Live Virtual Machine Lab 19-1: Implementing Network Security Measures

Introduction

A live virtual machine lab provides a hands‑on environment where learners can experiment with real‑world networking tools without risking production systems. Lab 19‑1, titled Implementing Network Security Measures, is a common exercise in many cybersecurity curricula (e.g.Day to day, , CompTIA Security+, Cisco CCNA Security, or university network‑defense courses). In this lab, students spin up several virtual machines that act as routers, switches, servers, and endpoints, then apply a series of security controls—firewalls, intrusion detection/prevention systems, virtual private networks, and segmentation techniques—to protect the simulated network.

Worth pausing on this one.

The purpose of the lab is twofold: first, to reinforce theoretical concepts such as defense‑in‑depth, least privilege, and secure configuration; second, to develop practical skills in configuring security appliances, interpreting logs, and troubleshooting policy conflicts. By completing Lab 19‑1, participants gain confidence that they can translate classroom knowledge into operable safeguards that would be used in an enterprise data center or a small‑to‑medium business network No workaround needed..

In the sections that follow, we will walk through the lab’s objectives, break down each implementation step, illustrate real‑world analogues, discuss the underlying theory, highlight frequent pitfalls, and answer common questions that arise when learners tackle this exercise Nothing fancy..

Detailed Explanation

What the Lab Entails

Lab 19‑1 typically begins with a pre‑built topology hosted on a hypervisor such as VMware Workstation, Oracle VirtualBox, or Microsoft Hyper‑V. The topology includes:

• Router VM – running a Linux‑based firewall distribution (e.g., pfSense, OPNsense, or VyOS).
• Switch VM – a lightweight Linux bridge or a virtual switch that can be configured for VLAN tagging.
• Server VMs – one acting as a web server (Apache/Nginx), another as a file server (Samba), and a third as a database server (MySQL/MariaDB).
• Client VMs – representing internal workstations and an external attacker host.

All VMs are interconnected via virtual NICs, allowing the instructor to simulate both trusted and untrusted traffic flows. The lab manual then guides the learner through a series of security‑hardening tasks:

1. Baseline connectivity test – verify that all hosts can reach each other before any controls are applied.
2. Firewall rule creation – define inbound/outbound policies on the router/firewall VM.
3. Intrusion Detection System (IDS) deployment – install and configure Snort or Suricata on a monitoring VM.
4. Virtual Private Network (VPN) setup – establish an IPsec tunnel between the router and a remote‑access client.
5. Network segmentation – create VLANs and apply inter‑VLAN ACLs to isolate the web, file, and database tiers.
6. Logging and monitoring – forward firewall and IDS logs to a central syslog server and review alerts.

Each step builds on the previous one, reinforcing the concept that security controls are most effective when layered.

Why a Live VM Lab Is Effective

Traditional lecture‑only instruction can convey the what of network security but often falls short on the how. A live VM lab bridges that gap by:

• Providing instant feedback—misconfigured rules immediately break connectivity, prompting rapid correction.
• Allowing safe experimentation—students can deliberately trigger attacks (e.g., port scans, brute‑force login attempts) without affecting real assets.
• Encouraging troubleshooting skills—log analysis, packet captures (using Wireshark or tcpdump), and policy adjustments become routine tasks.
• Supporting repeatability—the entire topology can be snapped, restored, or cloned, enabling learners to retry scenarios until mastery is achieved.

Because the lab runs on the learner’s own hardware (or a cloud‑based lab platform), it also familiarizes them with the virtualization tools that are ubiquitous in modern IT operations And it works..

Step‑by‑Step or Concept Breakdown

Below is a condensed, logical flow that mirrors the typical Lab 19‑1 workbook. Each numbered block represents a major phase; sub‑steps are elaborated in paragraph form.

1. Environment Preparation

• Import the OVA/VMDK files supplied by the instructor into the chosen hypervisor.
• Assign appropriate network adapters:
  • Adapter 1 – NAT or Host‑Only for management access.
  • Adapter 2 – Internal Network labeled “LAN” for the trusted side.
  • Adapter 3 – Internal Network labeled “DMZ” for the web server.
  • Adapter 4 – Internal Network labeled “WAN” for the external attacker host.
• Start all VMs and verify that each obtains an IP address via DHCP (or static assignment as per the lab guide).

2. Baseline Connectivity

• From a client VM, ping the router’s LAN interface, then the web server in the DMZ, and finally the external host.
• Record round‑trip times and note any packet loss. This establishes a known‑good state before any security controls are applied.

3. Firewall Implementation

• Access the firewall VM’s web console (usually https://<firewall‑IP>:8443).
• Create zones: LAN (trusted), DMZ (semi‑trusted), WAN (untrusted).
• Define default policies:
  • LAN → DMZ: allow HTTP (TCP 80) and HTTPS (TCP 443).
  • LAN → WAN: allow DNS (UDP 53), HTTP/HTTPS, and necessary outbound services.
  • WAN → LAN: deny all (implicit drop).
  • WAN → DMZ: allow only HTTP/HTTPS to the web server.
• Enable stateful inspection so that return traffic for allowed outbound connections is permitted automatically.
• Test: attempt to ping from the WAN host to a LAN client—should be blocked; attempt to browse the web server from the WAN host—should succeed.

