Cuestións resoltas sobre pfSense

Pregunta 1 – Introducción á ferramenta

Cuestións

1. Qué é PfSense?
2. Qué funcionalidades ten?
3. Cales de ellas coñeces?
4. Por qué xurdíu OpnSense e en qué se diferencian?
5. Qué outras ferramentas con funcionalidade de firewall coñeces?

Solucións

Pregunta 23 - Cuestións básicas de pfSense

Cuestións

1. Cal é o termo que se utiliza para referirse a rede que está separada do resto da rede local e que provee servizos ós usuarios fora da rede local?
2. Cales son os requisitos mínimos de pfSense 2.4 no tocante a CPU, RAM e espazo en disco?
3. Canta memoria require unha entrada da táboa de estados?
4. Por qué e unha boa idea (tanto para pfSense como para a descarga doutro software) facer uso dos checksums?
5. Cal é a mellor elección de sistema de ficheiros para unha organización que (a) require sorporte para encriptación a nivel de sistema de ficheiros e data deduplication? (b) require a maior compatibilidade hacia atrás posible?
6. Identifica os dous lugares onde se pode facer a asignación de interfaces en pfSense
7. Identifica cando menos catro tipos de configuracións válidas para unha interface pfSense
8. Cal é a configuración por defecto para as Block Private Networks e os enderezos de loopback ... (a) na interface WAN ? (b) na interface LAN? (c) por qué?
9. Identifica dous lugares na interfaz gráfica onde se pode configurar a zona horaria
10. Identifica cando menos tres parámetros que poden ser configurados no Setup Wizard

Solucións

1. Zona desmilitarizada.
2. Mínimos --> CPU: 500 MHz; RAM: 512 MB; espazo en disco: 1 GB. Recomendados --> CPU: 500 MHz; RAM: 512 MB; espazo en disco: 1 GB. Fonte: Documentación oficial de pfSense
3. Aproximadamente 1 KB. Fonte: Documentación de pfSense
4. Os checksums son importantes para asegurar a integridade dunha descarga; así verificando o checksum dun binario pódese confirmar que a descarga finalizou correctamente e que non foi alterada por un terceiro
5. (a) ZFS. (b) UFS Comentarios: Consulta que é a data deduplication
6. A través da consola / shell e a través da interface gráfica web
7. Posibles respostas válidas: Static; DHCP; PPTP; PPPoE; PPP; L2TP.
8. (a) Enabled. (b) Disabled. (c) As Block Private Networks están bloquedas na interface WAN porque os enderezos privados por definición non son enrutables e nunca deberían pasar a través da interface WAN interface. Na interface LAN e outras interfaces locais, o habitual e que queramos que funcionen os enderezos privados
9. A través do Setup Wizard e a través de System | General Setup.
10. Posibles respostas válidas: Hostname, Domain, DNS Servers, Timezone, NTP Server, WAN Interface, LAN Interface,Password.

Pregunta 24 - Cuestións avanzadas de pfSense

Cuestións

1. (a) Qué capa de transporte utiliza DHCP BOOTP? (b) Qué portos utiliza DHCP?
2. (a) Qué capa de transporte utiliza BOOTP? (b) Qué portos utiliza BOOTP?
3. Cales son os Router Advertisement (RA) flag settings que corresponden a habilitar Stateless DHCP (coñecido coma SLAAC)?
4. Cales son os dous servizos que pfSense ten para DNS?
5. (a) Qué capa de transporte utiliza DNS? (b) Qué portos utiliza DNS?
6. Que ventaxa ten DDNS sobre os o servizo tradicional DNS?
7. Qué tres tipos de autenticación soporta o servico de portal cautivo de pfSense?
8. Qué campo debe existir na páxina de login do portal cautivo cando está habilitada a autenticación por voucher?
9. Qué son as management information bases (MIBs)?
10. Qué e SNMP? CAl é o seu porto por defecto?

Solucións

1. (a) Transport Control Protocol (TCP). (b) 67 e 68.
2. (a) User Datagram Protocol (UDP). (b) 67 e 68.
3. M flag: 0; O flag: 1; L flag: 1; A flag: 1.
4. DNS Resolver (por defecto) e DNS Forwarder.
5. (a) UDP. (b) 53.
6. Pode ser actualizado moito máis rápido que o DNS tradicional facendoo axeitado para escenarios nos que o enderezo IP asociado cun dominio cambia frecuentemente
7. User Manager, Voucher, and RADIUS.
8. <input name=”auth_voucher” type=”text”>.
9. A estrutura na que os datos de xestión son organizados xerárquicamente nun dispositivo xestionada con SNMP. Fonte: Base de información xestionada
10. O Protocolo simple de administración de rede ou SNMP (do inglés Simple Network Management Protocol) é un protocolo da capa de aplicación que facilita o intercambio de información de administración entre dispositivos de rede. Os dispositivos que normalmente soportan SNMP incluyen routers, switches, servidores, estacións de traballo, impresoras, bastidores de módem e moitos outros. Permitelles ós administradores supervisar o funcionamiento da rede, buscar e resolver os seus problemas, e planifiar o seu crecemento. Os seus portos por defecto son 161/UDP e 162/UDP (Trap)

