WEBVTT

1
00:00.000 --> 00:03.760
Hello and welcome. My name is Keith Barker.

2
00:03.760 --> 00:07.200
And we've been using Firewalls and networks for a long, long time.

3
00:07.200 --> 00:10.880
And the concept of a firewall is some device in the network that's controlling

4
00:10.880 --> 00:12.080
what's allowed through.

5
00:12.080 --> 00:14.960
So if we have clients over here and clients over here and they have to go

6
00:14.960 --> 00:15.760
through the firewall,

7
00:15.760 --> 00:20.240
the firewall can control what's allowed or not allowed based on a layer three

8
00:20.240 --> 00:21.280
IP address or

9
00:21.280 --> 00:25.180
layer four protocol and/or port and a next-generation firewall also has the

10
00:25.180 --> 00:26.400
ability to look at the

11
00:26.400 --> 00:30.080
application layer to make decisions on whether traffic should be allowed to go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:26.400 --> 00:30.080
application layer to make decisions on whether traffic should be allowed to go

12
00:30.080 --> 00:30.640
through or not

13
00:30.640 --> 00:34.300
based on policy. So a firewall is all well and good, but what if we have a

14
00:34.300 --> 00:35.200
firewall sitting right

15
00:35.200 --> 00:38.420
here and we have two computers on this side of the firewall? They're both on

16
00:38.420 --> 00:39.360
the same network.

17
00:39.360 --> 00:43.670
How do we control traffic between them? The answer is with this firewall, we

18
00:43.670 --> 00:44.960
can't. However,

19
00:44.960 --> 00:49.290
something really cool in the world of NSX is the concept of the distributed

20
00:49.290 --> 00:50.400
firewall. Imagine

21
00:50.400 --> 00:54.880
a firewall where we set the rules about what's allowed or not allowed based on

22
00:54.880 --> 00:55.920
individual VMs

23
00:55.920 --> 00:59.760
or group memberships or other criteria that we specify. And then no matter

24
00:59.760 --> 01:01.360
where those VMs move,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:59.760 --> 01:01.360
where those VMs move,

25
01:01.360 --> 01:05.440
if they moved from segment 10 to segment 20 to segment 30, we can control what

26
01:05.440 --> 01:06.240
traffic is allowed

27
01:06.240 --> 01:11.440
or not allowed between those VMs based on our distributed firewall rules. It's

28
01:11.440 --> 01:12.080
because of that

29
01:12.080 --> 01:16.010
that we have the concept of micro segmentation. So in the past, if we had a

30
01:16.010 --> 01:16.880
firewall here and we

31
01:16.880 --> 01:20.000
had two computers over here on this segment, we really couldn't control with

32
01:20.000 --> 01:20.720
this firewall

33
01:20.720 --> 01:23.960
what could be sent back and forth over the network between those two VMs.

34
01:23.960 --> 01:24.160
However,

35
01:24.160 --> 01:28.370
with a distributed firewall, we can now have that micro segmentation and micro

36
01:28.370 --> 01:29.360
control regarding

37
01:29.360 --> 01:32.830
exactly what's allowed between those VMs, even if they're on the same exact
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.360 --> 01:32.830
exactly what's allowed between those VMs, even if they're on the same exact

38
01:32.830 --> 01:33.680
network segment,

39
01:33.680 --> 01:38.320
because logically that traffic is going through NSX. And as part of that, the

40
01:38.320 --> 01:39.200
traffic has to go

41
01:39.200 --> 01:43.540
through the logical distributed firewall rules to allow to be sent if that

42
01:43.540 --> 01:44.560
traffic is going to be

43
01:44.560 --> 01:49.440
allowed between those two VMs. And by default, with a distributed firewall, the

44
01:49.440 --> 01:50.320
default rule

45
01:50.320 --> 01:54.590
at very end says, please permit all your IP traffic. And that's why up to this

46
01:54.590 --> 01:55.040
point,

47
01:55.040 --> 01:59.160
using the defaults, we are able to send traffic back and forth between various

48
01:59.160 --> 02:00.320
VMs. However, as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:59.160 --> 02:00.320
VMs. However, as

49
02:00.320 --> 02:03.980
we'll see as we go through this set of videos together, we can change that

50
02:03.980 --> 02:04.800
behavior with the

51
02:04.800 --> 02:08.780
micro segmentation provided by the distributed firewall. So join me in the next

52
02:08.780 --> 02:09.680
video as we take

53
02:09.680 --> 02:12.770
a big picture look at the world of a distributed firewall, and then we'll

54
02:12.770 --> 02:13.840
follow that up with a

55
02:13.840 --> 02:18.640
specific game plan, and then we'll implement and verify that game plan together

56
02:18.640 --> 02:19.920
. So also you, my

57
02:19.920 --> 02:21.920
friend in the next video in just a moment.

58
02:21.920 --> 02:31.920
[BLANK_AUDIO]