and dynamic routing and this firewall is playing us here

1:38that it knows about two

1:39networks. So if we click here on this widget to expand it is showing us here we

1:43have two directly

1:44connected networks and one of those is right here that's our management network

1:49the 192 1 state 1

1:50network and then it also has for us configured an IP address on a logical

1:55interface called LAN

1:56and it's using 192 1 state 100. So another set of videos we'll take care of

2:01this

2:01LAN logical interface because we're not going to be using the 192 1 state 100

2:04network but for now

2:05what we need is we need an additional default route because at this moment this

2:09firewall only

2:09knows about those two directly connected networks and has no idea about

2:12forwarding to the next top

2:14of dot one as a default route. So to add a default route they can be done at

2:18the command line but

2:20since we're here in the GUI it's a lot easier right here to configure a default

2:23route we'd go to

2:24network so here with the network section expanded we then go to static routes

2:28right here and with

2:29static routes selected we'd click right here on create new and then we simply

2:33put the details so

2:34here's a syntax for a default route and for the gateway address which is the

2:39next top address for

2:40that default route we're going to use 192.168.1.1 which in my lab network here

2:45in my home office

2:47that is the IP address of the default gateway who is going to use as part of

2:50the default route

2:51here on the 40 gate so check this out I'm going to hit the tab key when I do it

2:56automatically says oh

2:57we'll use the management interface so if we hover over the management interface

3:00the reason it's going

3:01to use that interface in combination with the default route is because that

3:04management interface

3:05is on the same network 192.168.1. So the firewall knows that to reach the next

3:11top address for the

3:11default route that the management interface is the interface is going to use so

3:14it automatically

3:15populated that for us and then we'll take the defaults for administrative

3:18distance and we'll talk

3:19more about administrative distance and different types of routing in a separate

3:22set of videos but

3:23for now we now have a default route or we will once we click on okay and unlike

3:27some firewalls

3:28we don't have to go through another step so there's no second commit statement

3:32or anything else we

3:33have to do that default route is now in play so to verify that we could go to

3:37the dashboard and

3:38in a dashboard we click on network and here we go back to the routing widget

3:41and now it's showing

3:42us that we have two directly connected networks and one static route and that's

3:46the default static

3:47route we just configured so if we click on that here is that default route that

3:51says if you don't

3:52have a more specific route in your routing table go ahead and forward to the

3:55next IP address of 192.168.1.1

3:58which is my default router here in the office and it's this job to make a

4:01further routing decision

4:03towards the internet including doing things like address translations that are

4:06needed for this

4:07firewall to get to the internet so there's a few options for verifying now that

4:11this firewall

4:11can actually reach the internet using the default route and one would be just

4:15doing a simple ping

4:17to ping something out on the internet like a google DNS server at 888 or some

4:21of the resource

4:22or we could go ahead and do our registration at the firewall and if the

4:26registration is working

4:27where it connects to the fordnet servers and updates the registration that

4:31would also be a good

4:31indication that it works where we could also verify that DNS is working from

4:35the firewall

4:36so let's do some tests just to verify that this firewall has access now to the

4:40internet using the

4:41default route so one way of doing the ping would be to use this option right

4:45here so in the upper

4:46right hand corner there is a shortcut for a command line so effectively this

4:50gives us a command

4:51line interface for using the GUI a command line interface to the firewall so

4:55here we have the firewall

4:56prompt we are logged into the GUI so we're already logged in here so we dive in

5:00execute

5:01ping and then we can specify an IP address like 888 and if that works which it

5:05looks like it is

5:06that implies connectivity using our default route and if we did an execute ping

5:10to www. let's go ahead

5:12and go to fordnet.com and press center that is a great sign that implies that

5:17DNS is also working

5:19because it resolved the name www.fournette.com over to an IP address and then

5:24proceeded to do the ping

5:25let me go ahead and close that CLI another way to test would be to go to the

5:29networking section here

5:30and go to DNS and here it has two default porta-guard servers for DNS it's also

5:35indicating here

5:37that we have reachability to those DNS servers which is a great sign or if we