4. IDS/IPS Deployment

• Install Snort on a dedicated monitoring VM (often called “IDS”).
• Configure Snort to listen on a span port or mirrored interface that copies traffic from the firewall’s LAN and DMZ interfaces.
• Pull the latest community ruleset (e.g., Emerging Threats) and enable rules for:
  • SMB brute‑force (SID 1000001).
  • SQL injection attempts (SID 1000

5. Vulnerability Assessment

• Deploy a scanner – Install a lightweight vulnerability scanner (e.g., OpenVAS, Nessus, or the built‑in “Vulnerability Assessor” VM that ships with the workbook) on a dedicated assessment host.
• Create scan profiles – Define three profiles that correspond to the lab’s zones:
  • LAN profile – Deep scan of the internal domain controller, file server, and any admin workstations.
  • DMZ profile – Focused scan of the web server, checking for outdated Apache/Nginx versions, missing security headers, and known CVEs.
  • WAN profile – Light reconnaissance of the external attacker host to confirm that no unintended services are exposed from the internal network.
• Run the scans – Execute each profile against its target zone, allowing the scanner to resolve hostnames, enumerate services, and pull the latest CVE databases. Capture the generated reports in PDF and XML formats for later reference.
• Analyze findings – Review the top‑risk items (e.g., missing MS17‑010 patch on the file server, outdated SSL/TLS configuration on the web server, and open SMB ports). Prioritize remediation based on the CVSS scores provided in the reports.

6. Patch Management

• Establish a patch repository – Use a simple HTTP server (e.g., apache2 on a Linux VM) to host the operating‑system and application patches required for the lab environment.
• Automate patching on the web server –
  • Enable the web server’s package manager (apt/yum) to point to the local repository.
  • Run apt-get update && apt-get upgrade -y (or the equivalent) to apply the latest security updates.
  • Verify that the server now runs the patched kernel and that services restart cleanly.
• Patch the internal hosts – Apply the same updates to the LAN VMs (domain controller, file server, and client workstations). Use the repository to keep the patches consistent across all machines.
• Validate remediation – Re‑run the vulnerability scanner on the patched hosts. The scan should show a dramatic reduction in high‑severity findings, confirming that the remediation steps were effective.

7. Incident Response

• Simulate a breach – From the WAN host, launch a controlled attack against the web server:

  • Send a malicious HTTP request that triggers the SQL‑injection rule (SID 1000005) previously enabled in Snort.
  • Attempt an SMB brute‑force attack using a tool like hydra to exhaust the login attempt limit.

• Monitor alerts – Observe the IDS/IPS VM generating real‑time alerts. Confirm that the Snort log files (e.g., /var/log/snort/alert) contain entries with the appropriate SID and severity level.

• Correlate with firewall logs – Check the firewall’s web console for any blocked connections. The firewall should have dropped the inbound SMB traffic while allowing the HTTP/HTTPS request that the IDS flagged Worth knowing..

• Containment – Once the attack is detected, apply a temporary ACL on the firewall to block the offending source IP from the LAN and DMZ zones. This demonstrates how rapid isolation can limit lateral movement.

• **Eradication &

• Eradication & Recovery – Remove the attacker’s persistence mechanisms (e.g., delete any newly created user accounts or scheduled tasks on the domain controller). Restore any compromised files from the backup repository to a clean state. Verify that the web application’s database is sanitized and that no malicious payloads remain in the codebase Worth knowing..

• Post‑Incident Review – Document the timeline of the attack, the alerts generated, and the containment actions taken. Compare the actual response against the incident response plan to identify gaps. Update the firewall rules and IDS signatures based on the tactics observed during the simulation to improve detection capabilities for future events Easy to understand, harder to ignore..

8. Final Verification & Reporting

• Run a full re‑scan – Execute the vulnerability profiles once more across all zones to check that no high‑severity vulnerabilities remain and that the remediation efforts have hardened the environment.
• Compile the final report – Summarize the initial findings, the remediation actions performed, and the results of the incident response drill. Include screenshots of the IDS alerts, firewall blocks, and the final clean scan results to provide a comprehensive audit trail.
• Document the architecture – Update the network diagrams to reflect any changes made during the project, such as the addition of the IDS/IPS sensor or the new firewall ACLs. Store the documentation in the lab’s shared repository for future reference.

Conclusion

By methodically working through network segmentation, vulnerability scanning, patch management, and incident response, this lab demonstrates a defense‑in‑depth approach to securing a hybrid network environment. The exercise highlights how proactive scanning and timely patching reduce the attack surface, while IDS/IPS monitoring and rapid containment strategies limit the impact of live threats. In the long run, the combination of technical controls and structured processes ensures that the internal services remain protected from both external adversaries and internal vulnerabilities, providing a solid foundation for ongoing security operations.