Question

We often assume that, if things go wrong, we can just search online for a guide, instruction manual, or video to fix the problem—and why wouldn’t we, since this works much of the time? What do you do, however, if your internet connection IS the thing that went wrong? While you might be able to use a cell network to look up help on a smartphone, it can be reassuring to have local copies of guides, manuals, and instructions on hand rather than always depending on being able to search for the information online.

For this activity, you have two tasks:

Find two instruction manuals, steps, etc., one for NAT configuration and a second one for firewall configuration.
Create a set of rules for a firewall used in a hypothetical business network.
One of the most popular network technology developers is Cisco, so we’ll use it for this activity. Go online and search the web for instructions on how to perform NAT configuration for modern Cisco routers. Make sure the site is an OFFICIAL Cisco site. Create an offline version of the information. (Either copy and paste it into a text document, or save the web page) Create a second text document that contains the full URL for the source of the information.

Next, perform the same search for the firewall configuration of Cisco devices. Once again, copy and paste the instructions you find, or save the webpage. Add the full URL for this site to the text document, which already has the NAT configuration site URL. You may have this information from a prior activity if you are using a Cisco router; if so, you can use the same documents or links, if appropriate.

Finally, let’s put some of these ideas into practice and come up with rules that would make sense for a hypothetical small business network (i.e., 20 or so staff working in various parts of the company such as sales, management, IT department, and accounting/human resources). In your document listing the two URLs for NAT and firewall configuration, add two rules that would make sense for the firewall of an intranet used by the accounting staff to fulfill payroll. The two rules should include the following information:

The purpose of the firewall
The affected service, application, or information
Who will be affected by the rules
The rules themselves
Just to make it more interesting, assume that the firewall already has one rule: All traffic, by default, is blocked. You should also assume that you’ve already configured the network to audit all logs.

The rules can be explained in general terms—that is, you don’t need to write the specific line of code that would be required—and you should identify specific port numbers. Examples of rules can easily be found online; just make sure the rules are suitable for a small business environment.

Include the following materials in your submission for this activity:

One text file that lists two URLs (for NAT configuration and firewall configuration) and two examples of firewall rules
Two files that are accessible offline and include instructions for NAT configuration and firewall configuration (The files should be pulled from official Cisco support information and can be provided in TXT or HTML formats, or even PDF if you pull an instruction manual offline.)

Answer 1

I can’t fetch or save live web pages for you, but I can (A) point you to the official Cisco pages you should download, (B) give step‑by‑step NAT and firewall configuration text you can save offline as your working copies, and (C) produce the required single text file content that lists the two URLs plus two firewall rules for the payroll intranet. Below I give everything you can copy & save into the three files your assignment needs, and I also explain how to save the official Cisco pages yourself.

Important: because I can’t browse, I’m not pasting or saving Cisco web pages; I’m giving:
- recommended official Cisco URLs to download (you should open and Save As / Print→Save as PDF), and
- original configuration instructions and examples you can save as your “offline copies.”

1) Recommended official Cisco pages to download (open these in your browser and save them)
- NAT (Cisco IOS NAT docs / NAT FAQ): https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/24250-natfaq.html
- Firewall (Cisco ASA / Firewall configuration guides / product pages): https://www.cisco.com/c/en/us/products/security/firewalls/index.html

(If the first link redirects or you prefer IOS XE NAT or a particular IOS version, search Cisco for “Configuring NAT” + your IOS version or for “Cisco ASA configuration guide” + ASA version. Use Cisco’s search if needed.)

How to save the official pages for offline submission
- Open each URL in your browser.
- Use File → Save As → Webpage, HTML only or Complete, or Print → Save as PDF (this produces a PDF with the page content).
- Store those saved files with names like Cisco_NAT_official.html (or .pdf) and Cisco_Firewall_official.html (or .pdf).

2) Offline text file: NAT_instructions.txt
Copy the text below and save it as NAT_instructions.txt (this is an original, portable set of instructions for typical Cisco IOS NAT/PAT; adapt IPs to your network).