5:40went to system and

5:41went to firmware and registration right here because they already registered

5:44this firewall

5:45it's showing us registered so on a brand new firewall where we hadn't yet had

5:48internet access

5:49to that initial registration here we could go ahead and attempt that

5:53registration and if we have

5:54routing in place for the management plane the firewall should be able to reach

5:57out to the internet

5:58to the four net servers online and to the registration and sometimes that

6:01registration may take somewhere

6:03between five and fifteen minutes depending on how busy the servers are so once

6:07you've had connectivity

6:08after the internet you verify that for example with a ping and then you've come

6:11here just be

6:11aware it may take a few minutes for that registration to be completed also

6:15another step right here

6:16regarding firmware and registration in their system is that if you have an

6:20older version of software

6:22for example 7.2 or 7 something then you want to upgrade you could also do the

6:26upgrade right here

6:27so as we proceed to this course together I'll walk you to one of the updates on

6:31one of the other

6:32firewalls this one is currently up to date also right here i'd like to mention

6:36this option right

6:37here which is F4 feature so if you have a firmware version that says feature

6:43right here that is

6:44not a great idea for production so i'm using it because i want to use the

6:48latest and greatest

6:49version of software but in a production environment we want to have a m version

6:53which is mature it's

6:54so the same mature there which implies that the m version the mature version

6:58has been tested and

7:00verified and there's not as many surprise bugs or updates that will need to be

7:04done for full

7:05functionality so in the labs i'm going to be using the feature option because i

7:08want the latest

7:09and greatest version but in a production environment we'd want to stick with

7:13the m flavor because it's

7:14gonna be more stable we'll have less surprises but once again here in the lab

7:17environment i'm

7:18going to be using the feature version because i want you to use the latest and

7:21greatest for the

7:22demonstrations

0:00One of the things I've discovered over the years is that as we're learning

0:03something new or studying something

0:04It's important to do a little pause once in a while just to confirm that we get

0:09it

0:09So here's what I love to do regarding this bootstrap scenario

0:12I'd like you to imagine that you and I have been asked to redeploy a 48

0:17firewall in the network and the initial steps

0:19They want us to do is get the management plane up and running effectively

0:23allowing us to manage and work with that firewall

0:26So as part of the scenario, I'd like you to answer the following questions

0:29regarding how would you accomplish the following number one

0:32For an existing firewall that's already in place for example this one right

0:36here

0:36How do we gain initial access to the CLI of an existing 48 firewall?

0:41So there's a couple different options there

0:43I'd like you to think about two different ways you can get to the CLI the

0:47command lane interface of an existing

0:49Fortigate and secondly, how do we perform a full factory reset? So any of the

0:53configurations?

0:54We're getting IP addresses or how the ports are configured

0:57How do we do a full factory reset?

0:59And then third once that reset has been completed

1:02How do we then gain access to the CLI or the GUI of a freshly reset 48 firewall

1:08?

1:08And let's also presume that we have our physical cables already in place for

1:12the management port

1:14So that management port is already connected in to the 192.168.1 network

1:18So on a freshly reset firewall, how do we gain access to the CLI and the GUI

1:22and then fourth

1:23How do we go about changing the management interface IP address?

1:26Now there's a couple different ways that we looked at in this set of videos

1:29regarding how to change that IP address

1:31So what I'd like you to do is list both of those options

1:34How do we change the management IP address on the management interface of this

1:3848 firewall?

1:39And then finally how do we go about adding a default route?

1:43So thinking through these options will help us remember the steps involved for

1:48doing exactly that

1:49So what I'd love for you to do is take a few minutes, think through these on

1:52your own

1:53And then once you're comfortable with the answers to these questions

1:56If you'd like to join me in the next video and we'll do a quick walkthrough of

2:00these steps and these options

2:02So have some fun with this scenario and I'll see you when you're ready in the

2:05very next video

2:06[BLANK_AUDIO]

0:00In this video, we get to do a walkthrough of the tasks asked about in this

0:03scenario.

0:04So the first question is, how do we gain access to the CLI of an existing 40-

0:08gate?

0:08And it wants, what are the two options there? And the two primary options will

0:12be using SSH.

