Question

For this activity, you have two tasks:

Find two instruction manuals, steps, etc., one for NAT configuration and a second one for firewall configuration.
Create a set of rules for a firewall used in a hypothetical business network.
One of the most popular network technology developers is Cisco, so we’ll use it for this activity. Go online and search the web for instructions on how to perform NAT configuration for modern Cisco routers. Make sure the site is an OFFICIAL Cisco site. Create an offline version of the information. (Either copy and paste it into a text document, or save the web page) Create a second text document that contains the full URL for the source of the information.

Next, perform the same search for the firewall configuration of Cisco devices. Once again, copy and paste the instructions you find, or save the webpage. Add the full URL for this site to the text document, which already has the NAT configuration site URL. You may have this information from a prior activity if you are using a Cisco router; if so, you can use the same documents or links, if appropriate.

Finally, let’s put some of these ideas into practice and come up with rules that would make sense for a hypothetical small business network (i.e., 20 or so staff working in various parts of the company such as sales, management, IT department, and accounting/human resources). In your document listing the two URLs for NAT and firewall configuration, add two rules that would make sense for the firewall of an intranet used by the accounting staff to fulfill payroll. The two rules should include the following information:

The purpose of the firewall
The affected service, application, or information
Who will be affected by the rules
The rules themselves
Just to make it more interesting, assume that the firewall already has one rule: All traffic, by default, is blocked. You should also assume that you’ve already configured the network to audit all logs.

The rules can be explained in general terms—that is, you don’t need to write the specific line of code that would be required—and you should identify specific port numbers. Examples of rules can easily be found online; just make sure the rules are suitable for a small business environment.

Include the following materials in your submission for this activity:

One text file that lists two URLs (for NAT configuration and firewall configuration) and two examples of firewall rules
Two files that are accessible offline and include instructions for NAT configuration and firewall configuration (The files should be pulled from official Cisco support information and can be provided in TXT or HTML formats, or even PDF if you pull an instruction manual offline.)

Answer 1

Short answer up front: I can’t fetch or save live web pages for you, but below I give (A) two official Cisco pages you should use, (B) exact instructions you can copy into two offline files (one for NAT configuration, one for firewall configuration) that match Cisco IOS/IOS-XE practices, and (C) two firewall rules (with purpose, affected service, affected users, and the rule text + ports) for your small-business accounting/payroll intranet. You can copy the text I provide into files (for example NAT_config.txt and Firewall_config.txt) and also save the Cisco pages I point to if you want the official pages themselves.

1) Official Cisco pages to use/supply (full URLs)
- NAT configuration (Cisco IOS/IOS‑XE NAT documentation / NAT overview & examples)
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/15-mt/nat-15-mt-book/nat-overview.html

- Firewall configuration (Zone-Based Policy Firewall for IOS / IOS Security — Zone‑based policy firewall)
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_fw/configuration/15-mt/sec-fw-15-mt-book/sec-zone-based-policy.html

Note: If you prefer Cisco ASA/FTD firewall guides instead of IOS zone-based firewall docs, use Cisco’s ASA configuration guides available from Cisco’s Security product pages:
https://www.cisco.com/c/en/us/support/security/asa-5500-x-series-next-generation-firewalls/products-installation-and-configuration-guides-list.html

How to save those pages offline:
- Open each URL in your browser (on the Cisco site).
- Use your browser File -> Save Page As… to save as HTML (or print to PDF).
- Or copy/paste the page text into a text file and save NAT_config.txt and Firewall_config.txt.

2) Offline file contents you can copy into two files

File: NAT_config.txt
(Use this text to save as an offline reference. It is a concise, practical NAT configuration guide for modern Cisco IOS/IOS‑XE routers.)

- Purpose
Configure NAT so internal private addresses can reach the Internet (and optionally provide static mappings for inbound services).

