Unit 2: Advanced Networking and Network Defense

Lesson at a glance

| Item | Detail | | --------------------- | ------------------------------------------------------------------------------------- | | Suggested length | 5 × 60 minutes | | Recommended placement | Week 2 of Cyber II | | Prerequisite | Cyber I Unit 4; Cyber II Unit 1 | | Materials | pfSense or OPNsense VM (firewall), three lab subnets, Suricata or Snort, sample PCAPs |

Safety: All firewall and IDS testing happens inside the host-only lab. Never apply student-built rules to school production infrastructure.

Standards & credential alignment

• OffSec PEN-100: networking fundamentals for offensive/defensive ops.
• NIST SP 800-41: firewall guidelines.
• CIS Controls v8: Control 12 (Network Infrastructure Management), Control 13 (Network Monitoring).

Learning objectives

By the end of this unit, students can:

1. Design a 3-tier segmented network (DMZ, internal, management) on paper.
2. Build the design in a lab firewall (pfSense or equivalent).
3. Write firewall rules in default-deny posture with explicit allow-list exceptions.
4. Distinguish IDS (passive) from IPS (active) and from EDR.
5. Configure Suricata to alert on a known signature.
6. Recognize Zero Trust concepts: explicit verification, least privilege, assume breach.

Vocabulary

• VLAN - Virtual LAN. Logical segmentation on a switch.
• DMZ - Demilitarized zone; semi-trusted zone facing the internet.
• NAT - Network Address Translation; many private IPs share one public.
• Stateful firewall - Tracks connection state; allows reply traffic for outbound.
• Default-deny - Block everything; explicitly allow what's needed.
• IDS / IPS - Detection (alerts only) / Prevention (blocks).
• VPN - Virtual Private Network; encrypted tunnel.
• Zero Trust - Architecture that verifies every request, regardless of network location.

Pacing

| Day | Focus | Deliverable | | --- | --------------------------- | --------------------------------------------------------- | | 1 | Network segmentation design | Network diagram | | 2 | Build pfSense firewall | Working firewall with three interfaces | | 3 | Firewall rules + NAT | Documented rule set with default-deny | | 4 | IDS/IPS concepts + Suricata | One Suricata alert on known traffic | | 5 | Zero Trust + VPN concepts | Written response: how would Zero Trust change the design? |

Day 1 - Design the network

Pairs design a small enterprise:

       Internet
          |
       [Edge firewall / NAT]
          |
   +------+------+------+
   |             |      |
 [DMZ]      [Internal] [Mgmt]
 web/      finance/   admins
 mail      HR         IT only
 server    files      jump box

Rules to defend in writing:

• Internet → DMZ: allow 80/443 to web, 25/465/587 to mail.
• Internet → Internal: deny.
• DMZ → Internal: deny except specific service paths.
• Internal → DMZ: allow specific.
• Mgmt → Internal/DMZ: allow admin protocols (SSH/RDP) on a need-to basis.
• All zones → Internet: allow 443 outbound only; everything else logged and reviewed.

Day 2 - Build it in pfSense

Walk through:

1. Boot pfSense VM with three interfaces (WAN/LAN/OPT1).
2. Assign interfaces in the console.
3. Web UI on the LAN side.
4. Configure WAN as DHCP client (or static if your lab uses static).
5. Configure LAN and DMZ as separate subnets.
6. Confirm hosts in each subnet pull DHCP correctly.

Day 3 - Firewall rules

Implement default-deny:

• Block everything by default at each interface.
• Add rules per the design from Day 1.
• Apply, test, screenshot the rule list.
• Try to break it: from DMZ host, attempt to reach Internal host on SMB. Confirm blocked. Adjust if you intended to allow.

Day 4 - Suricata IDS

Install Suricata on the firewall (or on a dedicated monitoring VM with port mirror). Add the ET Open ruleset.

Generate known traffic: download the EICAR test string over HTTP from a controlled source. Confirm Suricata alerts. Read the alert: signature ID, source/dest, reasoning.

Day 5 - Zero Trust + VPN

Mini-lecture (20 min): NIST SP 800-207 Zero Trust core tenets.

• No implicit trust based on network location.
• Authenticate and authorize every request.
• Assume breach.

Activity (35 min): students write a 1-page memo describing how their Day 1 design changes under Zero Trust. Hint: the "internal" zone stops being a free-pass zone; identity becomes the perimeter.

Teacher background (read this before the lesson)

Most learners still think "the firewall" is a single box at the edge. This unit has to break that. Segmentation, default-deny, and Zero Trust are the same idea at three scales: don't trust a packet because of where it came from.

Common failure modes in the room:

1. Students write allow-all "so the lab works," then never tighten it.
2. Suricata is treated as a movie alert feed instead of a signature they must explain.
3. The Zero Trust memo becomes a slogan dump. Require one concrete change to their Day 1 diagram.

Teacher says, verbatim, before Day 3 testing: "If a rule you wrote would break the school or company network, you do not apply it there. You test it here. That is not caution. That is the job."

Materials checklist

• [ ] pfSense or OPNsense VM with three interfaces documented
• [ ] Three lab subnets labeled DMZ / Internal / Mgmt
• [ ] Suricata or Snort with ET Open (or equivalent) staged
• [ ] EICAR-over-HTTP generation path that stays inside the lab
• [ ] Printed Day 1 diagram worksheet and Day 5 memo rubric

Differentiation, IEP, and 504 supports

• Reading support: Provide a completed sample rule table with two rows filled; learners add the rest.
• Processing time: Day 1 design can be a provided topology they annotate instead of drawing from scratch.
• Motor / UI load: Pair for pfSense clicks; the recorder owns the written rule list.
• EL learners: Keep zone names (DMZ, Internal, Mgmt) on color cards all week.

Common misconceptions

• "Inside the firewall is safe." - Lateral movement is the dominant attack pattern. Internal segmentation matters as much as the perimeter.
• "IPS is always better than IDS." - IPS that mis-fires breaks production. Tune in IDS mode first; promote to IPS only when confident.
• "Default-deny means nothing works." - Default-deny means you can explain every allow. That is the professional standard.
• "Zero Trust replaces firewalls." - Zero Trust changes what you trust (identity and request), not whether you still segment networks.

Assessment

Day 1 design rubric (1–4): zones labeled, flows named, default-deny stated, one lateral-movement path blocked in writing.

• Day 1 design - rubric scored.
• Day 3 rule set - submitted with annotations (why each allow exists).
• Day 4 alert - screenshot + paragraph: signature ID, source/dest, why it fired.
• Day 5 Zero Trust memo - 1 page, rubric scored. Must change at least one implicit-trust path from Day 1.

Career connection

Network defense is how most organizations actually buy security: segmentation, monitoring, and the person who can explain a rule to a change board. This unit is that job, scaled to a lab.

Homework

Read the CISA Zero Trust Maturity Model 2.0 executive summary (Identity and Networks pillars). One paragraph: which pillar is this organization weakest on, and what would you measure first?