0:13Let's presume we know the IP address on the management interface of the

0:16firewall. We get

0:17SSH to that and then log in. Or if we have console access to that firewall, we

0:22could use a serial

0:23connection and connect to the console port. So those are two different ways of

0:26connecting to

0:27that 40-gate. So currently, this firewall right here is at .51. We set that up

0:31previously.

0:32So if this was our existing firewall and we wanted to connect, let's go ahead

0:35and verify

0:36those two options of connecting over to this firewall. So for the first option,

0:39I'm going to

0:40use secure CRT and open up a connection over the COM3 port on my local computer

0:45, press enter,

0:46and boom, there's our login. There's our CLI access. So that's how we get there

0:50from the console port.

0:52And for SSH, we could go ahead and use an IP connection to get over there. So

0:55here, based on

0:55this entry that's connecting via SH over to .51, if we double click on that,

1:00accept and save the

1:01host key for the first time we're connecting. And then it would prompt us for

1:03the username and

1:04password. And because it's entry right here, .51, I already had pre-configured

1:08and secure CRT to

1:09save the username and save the password, secure CRT, put that in the background

1:13form. So that's

1:14two different ways through the console port or through SH that we can connect

1:18initially to the

1:18existing 40-gate firewall. So the next question asks, how do we perform a full

1:22factory reset? And

1:24the command for that is execute factory reset and press enter and then hit Y to

1:28continue.

1:29So here at the CLI, it doesn't matter too much if we do this through the

1:32console connection or

1:33here through the SSH connection. So once we're logged in, we'll type in execute

1:37space, FAC,

1:38and we'll do a question mark. And we want to do a factory reset all by itself.

1:42And that way,

1:42you can wipe it completely clean, except for the registration. If that's

1:45already done, that's not

1:46a problem. And it's already been licensed. That part doesn't get wiped away. So

1:49you can do this

1:50as many times as you need to, and your licensing on the firewall will stay in

1:53place. So the next

1:54cute factory reset press enter will hit Y to continue, and it's off to La La

1:59Land. So it'll do

2:00the factory reset and the reboot. And when it comes back, it'll ask us to

2:04authenticate again,

2:05using the default username of admin and the default password of nothing just by

2:09pressing enter.

2:09And at that point, it'll ask us to go ahead and set up a new password. So that

2:13's the factory

2:13reset. And then to gain access via the CLI and GUI of a freshly reset 40-gate

2:18for CLI access,

2:19we can once again use the console port. Or if we want to use SSH, and we want

2:23to go to the default

2:24IP address of dot 99, we could use SSH. So those are two options for command

2:28line interface access

2:30to our 40 gate. And if we use the SHB to dot 99 on the 192 West State One

2:35network, because that

2:36is the default IP address that's going to be using on its management interface.

2:40Or if we connect via

2:40GUI, we open for browser to dot 99. So even if we just type in 192 West State

2:46one dot 99,

2:47only HTTPS services are enabled by default. And so we're going to be using

2:52secure HTTPS to connect

2:54for that GUI interface access. So to verify that, we already know that the

2:57console cable isn't

2:58moving. That's going to work. So let's verify SSH to dot 99 and also HTTPS to

3:03dot 99 to this newly

3:05reset 40 gate. So I just attempted to go to 192 West State one dot 99. But I

3:09think that the 40 gate

3:11hasn't completely done with its reboot. So as a quick test, I'm going to bring

3:15up a command prompt.

3:16And let's just do a quick ping over to 192 dot one state dot one dot 99. And

3:22that is responding. So

3:23let me go ahead and close that. I probably just did this a little bit too soon.

3:26So now it's been

3:27another minute or two, I'll click on reload. And sure, now I have the

3:30certificate warning,

3:31I'll click on advanced and proceed. And then we'll log in as admin. And there's

3:36no password. So

3:36we'll just leave that empty, click on login. At this point, it wants the old

3:39password, which is empty.

3:41There's no password there. And then we'll set up our new password and it will

3:43confirm the new

3:44password. So in the demonstrations earlier in the videos, we changed our setup,

3:48the initial password

3:49at the CLI. Here's an example of doing it through the GUI. We'll click on OK,

3:53and now it's asking

3:53us to log in. So we'll type in admin, and then we'll put in the password that

3:57we just set. So I'll

3:58supply that password. And then we'll click on login. And then it's walking us

4:01through the wizard here.