- Typical NAT types to configure
1. Static NAT — one-to-one mapping between a private IP and a public IP
2. Dynamic NAT — pool of public IPs mapped to internal IPs
3. PAT / NAT overload — many internal IPs share one public IP using unique ports (most common for small business)

- Example network
- Internal (inside) subnet: 10.10.0.0/24
- Router outside interface public IP: 198.51.100.10
- Router inside interface IP: 10.10.0.1

- Example: Configure PAT (NAT overload) so all inside hosts share the router's public IP
1. Define inside and outside interfaces
interface GigabitEthernet0/0
ip address 10.10.0.1 255.255.255.0
ip nat inside
interface GigabitEthernet0/1
ip address 198.51.100.10 255.255.255.248
ip nat outside
2. Create an access list to match inside local addresses (used by NAT)
ip access-list standard NAT_INSIDE
permit 10.10.0.0 0.0.0.255
3. Configure NAT overload using the outside interface IP
ip nat inside source list NAT_INSIDE interface GigabitEthernet0/1 overload

- Example: Static NAT for an internal server (map 10.10.0.50 to public 198.51.100.50)
ip nat inside source static 10.10.0.50 198.51.100.50

- Example: Port forward (PAT static translation) for inbound HTTP to an internal web server
ip nat inside source static tcp 10.10.0.50 80 198.51.100.50 8080

- Notes and best practices
- Make sure ip nat inside/outside are applied on the correct interfaces.
- For PAT, use an access list to specify the internal addresses to be translated.
- Ensure ACLs and firewall rules on the router/firewall allow the translated traffic (especially for inbound static mappings).
- Document all static mappings; keep NAT table and translations small and manageable.
- On routers with multiple VRFs or security contexts, use NAT configuration per VRF/context as per official Cisco docs.
- For large or more secure deployments, consider stateful firewall devices or ASA/FMC/FTD appliances for inbound service exposure.

File: Firewall_config.txt
(Use this text to save as an offline reference. It is a concise, practical firewall configuration guide for Cisco IOS Zone‑Based Policy Firewall (ZBFW) concepts and sample steps.)

- Purpose
Use the IOS Zone-Based Policy Firewall to define zones, inspect traffic between zones, and control what services are permitted or denied.

- Key concepts
- Zones: group interfaces into logical security zones (e.g., inside, outside, mgmt, accounting).
- Class-maps: match traffic by protocols or ACLs.
- Policy-maps: set actions (inspect, pass, drop) for class-maps.
- Zone-pairs: attach a policy to traffic flowing from one zone to another.

- Typical steps to create a simple zone-based policy (high level)
1. Create zones:
zone security INSIDE
zone security OUTSIDE
2. Assign interfaces to zones:
interface GigabitEthernet0/0
zone-member security INSIDE
interface GigabitEthernet0/1
zone-member security OUTSIDE
3. Create class map(s) to match desired traffic:
class-map type inspect match-any CM_ALLOW_PAYROLL
match protocol http
match protocol https
4. Create policy map and specify inspect/pass/drop:
policy-map type inspect PM_INSIDE_TO_OUTSIDE
class CM_ALLOW_PAYROLL
inspect
class class-default
drop
5. Create zone-pair and apply the policy:
zone-pair security ZP_INSIDE_TO_OUTSIDE source INSIDE destination OUTSIDE
service-policy type inspect PM_INSIDE_TO_OUTSIDE
6. Verify with show commands:
show zone security
show policy-map type inspect
show access-lists
show logging (or show log) to check audit logs (depending on device)

- Example allowed services and ports (common)
- HTTP(S): TCP 80, 443
- SSH for admin: TCP 22 (limit to management subnet)
- RDP for Windows admin remote access: TCP 3389 (limit to IT admin hosts)
- DB (Postgres/MySQL): TCP 5432 or 3306 (restrict who can reach these)

- Notes and best practices
- Default implicit action in ZBFW: traffic that is not explicitly permitted is dropped.
- Use ACLs or class-maps to narrow matches; avoid broad permit-any rules.
- Log allow and deny events for critical services (you said logs are audited—keep that on).
- Separate management access onto a dedicated management VLAN and limit admin protocols (SSH) to IT subnet only.
- Keep firewall rules simple and documented; test changes in a maintenance window.

3) Two firewall rules for the accounting/payroll intranet
Assumptions (per your instructions):
- All traffic is blocked by default.
- Audit logging is enabled for all firewall events.
- Network addressing (example):
- Accounting VLAN/subnet: 10.10.20.0/24
- Payroll application server: 10.10.50.10
- Payroll database server: 10.10.50.20
- Payroll application server is the only server that should query the DB server.