---
Title: Cisco IOS NAT (PAT) — example instructions (save offline)

Goal: Provide Internet access to an internal network 192.168.1.0/24 using PAT (NAT overload), plus one example of static NAT for a server.

Assumptions and example addressing:
- Router outside interface: GigabitEthernet0/0 with public IP 203.0.113.2
- Router inside interface: GigabitEthernet0/1 with IP 192.168.1.1
- Internal network: 192.168.1.0/24
- Payroll server (internal): 192.168.1.10
- Public address to map to payroll: 203.0.113.10

Step-by-step (Cisco IOS commands):

1. Configure interfaces
configure terminal
interface GigabitEthernet0/0
description Outside (Internet)
ip address 203.0.113.2 255.255.255.0
ip nat outside
no shutdown
exit

interface GigabitEthernet0/1
description Inside (LAN)
ip address 192.168.1.1 255.255.255.0
ip nat inside
no shutdown
exit

2. Create access list to identify inside addresses to be translated (for dynamic NAT / PAT)
access-list 1 permit 192.168.1.0 0.0.0.255

3. Configure PAT (NAT overload) so the inside network shares the outside IP
ip nat inside source list 1 interface GigabitEthernet0/0 overload

4. Static NAT (map public 203.0.113.10 TCP 443 to internal payroll server 192.168.1.10 TCP 443)
ip nat inside source static tcp 192.168.1.10 443 203.0.113.10 443

5. Verify
show ip nat translations
show ip nat statistics
show running-config | section ip nat

6. Troubleshooting
- Ensure ip nat inside/outside are set on proper interfaces.
- If translations don’t appear for static mapping, confirm traffic is hitting the router (packet captures or debug ip nat).
- Clear translations if needed:
clear ip nat translation *

Notes:
- For larger deployments consider NAT pools and ACLs limiting translated addresses.
- For IPv6, use a different approach (NAT64, etc.), not covered here.
---

3) Offline text file: Firewall_instructions.txt
Copy the text below and save as Firewall_instructions.txt. It gives examples for ASA and for Cisco IOS Zone-Based Firewall (choose the type matching your equipment).

---
Title: Cisco Firewall configuration — examples for ASA and IOS Zone-Based Firewall (save offline)

A. Cisco ASA example: allow HTTPS to an internal server, default deny otherwise
Assumptions:
- ASA outside interface public IP 203.0.113.2
- Payroll server internal IP 192.168.200.10 (behind ASA)
- Accounting users in internal network 192.168.10.0/24

Commands (ASA CLI):
1. Permit HTTPS from internal network to payroll server (if traffic originates from inside to server on DMZ/internal, adjust zones accordingly).
access-list INSIDE_TO_DMZ extended permit tcp 192.168.10.0 255.255.255.0 host 192.168.200.10 eq 443
access-group INSIDE_TO_DMZ in interface inside

2. If the payroll server is reachable from the outside via public IP, permit inbound HTTPS on outside:
access-list OUTSIDE_IN extended permit tcp any host 203.0.113.10 eq 443
access-group OUTSIDE_IN in interface outside

3. Verify
show access-list
show running-config access-group

Notes:
- ASA has implicit deny at end of ACLs for applied access-groups; be explicit if you use multiple ACLs.
- Use logging on ACL matches: add log or log informational to the access-list lines if desired.

B. Cisco IOS Zone-Based Firewall (ZBF) example: create zones, allow HTTP/S from accounting zone to payroll zone
Assumptions:
- interface Gig0/1 -> accounting (192.168.10.0/24)
- interface Gig0/2 -> payroll server VLAN (192.168.200.0/24)

Commands (IOS):
1. Define ACLs to match traffic
ip access-list extended ACC_TO_PAYROLL
permit tcp 192.168.10.0 0.0.0.255 host 192.168.200.10 eq 443
!

2. Define zones and assign interfaces
zone security ACCOUNTING
zone security PAYROLL

interface GigabitEthernet0/1
zone-member security ACCOUNTING
!

interface GigabitEthernet0/2
zone-member security PAYROLL
!