Pregunta 25 - Configuración de VLANs

Cuestións

1. Cal é o estandar do IEEE para VLAN tagging?
2. Calesson os ID numbers míimos e máximos para VLAN tags?
3. Nomea dous métodos utilizados para VLAN hopping.
4. Cal debe ser o valor do campo priority code point (PCP) para asegurar o tratamento coñecido coma best effort?
5. Cal é a principal vantaxe do QinQ VLAN tagging?
6. Identifica dúas ventadas do uso de link aggregation.
7. Qué regra crea automáticamente o firewall pfSense para unha interface opcional (coma OPT1)?
8. Identifica dous tipos de portos que deben ser configurados no switch para que a configuración VLAN quede completada.
9. Como se chama o VLAN ID por defecto?
10. Identifica métodos para configurar VLANs en switches Cisco.

Solucións

1. 802.1Q.
2. 1, 4094.
3. Switch spoofing, double tagging.
4. 7.
5. Incrementa o número posible de VLANs (16,752,649 con un único nivel de anidamento, sendo posible un número maior con tamén maior nivel de anidamento).
6. Increased throughput (aumento de rendemento) e redundancia.
7. Ningunha (temos que crear nos as regras que permiten accesos dende as VLANs a outras redes).
8. Trunk ports and VLAN ports.
9. PVID.
10. Static, Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP).

Pregunta 26 - Filtrado de tráfico con reglas

Cuestións

1. Cndo creamos regras no filtrado, qué principio deberíamos aplicar?
2. Cal é a diferenza entre Block e Reject no filtrado de tráfico?
3. Our network has two interfaces: WAN and LAN. The only two rules created so far are the IPv4 and IPv6 "Allow LAN to any" rules that pfSense creates when the LAN interface is initially assigned. We create a rule to block Recode with the following settings: Action = Reject; Interface = LAN; Address Family = IPv4 + IPv6; Protocol = TCP; Source = LAN net; Destination = 151.101.21.52 (Recode's IP address). We place the rule at the bottom of the LAN rules table. What happens when we try to access Recode?

Assume we have created the same rule as the one in Question 2, but we place it at the top of the LAN rules table. Now what happens when we try to access Recode?

1. Assume we have the same ruleset as Question 2, but we also create a floating rule with the following settings; Action = Pass; Quick = Disabled; Interface = LAN; Direction = in; Address Family = IPv4+IPv6; Protocol = Any; Source = Any; Destination = Any. The Block Recode rule is at the top of the LAN rules table. (a) After we enable the new floating rule, what happens when we try to access Recode? (b) If we change the Quick setting on this rule to Enabled and reload the firewall rules, what happens when we try to access Recode? (c) After we change the Quick setting to Enabled, what effect do the "Allow LAN to any" rules have on traffic?
2. Nomea catro tipos de alias.
3. Describe tres métodos para crear alias con múltiples enderezos IP.
4. Cal é un tipo de Virtual IP introducido con pfSense 2.0?

Solucións

1. Principio de mínimo privilegio
2. Block descarta o tráfico silenciosamente mentras que Reject devolve un paquete (RST para TCP ou ICMP Port Unreachable para UDP).
3. We will be able to connect to Recode; the block rule will have no effect because it was placed after the "Allow LAN to any" rule.
4. We will not be able to connect to Recode; the block rule will match the traffic to Recode before the “Allow LAN to any” rule.
5. (a) We will not be able to connect to Recode; the new “default allow” rule will be invoked after the block rule. (b) We will be

able to connect to Recode; the new "default allow" rule will be invoked before the block rule. (c) The default "Allow LAN to any" rules have no effect on traffic flow anymore because they are never reached; the floating "default allow" rule is invoked first.