4:02So I'll click on begin. I'll say don't bother migrating because we just wiped

4:06it out. I'll disable

4:07automatic patch upgrades for the lab environment here. Click on save and

4:10continue acknowledge it's

4:11not going to do automatic updates. Click OK. And then I'll take the default

4:15option for the

4:15dashboard. Click OK. And I'll say please don't show this in the future as far

4:18as the prompt for

4:20the video. Click OK. And boom, here we are on the status section of the

4:23dashboard for this firewall.

4:25So to gain access to the CLI or GUI of this freshly reset 40 gate, if we're

4:30using SSH for CLI access,

4:32we'd go to the default IP address of .99 on the 192.168.1 network. Or if we

4:37have a console

4:38cable going to the console port, we can use it as well. And for the GUI, simply

4:41open up a browser

4:42to that IP address, the default IP address of .99. And then the next step says,

4:46how would you change

4:46the management interface IP address? So we could do that via the CLI, or we

4:50could do it via the GUI.

4:52So last time in the demos, we did it via the GUI. So if you want to see that

4:55again, please check

4:56out that video in the set. And for this example, let me walk you through config

4:59uring the measurement

5:00IP address on this firewall from the default of .99. But we'll use the CLI, the

5:04command line interface

5:05to do it. So we'll go back to our terminal emulator. Once again, I'm using

5:09secure CRT here. And we'll

5:11go to our serial connection that's going over to the console port. And we'll go

5:14ahead and log in

5:15as admin. And I'll put in the password that I changed at the GUI. And if that

5:19works correctly,

5:20we are now logged in. Fantastic. So to change the management interface IP

5:24address, we type in

5:24config space, the word system space, the word interface, press enter. And now

5:28we're in interface

5:29configuration. So here we can do a show, it's going to go through all the

5:32interfaces. It's

5:32going to confirm our current settings for the management interface. So that is

5:36right here. And

5:37then we're going to edit the management interface and simply going to copy and

5:40paste

5:40edit space management. So because it's one word with no spaces, you don't

5:43actually need the quotes,

5:44but you can use the quotes if you want. So it's like going to paste in edit

5:47space, quote,

5:48management, quote. However, you can just type it in without the quotes as well.

5:51Either way is

5:52great, press enter. And now we're in interface configuration effectively for

5:56that management

5:56interface. So here we do a show to see what we currently have. If we want to

6:00change this IP address,

6:01we simply use this command right here. I'm just going to copy paste it. And

6:04then we're going to

6:05change the address from dot 99 to go ahead and set it to our intended IP

6:10address of 51 and press

6:12enter. Then we'll do a show just to verify that we don't have a typo that looks

6:16good. It's allowing

6:17ping HTTPS and SSH by default. That's great. So we'll type in and as giving us

6:22a warning,

6:23indicated we have one admin session. So the admin session that we're connected

6:26to on the

6:27management interface is our GUI interface that we have currently connected. And

6:30this warning is

6:30saying if you change this IP address, it could negatively impact that

6:33connection,

6:34which it will because we're changing the IP address from dot 99 to dot 51. So I

6:38'll say yes,

6:38go ahead. And then at the GUI, we can just re log in to the correct address now

6:42of 192.168.1.51.

6:45And if we use the command get system interface physical, press enter and hit

6:49spacebar for one

6:50page of time, then another key like queue to quit the scrolling. Here's our

6:53management interface.

6:55And there is its new IP address of dot 51. So to verify connectivity via SSH, I

7:00'm going to go

7:00ahead and make a new entry. So here my terminal image, I created a new session

7:04using SSH. And we're

7:05going to go to 192.168.1.51, our new IP address. We'll go ahead and supply the

7:10username here as

7:11admin, click on next. And then I'll call this fg dash three at dot 51. That way

7:19, when we see it

7:19in the entries here, we'll know which one it is, click on finish, and then we

7:22'll go ahead and launch

7:23it. And there we have a message saying do you want to accept and save the host

7:26key, we'll say yes.

