WEBVTT

1
00:00.000 --> 00:03.120
Now hopefully you've had a chance to play at home and try some of those

2
00:03.120 --> 00:04.160
commands already and

3
00:04.160 --> 00:10.200
take a look inside of our NX API sandbox. And if you have had a chance to play

4
00:10.200 --> 00:11.040
at home, you'll

5
00:11.040 --> 00:15.910
notice that one of those three areas did not come up inside of here and I want

6
00:15.910 --> 00:17.040
to explain why

7
00:17.040 --> 00:23.080
I have momentarily. But if you're like me and you have a little rest on you as

8
00:23.080 --> 00:23.840
far as like your

9
00:23.840 --> 00:27.110
Cisco command lines go sometimes, you can always click on your command

10
00:27.110 --> 00:28.800
reference and pop open to

11
00:28.800 --> 00:33.640
see what's actually going on here. And you can see I did that for SNMP. So we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.800 --> 00:33.640
see what's actually going on here. And you can see I did that for SNMP. So we

12
00:33.640 --> 00:34.480
're going to take a

13
00:34.480 --> 00:42.000
look at our API here real quick and we're just going to do a very simple show

14
00:42.000 --> 00:43.760
SNMP. And we're going

15
00:43.760 --> 00:48.270
to actually send the request and go down here and take a look at our response.

16
00:48.270 --> 00:49.040
Now this allows us

17
00:49.040 --> 00:54.400
to be able to go through and take a look at our SNMP configuration and also see

18
00:54.400 --> 00:55.360
where we can make

19
00:55.360 --> 01:00.350
changes inside a Nest Comp or Net Comp or Rest Comp as far as how we want to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:55.360 --> 01:00.350
changes inside a Nest Comp or Net Comp or Rest Comp as far as how we want to

20
01:00.350 --> 01:02.480
send it to our mass

21
01:02.480 --> 01:06.470
devices across the infrastructure if we wanted to do so or we could just

22
01:06.470 --> 01:08.320
configure them individually.

23
01:08.320 --> 01:13.860
And it's mostly to be able to go through and configure devices to on an

24
01:13.860 --> 01:16.160
individual level and to

25
01:16.160 --> 01:21.670
basically send a basic configuration to get things ready for our actual network

26
01:21.670 --> 01:22.720
. Because if you

27
01:22.720 --> 01:28.000
take a look at the actual response that we get from show SNMP, you can see that

28
01:28.000 --> 01:28.960
we have version

29
01:28.960 --> 01:34.440
of TCP authentication status and protocol status. Now we do have our same
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:28.960 --> 01:34.440
of TCP authentication status and protocol status. Now we do have our same

30
01:34.440 --> 01:36.240
community names for

31
01:36.240 --> 01:40.920
for being able to read or write and whatnot to have access to be able to

32
01:40.920 --> 01:42.080
monitor what's actually

33
01:42.080 --> 01:47.600
going on. But you can see that we also have encryption like right here it says

34
01:47.600 --> 01:49.360
AES 128 and we can

35
01:49.360 --> 01:54.450
actually go through and make sure that our SNMP configuration is secure on that

36
01:54.450 --> 01:55.600
IP level. The next

37
01:55.600 --> 02:02.630
one that we went into was NTP and this was an also show NTP and I wanted to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:55.600 --> 02:02.630
one that we went into was NTP and this was an also show NTP and I wanted to

38
02:02.630 --> 02:04.400
show you the

39
02:04.400 --> 02:09.730
well I'm going to show you live that I messed that up and I'm going to do a

40
02:09.730 --> 02:11.520
search for NTP because I know

41
02:11.520 --> 02:15.010
that's command in here and I'm going to go down to it and that's why this

42
02:15.010 --> 02:16.400
command reference is

43
02:16.400 --> 02:20.520
really good. But the reason I wanted to show this one is because we are going

44
02:20.520 --> 02:21.840
to show our NTP

45
02:21.840 --> 02:26.300
authentication status and while we're doing that I'm going to explain that NTP

46
02:26.300 --> 02:27.440
allows us to be able

47
02:27.440 --> 02:33.300
to sync up our different devices based on time sync. We want to have one or
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:27.440 --> 02:33.300
to sync up our different devices based on time sync. We want to have one or

48
02:33.300 --> 02:35.120
maybe a one primary

49
02:35.120 --> 02:39.760
and one backup timing source to make sure that all of our devices on the

50
02:39.760 --> 02:41.920
network whether they be

51
02:41.920 --> 02:47.460
on a physical or a cloud environment are all time sync. There are different

52
02:47.460 --> 02:48.640
resources and

53
02:48.640 --> 02:53.930
services out there that require us to be within time. For instance, Microsoft

54
02:53.930 --> 02:55.600
Server requires servers

55
02:55.600 --> 02:59.960
to be within a certain time skew to be able to do authentication inside of

56
02:59.960 --> 03:01.360
Active Directory.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:59.960 --> 03:01.360
Active Directory.