1. IP, Network, Port, URL. Fonte: Documentación oficial sobre alias
2. (a) Navigate to Firewall | Aliases, click on the IP tab, click on Add, and enter each IP address manually; (b) navigate to Diagnostics | DNS Lookup, perform a DNS lookup, and create an alias from it; (c) navigate to Firewall | Aliases, click on the Import button, do a bulk import.
3. IP Alias

Pregunta 27 - NAT

Cuestións

1. Name any two technologies other than NAT developed to deal with the issue of IPv4 address exhaustion.
2. If we initially install pfSense and configure the interfaces with IPv4 addresses only, do we need to alter the Outbound NAT settings? Why or why not?
3. If Automatic Outbound NAT is selected, how many rules are created for each non-WAN interface?
4. We have an FTP server that must be made accessible to the internet and also must be accessible within our private network. We want to assign this server its own public IP address. What type of NAT should we use?
5. What will happen if we create a Port Forwarding entry and set Filter rule association to None, assuming we do not make any

changes to the firewall rules?

1. Why do we normally leave Source set to any on a Port Forwarding entry?
2. Assume we want to create a Port Forwarding entry for Remote Desktop Protocol (which normally runs on port 3389), but want to make RDP accessible from the internet on port 7000. (a) What should the Destination port range be set to? (b) What should the Redirect port range be set to?
3. (a) Name at least one reason to implement NPt on an IPv6 network. (b) What alternative to NPt does the IETF recommend?

Solucións

1. Classless networks (CIDR), private networks (RFC 1918

networks), and IPv6. Any two would be acceptable.

1. No; we do not need to alter the Outbound NAT settings because outbound NAT rules were generated for each of the non-WAN interfaces.
2. Two rules (one for IPsec and the other for all other traffic).
3. 1:1 NAT.
4. The port forwarding traffic will be blocked by the firewall.
5. We normally don’t care what the source of the incoming traffic is.
6. (a) 7000; (b) 3389.
7. (a) Multihoming and route aggregation are both valid answers. (b) DHCPv6.

Pregunta 28 - Traffic Shaping

Cuestións

1. What is the purpose of traffic shaping?
2. (a) Identify the three types of queuing supported by the pfSense traffic shaper. (b) Identify a queuing discipline that tends to

ensure that low-priority traffic is not starved of bandwidth. (c) Identify a queuing discipline that uses a two-part nonlinear curve and decouples bandwidth from latency.

1. Can we implement Layer 7 traffic shaping with the built-in pfSense traffic shaper? Assume we are using the current version of pfSense.
2. Identify the two wizards with which we can implement traffic shaping in pfSense using the built-in traffic shaper.
3. Identify a type of queue which provides for end-to-end notification of network congestion without dropping packets.
4. Under which tab can you find the firewall rules generated by the built-in pfSense traffic shaping wizard? (Hint: It is the only rules category that has a Match option for Action.)
5. What interfaces are enabled by default when we install Snort?
6. How can we determine the length of a pfSense queue?

Solucións

1. To ensure that network traffic conforms to certain predefined constraints.
2. (a) Priority queuing (PRIQ), class-based queuing (CBQ), and Hierarchical Fair-Service Curve (HFSC). (b) Class-based queuing. (c) Hierarchical Fair-Service Curve.
3. No; we can only implement it with third-party packages such as Snort.
4. (a) The Multiple Lan/Wan configuration wizard; (b) the Dedicated Links wizard.
5. Explicit Congestion Notification.
6. The Floating Rules tab.
7. None; we have to manually enable each interface.
8. By navigating to Status | Queues and looking under the Length column.

Pregunta 29 - VPN

Cuestións

1. Name the two most common types of VPN deployments.
2. (a) Identify the three VPN protocols supported by the current version of pfSense. (b) Which protocol does not natively support

encryption?

1. Identify the three protocols encompassed by IPsec.
2. If we are setting up an IPsec connection and Key Exchange version is set to Auto, what will happen if we try to initiate a

site-to-site connection to (a) a firewall where the Key Exchange version is set to IKEv1? (b) a firewall where the Key Exchange version is set to IKEv2? (Assume that the rest of the configuration is correct.) 5. (a) Which port must always be unblocked for IPsec to function? (b) What is the default OpenVPN port? 6. What are the three authentication options for L2TP? 7. What option was added to the Diffie-Hellman key configurationin pfSense 2.4? 8. With OpenVPN, what alternatives are there to authentication through certificates managed through the pfSense Certificate Authority Manager?

Solucións

Pregunta 30 - XXX

Cuestións

1. Identify any three types of load balancing algorithms.
2. (a) What are the advantages of client-side load balancing? (b) What are the advantages of server-side load balancing?
3. What are the two modes of load balancing supported by the built-in pfSense load balancer?
4. If I am using pfSense's load balancer and I add a server to a server pool but no traffic from outside the network is reaching

the new server (and traffic from outside the network is reaching other servers within the pool), what is the likely cause? Assume that my server pool setup was functioning correctly before I added the server.

