- Let's take a look at some scenario situations
that you'll probably run into on the exam.
Now, keep in mind that,
because scenarios are so important for the exam,
the CompTIA is very much capable of taking
something that looks really, really complicated,
and really breaking it down
into something incredibly simple.
Here's a case in point.
What I've drawn up here is a fairly typical network.
You'll see that I've got some firewall that's also a router
that's out to the internet.
I've got some first level devices here,
some servers, a wireless access point.
And then, beneath that, I've got another NATed router
that's connecting to this one particular system.
When you're running into situations
where you can't get to somebody else,
the first thing you need to consider is the idea
that you have blocked TCP or UDP ports
somewhere in the setup.
Now, when we're talking about blocked ports,
it could be anything, so, for this scenario,
I'm just gonna say Port 80, but it really depends
on what the scenario says
you need to be able to be ready about.
"Oh, well, my DNS isn't resolving?"
Well, then you need to check DNS ports.
If my DHCP isn't resolving, then you need to check DHCP.
Get the idea?
So, in this case, I'm doing HTTP, just because it's simple,
but keep in mind that these situations
are always gonna take place, always at the same time,
always with the same stuff.
If you're gonna be blocking TCP and UDP ports,
you have to do it with something
that has an access control list.
So, let's take a look at this scenario right now and say,
"Where are the ACLs?"
Well, first of all, individual hosts
can have access control lists
in the form of host-based firewalls.
Secondly, this firewall is, by definition,
an access control list, so that could be an issue.
And then, next is this NATed router.
So, while this router has NAT,
we can also assume that it also has a firewall.
For the exam, if you run into any device with NAT,
just assume it has firewall, also,
and you'll be well-served.
So, if I'm on this laptop right here,
and I can't get to the webpage on this box right here,
you have to think to yourself,
"What's between here and there
"that could potentially block it?"
So, number one, the WAP.
Now, this is a WAP.
It's not one of these home wireless routers, okay?
It's just a pure WAP.
Traditionally, a pure WAP does not have an ACL.
Now, if this was a home router,
that would change things, right?
But it's not.
So, we don't have any blockage here.
This is just a regular old switch running at layer two.
So, there's something over here.
Now, it would be weird to have a web server
that was also blocking Port 80,
but maybe it wants to use a non-standard port.
Maybe it wants 8080 or something like that, as security.
So, the answer to this is that I would be looking
at the host-based firewall right here
to see if it has a blocked port.
That was fun, let's do it again.
This time, I can't get out to the internet on Port 80,
just can't even get out to the internet at all,
and, let's pick this system right here.
Now, in this particular case,
we have two areas to look first.
Number one, I'm gonna be looking on the NAT.
Since the NAT has a firewall, it could potentially
be blocking outgoing Port 80 there.
The other place I would be looking
is on the firewall here,
to see if there's an outgoing Port 80.
Now, granted, it's pretty rare for us
to block outgoing Port 80,
because nobody would be able to use Google, right?
So, I'm just using that as a scenario for you
to make a consideration
when you're running into this type of stuff.
So, that was fun, let's do it one more time.
Let's say that I'm in the outside world.
In fact, I'm gonna make it more complicated.
I'm gonna draw a camera,
cause I'm so good at drawing cameras.
So, let's plug this camera in.
Now, in this particular case, I cannot get to this camera
from the outside world.
So, coming in from here, I can't get to this camera.
These can be really complicated situations.
So, the camera's got a Port 80,
and I should be able to open up a web browser.
Where should I be looking for blocked ports?
Well, number one, NAT.
Remember, NAT is going to be
changing the port number itself,
so to get to this camera from inside the NAT,
we would have to install port forwarding.
So, it's not really a port block, in that particular case.
So, we'll assume that port forwarding is working
and is good order here.
So, let's march our way out,
switch isn't gonna be doing anything.
It's got to be here.
There's something in this firewall that's blocking
incoming Port 80s in this particular case.
So, when you're running into these situations,
and you're gonna be seeing this on the exam,
don't let a big, complicated scenario like this mess you up.
What you need to do is, number one,
remember the function of that particular port,
what's it supposed to be doing,
and the service that it's supposed to be giving,
and then, number two, take the time to just trace it out.
You will be shocked how many of these
very large, complicated scenarios are actually wildly,
and I mean incredibly, trivial in terms of their answers.
Okay, well, that's one, but let's go ahead
and do another scenario.
This time, what I want to do is,
I want to talk about host-based firewalls.
So, let's go ahead and fire up a host-based firewall,
and let's talk about some of the issues we run into there.
Host-based firewalls, in fact,
all kinds of different firewalls,
will have challenges with their ACLs
that come up from time to time.
Now, what I want to do here is talk about
a typical host-based firewall.
In this case, I'm gonna be using good old Windows Defender,
cause they all pretty much work the same.
The thing we need to keep in mind
when we're talking about host-based firewalls is,
because it's on the machine, it can actually
not just use ports, for example,
but it can also use the names of programs,
because it's on the same computer
as the programs that are running.
So, I don't necessarily have to block a port.
I can just block a program.
So, let's go ahead and take a look
at a default Windows Defender.
Let's see what we're talking about.
So, as we take a look at the screen,
the first thing I want to make sure
we're all comfortable with is that
all of these different firewalls
are going to have default settings.
So, here, the firewall is on
for my domain, private and public,
so it doesn't matter what kind of network I'm on.
It's gonna run.
And notice that it says, "Inbound connections
"that do not match a rule are blocked,"
whereas, "Outbound connections
"that do not match a rule are allowed."
This is reaLly, really important,
and this is the kind of default stuff
that you're gonna see on every single host-based firewall.