Rule 1: Allow accounting staff to use the payroll web application (HTTPS)
- Purpose
Allow accounting staff to securely access the payroll web application used to run payroll and access payroll reports.
- Affected service / application / information
Payroll web application (HTTPS), port TCP 443 (and optionally TCP 8443 if the app uses that alternate HTTPS port).
- Who will be affected
Accounting staff workstations in the Accounting VLAN (10.10.20.0/24) and the payroll web server (10.10.50.10).
- Rule (general description)
Permit TCP traffic from source 10.10.20.0/24 to destination 10.10.50.10 on destination port 443 (and port 8443 if required). Log accepted connections. All other traffic from accounting to payroll servers is denied by default.
- Example pseudo-policy text
Allow: src 10.10.20.0/24 -> dst 10.10.50.10 : TCP dst-port 443 (log)
Implicit/explicit: deny any other ports to 10.10.50.10 from 10.10.20.0/24 (log)

Rule 2: Restrict database access so only the payroll application server can query the DB
- Purpose
Prevent user workstations and other servers from directly accessing payroll database credentials or data; protect integrity and confidentiality of payroll records.
- Affected service / application / information
Payroll database service (example: PostgreSQL TCP 5432 or MySQL TCP 3306). Choose the DB port matching your DB product; here we use PostgreSQL TCP 5432 as an example.
- Who will be affected
- Allowed: payroll application server 10.10.50.10 -> payroll DB server 10.10.50.20 on TCP 5432
- Denied: accounting workstations (10.10.20.0/24) and all other hosts attempting to reach 10.10.50.20 on TCP 5432
- Rule (general description)
Permit TCP traffic from source 10.10.50.10 to destination 10.10.50.20 on destination port 5432 (log). Explicitly deny TCP traffic from any other source to 10.10.50.20 on port 5432 (log).
- Example pseudo-policy text
Allow: src 10.10.50.10 -> dst 10.10.50.20 : TCP dst-port 5432 (log)
Deny: src any EXCEPT 10.10.50.10 -> dst 10.10.50.20 : TCP dst-port 5432 (log and alert)

Notes on implementation and testing
- Because default policy is block, add the two allow rules above in the correct direction/zone (e.g., INSIDE → SERVER_ZONE) and ensure the deny on DB port is explicit (or rely on default deny for anything not permitted, but explicit deny with logging is preferable for audit).
- Limit SSH/RDP/management access to the payroll servers to IT admin subnet only; e.g., allow TCP 22 from 10.10.30.0/24 (IT) to servers, deny from accounting.
- Monitor firewall logs after deploying rules for unexpected denials from legitimate clients and adjust if necessary (e.g., add DNS/LDAP or NTP access as needed).
- Document each rule in the change control record (what, why, who approved, rollback plan).

Optional: Example minimal IOS-style ACL snippets (for illustration only)
- Allow accounting web access to payroll server (HTTPS):
ip access-list extended ACC_TO_PAYROLL
permit tcp 10.10.20.0 0.0.0.255 host 10.10.50.10 eq 443
deny ip any host 10.10.50.10 log
- Restrict DB access:
ip access-list extended DB_RESTRICT
permit tcp host 10.10.50.10 host 10.10.50.20 eq 5432
deny tcp any host 10.10.50.20 eq 5432 log
permit ip any any

(If using Zone-Based Policy Firewall, implement the above as class-map matches and policy-map inspect rules; if using ASA/FTD, create access rules or modular policies with logging enabled.)

4) What you should submit for the activity
- A text file listing the two URLs (the NAT and firewall Cisco pages) and the two firewall rules (you can copy the “1) Official Cisco pages” and “3) Two firewall rules” sections above into one text file).
- Two offline files containing the NAT and firewall instructions (copy the NAT_config.txt and Firewall_config.txt contents above into separate files NAT_config.txt and Firewall_config.txt). If you must include the official Cisco pages verbatim, open the URLs above in your browser and save each page as HTML or PDF as required by your assignment.

If you want, I can:
- Generate the exact text file contents ready for copy/paste named (NAT_config.txt, Firewall_config.txt, URL_and_rules.txt), or
- Provide more specific example IOS/ASA commands for your exact addressing and services, or
- Walk you step-by-step through saving the Cisco pages and verifying their content.

Which of those would you like next?