1. Identify which of the following can be synchronized using pfSense's High Availability Sync. (a) firewall rules; (b) packages;

(c) virtual IPs; (d) system logs.

1. In a normal CARP configuration, do we need to create a virtual IP for the PFSYNC interface? Why or why not?
2. Assume we have a functioning CARP failover group in which all options are selected in Select options to sync on the System |

High Availability Sync page. On the backup firewall, we create a new firewall rule. What happens to this rule when we navigate to Status | Filter Reload and on the master firewall and click on the Force Config Sync button?

1. Why is it important to set the Advertising frequency in a CARP setup with multiple backup firewalls?
2. Assume you are required to implement load balancing on a pfSense firewall using the Least Connections algorithm. What is

the easiest way of achieving this?

1. Assume that we need to keep CARP disabled through a reboot. How do we do this?

Solucións

Pregunta 31 - YYY

Cuestións

1. What document is provided by many ISPs that defines the

aspects of service to be provided to the client?

1. What is policy-based routing?
2. (a) If we have two separate internet connections and we want to combine them for bandwidth aggregation, what form of

redundancy and high availability should we use in our gateway group? (b) If we have two separate internet connections and we only want to use the secondary connection if the first one is down, what form of redundancy and high availability should we use?

1. What will happen if we configure a gateway group and do not add or change the firewall rules? Assume our setup is otherwise

correct.

1. In a multi-WAN setup, under what circumstances must you add a static route for an external DNS server?
2. If we add multi-WAN capabilities to a CARP failover group, how many virtual IPs do we need to add?
3. What option can be used to ensure that all traffic to a certain website is routed through the same WAN interface as long as

there are states that refer to the connection?

1. If you have set up a gateway group with load balancing and an external "what is my IP" website keeps reporting no change in

your IP address, what could be the cause? Identify any three causes.

Solucións

Pregunta 32 - ZZZ

Cuestións

1. What is the key difference between routing and bridging?
2. (a) What class of routing protocols involves a router only informing its neighbors of topology changes? (b) What class of

routing protocols involves each router constructing a map of its connectivity to the network?

1. Identify two methods we can use to deal with the problem of return traffic not following the same route as the traffic

originally sent when configuring static routes.

1. (a) We want to utilize RIP v2 as our routing protocol. What pfSense package should we install? (b) We want to utilize OSPF

as our routing protocol. What pfSense package can we use?(Identify either one.) (c) What is the best choice if we want to redistribute OSPF routes to BGP neighbors?

1. What is the first step in implementing policy-based routing?
2. Identify the two spanning tree protocols supported by pfSense bridging.
3. We have a CARP failover group and we want to bridge two interfaces on the failover group. What issue will this cause?
4. (a) What diagnostic tool found in the pfSense web GUI can we use to diagnose routing problems? (b) How are static routes denoted in this tool?

Solucións

Pregunta 33 - XYZ

Cuestións

1. What two methods can be used to install pfSense packages?
2. What is the default port on which a Squid proxy will listen?
3. We have added a firewall rule to block access to a certain website from all local networks and we have confirmed that the rule works as intended. (a) After we install the Squid proxy server, what will be the outcome when we try to access this website? (b) After we enable the Squid proxy server, what will be the outcome when we try to access the website? For both (a) and (b), assume we have not done any additional configuration to Squid.
4. If we want to block a country from accessing our network, what package provides the easiest way of doing this?
5. Identify the different states of interesting ports in an Nmap probe.
6. If we want to add a load balancing group and also want email notifications if a server in the group goes down, which package should we install?
7. Identify the three modes in which Snort can be run.
8. Identify the three different protocols that can be specified in a Snort rule.
9. Identify any package that can be used for network monitoring (there are several).
10. (a) What is the difference between a Zabbix agent and a Zabbix proxy? (b) We want to enable SNMP trap monitoring. What Zabbix package should we install?

Solucións

Pregunta 34 - ZYX

Cuestións

1. What is the final step in troubleshooting a networking problem?
2. A site can be reached by pinging the IP address but pinging the hostname fails. What is a likely cause of this?
3. Name a wireless standard that uses the 2.4 GHz range (there are two).
4. Which wireless encryption standard sends challenges in the clear and is generally considered insecure now?
5. Identify a method of determining whether an interface is up or down from within the pfSense web GUI.
6. What tool can be used to monitor the pfSense state table, and can be used from within the web GUI or the command line?
7. What tool can be used to ping a site that blocks ICMP traffic but allows TCP traffic?
8. What are the two main purposes of traceroute?

Solucións