In essence, it's pretty much just gonna let anybody out,
but it's not gonna let anybody in unless you do something.
So, let's take a look,
and let's take a look at some outbound rules.
Now, you can see, we've got
a whole bunch of outbound rules here.
Now, what's interesting is, it's basically saying,
"Everything there is is allowed to go out."
And that's just how this particular tool works.
So, I'm gonna just pick on one here.
Here we go, this is a game I like to play.
So, we take a look at this,
we're going to see that this particular game
is allowed to go out,
and it doesn't even care what port it is.
That's because it's actually looking at the program itself.
So, it's really not that terribly interesting
when we're looking at outbound rules on these tools.
Now, if you wanted to, we could change this,
but you would find your users calling you up all the time,
because every time they opened up a web browser,
or tried to check their email,
or tried to play a game, or tried to do anything,
they'd be getting these big errors
that would keep popping up.
So, what's more interesting is on the inbound rules.
Now, remember, by default, everything is not allowed
unless it's specifically listed here.
So, let's take a look.
Here's my Dropbox program, for example.
I'm a big fan of Dropbox.
And we'll see that Dropbox is allowed in on any port.
So, that's gonna be acceptable, because
we don't really care what port Dropbox is running on.
It's just the executable itself.
Now, what I want to do here is,
I'm gonna actually install an inbound rule
that's gonna allow Port 8080 to come in.
So, let's go ahead and create a new rule.
So, here's where the big difference is.
I could just say a program, but in this case,
I don't want a program.
What I want to talk about is a particular port,
so I'm gonna select Port in this case,
and it's gonna be TCP Port,
and I'm just gonna type in 8080.
And, for all my different types,
I'm gonna call it Timmy, and hit Finish.
So, you'll see that I've now created this particular rule.
So, keep in mind, what we're looking at here is that,
everything's blocked unless
there is something that says otherwise.
So, Windows actually calls
each one of these individual rules an exception,
and a lot of times, if I were to try
to fire up a program that needed Port 8080,
with Windows, it will come up, and assuming that
I have domain administrator control, not,
domain, administrator, or local administrator,
it will pop up and say, "Something called Timmy,
"or something like that, is trying to come in
"on Port 8080, should I allow it?"
And you can actually, on the fly,
make that type of situation.
So, what we're gonna be looking at in the exam
on these types of situations is that,
there's either going to be a setting
that is blocking something that should be allowed to pass,
or it's going to be allowing something that shouldn't.
The most important thing to remember
when you're dealing with scenarios like these is,
take a look at which way the traffic is coming.
People get very confused on things like
the difference between an incoming Port 80
and an outgoing Port 80.
Remember, if it's coming in on a particular port number,
that's because you have a server.
So, if you have incoming Port 80,
that means you're running a web server on that machine.
If you got an incoming Port 21,
that means you got an FTP server on this machine.
If you got an incoming Port 22,
that means you have a SSH server on this machine,
as opposed to outgoing.
So, with outgoing, if we have outgoing Port 22,
that just means that you have PuTTY, or some SSH tool.
You're trying to get out to a particular SSH server.
So, take your time with these,
and make sure you're comfortable
with the difference between those two.
Now, I don't want to stop there.
In fact, I want to go through one more scenario.
What we're gonna do this time is,
we're gonna talk about
incorrect access control list settings,
but to make it more fun,
let me fire up a little home router.
It'll be a bit more interesting.
I get in trouble with CompTIA mainly because,
when I hear the word access control list,
to me, that means any kind of list
that defines any kind of access control
to any kind of resource.
But CompTIA does make a bit of a separation,
and to be honest with you, today,
with internet of things and such coming into play,
and network access control,
I should be making a clear separation.
So, for me, when I see the word firewall on an exam,
I'm really thinking about a firewall
that's blocking ports, that's blocking time of day,
something like that, whereas,
when I see the word access control list
on the exam, I'm thinking about something
that actually defines who can and cannot get onto something.
So, when we're talking about ACLs,
you'll be seeing scenarios where Johnny can't get onto X.
Whenever we see this type of situation,
and it could be he can't get onto a wireless network.
It could be that he can't access some kind of network.
It's always, somebody can't get to the network
one way or another.
So, when you see this, think ACL,
and when you're thinking ACL,
there are three things I want you to consider.
Number one, is there some kind of username, password,
that they need to get on there?
Maybe it's a radius box, maybe it TACACS.
In that case, you're probably gonna need
some kind of username and password.
The other thing to consider,
especially when we're talking about port-based settings,
is, does this device have a MAC address
that's been preassigned, that is allowed to get on there,
or does it have an IP address?
So, let's go ahead and say, for a moment,
that we want to make sure that my phone
can get on the network.
So, let's take a look at the settings.
All right, so if we take a look at
this little TP link box here,
we'll see that there is a whitelist
that is set up right now, and right now,
the whitelist is set up for a device called MikePhone,
and he is automatically allowed.
So, these are the type of scenarios
that you should be ready for
when you're looking at the exam.
Number one, keep in mind that you're gonna have
some type of situation where you're gonna have
a username and password.
So, does Johnny have the username and password
to get on this network?
If we've got a radius box in play, if we're running TACACS+,
then we need to keep that as a consideration.
Number two, does Johnny have some kind of MAC address,
or some kind of IP address, which is either whitelisted
or blacklisted in such a way
that Johnny can't get on the network?
Now, keep in mind, it sounds simple when I say it.
Be ready for big, logical network diagrams
where you've got to click on something,
and it's not gonna be a pretty graphical user interface.
It's gonna be some text thing where it says,
line by line, who is allowed or not allowed,
and you've got to find where the mistake is in there.
So, be comfortable with these,
and be ready for these types of scenarios,
cause it's on the exam.