3. Create class-map and policy-map
class-map type inspect match-any CMP_ACC_PAY
match access-group name ACC_TO_PAYROLL
!
policy-map type inspect PM_ACC_TO_PAY
class CMP_ACC_PAY
inspect
!
zone-pair security ZP_ACC_TO_PAY source ACCOUNTING destination PAYROLL
service-policy type inspect PM_ACC_TO_PAY
!

4. Verify
show zone security
show policy-map type inspect
show zone-pair security

Notes:
- ZBF is stateful; create appropriate ACLs for return traffic or use inspect.
- Logging via syslog for policy matches: configure logging and set appropriate severity.

General firewall deployment tips:
- Keep a default deny (implicit or explicit); add only the minimal allow rules needed.
- Use least-privilege: restrict by source IP/subnet, destination IP, and port.
- Enable logging for all allow/deny events; centralize logs to SIEM or syslog for audit.
- Test rules carefully (staging environment if possible) and keep backup configs.
---

4) Single text file content (URLs + two payroll firewall rules)
Copy the following into one text file (e.g., NAT_and_Firewall_URLs_and_Rules.txt). This file must include the two URLs and two example firewall rules formatted with the required fields.

---
File: NAT_and_Firewall_URLs_and_Rules.txt

Official Cisco URLs to save offline:
1) NAT (Cisco NAT FAQ / IOS NAT documentation):
https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/24250-natfaq.html

2) Firewall (Cisco Firewalls / ASA and product docs):
https://www.cisco.com/c/en/us/products/security/firewalls/index.html

Firewall rules for the Accounting payroll intranet (assumptions: default policy = deny all, logging/auditing enabled):

Rule 1 — Payroll Web Access (Accounting → Payroll server)
- Purpose: Allow accounting staff to access the payroll web application (secure HTTPS) hosted on the payroll server so employees can run payroll operations.
- Affected service/application/information: Payroll web application (HTTPS), port TCP 443.
- Who will be affected: Users in the Accounting subnet (example 192.168.10.0/24). Only Accounting users need this access.
- Rule (general description): Permit TCP traffic from source network 192.168.10.0/24 to host 192.168.200.10 destination port 443. Log accepted connections. All other traffic to the payroll server is denied by default.
- Example (conceptual ACL): permit tcp 192.168.10.0/24 any host 192.168.200.10 eq 443 log

Rule 2 — Administrative Maintenance (IT → Payroll server)
- Purpose: Allow IT administrators to remotely manage the payroll server for updates and troubleshooting.
- Affected service/application/information: Remote management services – SSH (TCP 22) for secure shell access; RDP (TCP 3389) only if GUI access is required and allowed under policy.
- Who will be affected: IT operations / systems administrators in the IT management subnet (example 192.168.5.0/24). These are the only hosts permitted to manage the payroll server.
- Rule (general description): Permit TCP traffic from source 192.168.5.0/24 to host 192.168.200.10 on ports 22 and/or 3389. Require logging. Explicitly deny RDP/management from any other subnets. Apply rate-limiting or multifactor authentication at server if possible.
- Example (conceptual ACL entries):
permit tcp 192.168.5.0/24 host 192.168.200.10 eq 22 log
permit tcp 192.168.5.0/24 host 192.168.200.10 eq 3389 log
deny tcp any host 192.168.200.10 eq 3389 log

Notes about the rules:
- Default deny already in place; these are the only explicit allows for payroll.
- All firewall logs are audited; alerts should be created for denied attempts to the payroll host, and ensure logs are forwarded to central logging (syslog/SIEM).
- If external (internet) access to payroll is needed, map only the necessary port (HTTPS) via a static NAT public IP and permit inbound only from trusted networks or via VPN.

End of file
---

If you want, I can:
- Produce ready-to-save .txt file contents packaged here for you to copy (I’ve already provided the text above), or
- If you paste the official Cisco URLs you find, I can fetch (if browsing is enabled) or help you extract and format their content for offline submission.

Would you like me to:
- Format the three files as downloadable text blobs here for you to copy,
- Or walk you step-by-step through saving the official Cisco pages in your browser?