57
03:01.360 --> 03:08.010
Comp-seg devices or cryptographic devices on the DOD side require that time be

58
03:08.010 --> 03:09.040
set on those as

59
03:09.040 --> 03:14.300
well because if a packet is sent at let's say 12 o'clock on the nose and it

60
03:14.300 --> 03:15.120
arrives at

61
03:15.120 --> 03:21.010
at 1 o'clock but that time skew is off by an hour. Regardless of whether the

62
03:21.010 --> 03:21.920
cryptic app graphic

63
03:21.920 --> 03:26.550
keys are correct it will not accept the packet because the time has not been

64
03:26.550 --> 03:28.080
synced up between the two

65
03:28.080 --> 03:34.550
devices. And by going in and doing a show NTP authentication status inside of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
03:28.080 --> 03:34.550
devices. And by going in and doing a show NTP authentication status inside of

66
03:34.550 --> 03:37.360
our API sandbox here

67
03:37.360 --> 03:45.040
we can also see the NTP right now the authentication is disabled. Typically you

68
03:45.040 --> 03:46.240
can set up NTP just

69
03:46.240 --> 03:51.130
to point to a server and say use that for actual time sync. But if we wanted to

70
03:51.130 --> 03:52.400
be a little bit more

71
03:52.400 --> 03:57.870
secure we have a bunch of NTP reference commands to be able to go through and

72
03:57.870 --> 03:59.840
configure not just show

73
03:59.840 --> 04:05.280
but also to configure through NetComper ResCompt to go through and set up NTP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:59.840 --> 04:05.280
but also to configure through NetComper ResCompt to go through and set up NTP

74
04:05.280 --> 04:07.120
on our networking devices

75
04:07.120 --> 04:12.960
or Cisco related devices as well to make sure that we are set up to be able to

76
04:12.960 --> 04:15.680
have not only time sync

77
04:15.680 --> 04:20.590
between all the devices but it's authenticated making it just that much more

78
04:20.590 --> 04:21.760
secure and making sure

79
04:21.760 --> 04:26.570
that not everybody can get into our NTP server to send false timing information

80
04:26.570 --> 04:27.680
over the network.

81
04:27.680 --> 04:32.640
Now the last one that I gave you that you weren't able to find in here and I'll
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
04:27.680 --> 04:32.640
Now the last one that I gave you that you weren't able to find in here and I'll

82
04:32.640 --> 04:33.600
do a search for

83
04:33.600 --> 04:40.970
RIPWIC is SysLog. That allows us to be able to send logs from the devices that

84
04:40.970 --> 04:43.520
encrypted but we don't

85
04:43.520 --> 04:48.010
want people sneaking in to be able to see the logs being sent for actual

86
04:48.010 --> 04:49.840
infrastructure in case that

87
04:49.840 --> 04:54.970
we have a let's say firewall that's gone and fail open and we can't get any

88
04:54.970 --> 04:56.240
more response from it.

89
04:56.240 --> 05:01.010
We've got it set fail open just in case that we don't want to toss our own
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
04:56.240 --> 05:01.010
We've got it set fail open just in case that we don't want to toss our own

90
05:01.010 --> 05:02.960
network so the firewall

91
05:02.960 --> 05:08.160
itself does not work but it's still passing traffic and SysLogs might lead a

92
05:08.160 --> 05:09.920
baddie out there on the

93
05:09.920 --> 05:14.760
internet to be able to discover that it could fail open instead of going into

94
05:14.760 --> 05:15.760
failed closed.

95
05:15.760 --> 05:20.780
Now the preferred security method is failed closed. I'm just giving you a very

96
05:20.780 --> 05:22.400
quick scenario to why

97
05:22.400 --> 05:27.680
SysLog information might benefit a baddie out there and we want to make sure

98
05:27.680 --> 05:28.320
that SysLog

99
05:28.320 --> 05:32.710
information is being taken care of from point A to point B within our local
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
05:28.320 --> 05:32.710
information is being taken care of from point A to point B within our local

100
05:32.710 --> 05:35.360
environment and make sure

101
05:35.360 --> 05:40.600
that the logs are not being read by just anybody out there. Configuration and

102
05:40.600 --> 05:42.000
maintenance definitely

103
05:42.000 --> 05:46.240
gets a lot more intensive when we're swapping over to that infrastructure as a

104
05:46.240 --> 05:47.520
service. That's why we

105
05:47.520 --> 05:51.050
always have to keep in mind that logging and making sure that we're keeping

106
05:51.050 --> 05:52.240
track of everything as

107
05:52.240 --> 05:57.520
at the utmost of our security concerns. And we've seen the difference between

108
05:57.520 --> 05:58.400
infrastructure,

109
05:58.400 --> 06:03.730
platform and software as a service going through the different modeling methods
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
05:58.400 --> 06:03.730
platform and software as a service going through the different modeling methods

110
06:03.730 --> 06:04.720
and comparing what

111
06:04.720 --> 06:09.780
we're allowed to do and what different resources that are available to us.

112
06:09.780 --> 06:10.720
Whether it be something as

113
06:10.720 --> 06:16.470
simple as going through an actual browser to access a service or making sure

114
06:16.470 --> 06:18.160
that we can implement

115
06:18.160 --> 06:24.620
inside of our own environment and expand as needed. I hope this has been a form

116
06:24.620 --> 06:24.720
of

117
06:24.720 --> 06:27.280
for you and I'd like to thank you for viewing.