7:27And now it's prompting us for the password. So we'll put in the password. And

7:30then if I want

7:30secure CRT to remember the username and password with this entry, I'll put a

7:34check there in the

7:34checkbox and click on okay. And it should log us in via SSH to our 48 firewall.

7:40And there it is.

7:41All right, so I'm going to close secure CRT. And our last step is to add a

7:45default route.

7:46So the easiest way to do that is do it through the GUI from the graphical user

7:50interface. So

7:50let's open up a graphical user interface over to the new management IP address

7:54of 192.168.1.51.

7:56So here we are attempting to connect to this IP address. We have once again a

8:00certificate

8:00warning because our browser and this computer doesn't trust that issue of the

8:04certificate. So

8:05we'll click on advanced and proceed, then we'll log in as admin. And then put

8:09in the password that

8:10we set up, I'll say later regarding the migration tool. And then from here, if

8:13we want to set up a

8:14default route, what we could do is go in our network and then our network go to

8:18static routes.

8:19And currently we don't have any static routes, we'll simply click here and

8:21create new and we'll

8:22create our new static route. So that's the syntax for a default route. We could

8:26also go ahead and use

8:270, 0, 0, 0, slash and 1, 0 means the same thing to the firewall. And then for

8:33the next hop,

8:34we're going to specify my default gateway here in my home office, which is 192.

8:38168.1.1.

8:39And let the tab key automatically sorts out which interface it's going to use

8:42to forward to that

8:43next hop, which is the management interface. And showing us the IP address

8:46there, if we hover over

8:47it, 192.168.1.51. And then we'll click on OK. And then to verify we have the

8:53static route here

8:54and also figure out the dashboard on the left and then go to network, it's also

8:58going to reflect that

8:58here under the static and dynamic routing widget. So here if we click on that

9:02widget and showing

9:03us that default route and then to test it, one quick way is to go to the

9:07shortcut here for a

9:08command line interface from the GUI. So I'm going to click on CLI console. And

9:12then from here we'll

9:12type in ping, or rather execute ping. And we'll go ahead and ping eight dot

9:16eight dot eight

9:17to date just for basic IP connectivity. And then if we want to verify services

9:21such as DNS,

9:22we can do a execute ping and then go to a name like www dot cbtenegis.com,

9:28which we'll have to do

9:29name resolution in the background before it can execute the ping. And that

9:32looks good as well.

9:33So now we've verified that we have a new IP address on our management interface

9:37. So if we go to

9:37network and interfaces, here's our management interface, the little green

9:41indicates that we have

9:42a link coming in from our switch, what we're currently plugged into with the

9:45patch cable.

9:46There's its IP address. And for the routing, if we go to dashboard and network

9:50in here,

9:51the routing widget, we have our default route that we're using to actually

9:54reach the internet.

9:56So if you take a look at our bootstrap scenario about getting this device

10:00online and having access

10:01via the management plane, we looked at the options for connecting initially. We

10:05looked at the

10:05option for doing a factory reset and how to gain access to the CLI and the GUI.

10:09We also change

10:10the management IP address. And in the videos earlier, we did that change of the

10:13IP address in the GUI.

10:14And here in this walkthrough, we did it via the CLI. They are both good options

10:19. And then we added

10:19a default route with the proper next top. So that way, this firewall, well,

10:23just this management

10:23interface setup has access using the default route to actually get out to the

10:27internet. So now that

10:28we have bootstrap the firewall, when we set up the management plane,

10:32effectively the ability for

10:33us to connect to and manage the firewall, and we set up a default route so the

10:37firewall can get

10:38out to the internet. The next big challenge that we need to face is configuring

10:43the data plane.

10:43Remember, the data plane is the flow of traffic, for example, from users on our

10:48network to get to

10:49other networks, including the internet. And so those next steps of setting up

10:52the actual data plane,

10:53so the actual firewall can forward traffic from users, for example, out to the

10:57internet,

10:57that configuration we're going to do in the very next set of videos. So I look

11:01forward to seeing you

11:01there when you're ready. Meanwhile, I hope this has been informative and I'd

11:06like to thank you

11:07for viewing.