Changes between Initial Version and Version 1 of Cnbp2019/Agenda/pfSenseadvancedSetup

Timestamp:

Mar 10, 2019, 5:33:02 AM (6 years ago)

Author:

admin

Comment:

--

Cnbp2019/Agenda/pfSenseadvancedSetup

@@ +1 @@
+= Advance Configurations =
+Maintaining a pfSense can be problematic if the configurations are not fine tuned to meet your network requirements. 
+
+== pfSense Advanced Settings ==
+The advanced settings available under System > Advanced. There are there for additional tweaking or for those who need the functionality given. 
+== Admin Access ==
+=== webConfigurator ===
+These will change settings related to web interface of your pfSense instance 
+    • Protocol: HTTPS 
+    • TCP Port: defaults to 443 but you may change to a non-common port in production 
+    • Max Processes: 2 (number of webConfigurator processes to run allowing more users/browsers to access the GUI concurrently) 
+    • Alternate Hostnames: pfsense.instXY.ac.lk (this is, if you need to access webUI by its domain name) and many more... 
+
+=== Secure Shell ===
+You need to enable ssh to access its CLI remotely. SSH key methods and port number can be configured 
+
+=== Serial Communication ===
+If you desire to use serial communication as of a router or a switch you may configure these options. 
+
+=== Console Options ===
+If you dont tick the option, it will allow anyone to access the physical console of the pfSense server 
+
+== Firewall & NAT ==
+
+In production, depending on number of hosts and concurrent connections, you may need to increase values of '''Firewall Maximum States''' or '''Firewall Maximum Table Entries'''. 
+If you tick '''Disable Firewall''' option, it will convert the pfSense in to a normal routing device, remember it will remove NAT functions as well. 
+
+== Networking ==
+You may control IPv6 capabilities of the pfSense from this section and enable/disable IPv6 on the device. 
+We recommend not to touch this. 
+By any chance, if you need to change WAN interface addresses regularly, it is a good option to tick '''Reset All States''' 
+
+== Notifications ==
+In production environment, it is a good idea to configure SMTP settings for your pfsense. 
+
+
+
+== Package Manager ==
+You will find the package manager which controls installing and uninstalling of different 3rd party packages from System drop down menu. 
+
+=== Installed Packges ===
+You can Remove , Update , Reinstall any installed package using this tab. 
+
+=== Available Packages ===
+Any new 3rd party packages can be installed very easily using this tab and it gives a nice UI where you can search what you want and install if available. 
+
+Search for '''mailreport''' and click '''+ Install''' and confirm. It will take some time to install and once it shows '''Success''' go to '''Status > Email Reports''' 
+With this package you can add custom email reports based on given Schedules. 
+
+== Routing ==
+Static routing for gateways are done on this page located at System > Routing 
+
+== Gateways ==
+Your upstream and any downstream routers / L3 devices that are connected through routed interfaces must be configured on this page. One gateway for each interface and for each address family. Initially, two gateways for WAN interface should have been created to define IPv4 and IPv6 addresses of your WAN gateway. 
+Also on to the bottom of the page, you will find the selected gateways as your default Gateways. 
+
+=== Add New Gateway ===
+If you have a L3 device as your downstream and if you have defined vlans on it then you must define a static route pointing those vlans. This must be accomplished by creating a new gateway and creating static routes. 
+To add a new gateway click '''+ Add''' button on Gateways page 
+    • Select the interface facing that end point (WAN or LAN) 
+    • Address Family 
+    • Name: something identifiable 
+    • Gateway: IP address of the gateway or the interface address of the L3 device connected on the other side. Consider Address Family as well 
+    • Description: Some description about the gateway or the link 
+and save. 
+
+=== Static Routes ===
+To create a new static route, Click '''+ Add''' on Static Route Page, 
+    • Define your Destination Network and Mask, eg: 172.16.0.0 / 16 , 2401:dd00:2009:WX10:: / 60 
+    • Gateway: Select Gateway that is on that routed link 
+    • Description: Add a suitable description 
+Make sure you add the reverse route to the other device as well. 
+
+== Update ==
+You may update your installation using this menu, we will skip it for the workshop. 
+
+== User Manager ==
+You can create multiple users to give access in handling pfSense authentication. System > User Manager is responsible in creating and maintaining Local users as well as remote users like LDAP or Radius. 
+To create a new user you can use + Add and give, 
+    • Username 
+    • Password 
+    • Full Name (optional) 
+    • Expiration Date (optional) and click Save 
+Once the new User is created click on the edit (Pencil) mark to add user privileges. 
+On Effective Privileges of the edit page can be used to customize how that user can interact with pfSense. Click Add and select one or more privileges according to the needs 
+If you have more than one user with specific custom privileges, the best way assigning them is to create a user group with common privileges and assign users to that. 
+You may create a group on Groups tab with 
+    • Group Name 
+    • Scope: Local 
+    • Description 
+Once the group is created go to edit and assign privileges and users. 
+On Settings tab you may specify Session timeouts and Authentication Refresh Times as per your institute policy.