WEBVTT

1
00:00.000 --> 00:03.200
So in this third example of our distributed firewall policies,

2
00:03.200 --> 00:05.200
we're going to deny Telnet traffic,

3
00:05.200 --> 00:09.040
which effectively is TCP going to the well-known port of 23,

4
00:09.040 --> 00:13.840
if it's coming from any of our VMs that are members of the clients group,

5
00:13.840 --> 00:16.560
going to any VMs that are members of the server group.

6
00:16.560 --> 00:18.960
And I don't think we have yet created a group called servers,

7
00:18.960 --> 00:21.760
but there's also many different ways we could implement this.

8
00:21.760 --> 00:24.560
So we could say traffic from anybody in this group,

9
00:24.560 --> 00:27.520
going to specific VMs, but for scalability,

10
00:27.520 --> 00:30.560
we'd probably want to have a group that included those VMs.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.520 --> 00:30.560
we'd probably want to have a group that included those VMs.

11
00:30.560 --> 00:34.160
So as a quick refresher on tags and associating tags with VMs,

12
00:34.160 --> 00:36.560
and then using those tags as part of group membership,

13
00:36.560 --> 00:38.240
let's create a new tag called servers.

14
00:38.240 --> 00:42.400
We'll associate that with our web VM and also our database VM,

15
00:42.400 --> 00:45.920
and then we'll create a new group that's looking for that respective tag.

16
00:45.920 --> 00:47.600
And then we'll include that server's group

17
00:47.600 --> 00:50.800
as part of our security policy rule in the distributive firewall.

18
00:50.800 --> 00:54.560
So back at the NSX manager, we'll click on inventory on the left.

19
00:54.560 --> 00:56.880
Let's create a new tag by going to tags,

20
00:56.880 --> 00:59.760
click on add tag, and we'll call this servers.

21
00:59.760 --> 01:01.840
And then we'll select virtual machines,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:59.760 --> 01:01.840
And then we'll select virtual machines,

22
01:01.840 --> 01:07.360
and let's go ahead and include VMDB and also VM web

23
01:07.360 --> 01:09.840
as the two servers we want to receive that tag.

24
01:09.840 --> 01:12.240
So we'll click on apply and click on save.

25
01:12.240 --> 01:14.960
And then I don't see it here, so we'll click on refresh,

26
01:14.960 --> 01:16.400
and there it is right there.

27
01:16.400 --> 01:20.160
And it's assigned to currently two objects, and that's our two VMs.

28
01:20.160 --> 01:22.880
So next, let's go to groups and click on add group,

29
01:22.880 --> 01:24.960
and we'll call this server group.

30
01:24.960 --> 01:27.600
And for the compute members, we'll click on set there,

31
01:27.600 --> 01:30.880
and for the criteria, we want to look for a tag
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:27.600 --> 01:30.880
and for the criteria, we want to look for a tag

32
01:30.880 --> 01:33.600
that is exactly equal to servers.

33
01:33.600 --> 01:37.040
So we'll select that servers tag for a match, we'll click on apply,

34
01:37.040 --> 01:40.400
click on save, and then just to confirm that, for the server group here,

35
01:40.400 --> 01:42.000
I'm going to click on view members,

36
01:42.000 --> 01:45.440
just to confirm that our two servers show up there, which they do.

37
01:45.440 --> 01:48.080
So those two servers have the tag associated with them,

38
01:48.080 --> 01:49.520
and this group is looking for those tags,

39
01:49.520 --> 01:52.560
and that's why these two VMs are part of this group.

40
01:52.560 --> 01:53.840
So we'll click on close,

41
01:53.840 --> 01:57.600
and now let's include that group information as part of a security policy rule

42
01:57.600 --> 01:59.120
inside of the distributed firewall.

43
01:59.120 --> 02:02.080
So to do that, we'll go back to the security tab up on top.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:59.120 --> 02:02.080
So to do that, we'll go back to the security tab up on top.

44
02:02.080 --> 02:04.640
Over on the left, we'll click on distributed firewall.

45
02:04.640 --> 02:07.600
We'll go to our applications category, which we're currently in,

46
02:07.600 --> 02:09.600
and we'll expand our policy.

47
02:09.600 --> 02:12.800
Let me also collapse that left hand side to give us a little bit more room,

48
02:12.800 --> 02:14.800
and we are not using these two rules anymore.

49
02:14.800 --> 02:18.080
Let me go ahead and select both of those and delete them,

50
02:18.080 --> 02:21.040
and then click on publish to make sure everything is cleaned up.

51
02:21.040 --> 02:23.520
Click on refresh there, that looks good,

52
02:23.520 --> 02:25.520
and let's add a new rule to our policy.

53
02:25.520 --> 02:28.160
So with our policy selected, we'll click on add rule,

54
02:28.160 --> 02:30.960
and we'll call this one note-telnet clients to servers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:28.160 --> 02:30.960
and we'll call this one note-telnet clients to servers.

55
02:30.960 --> 02:33.200
So that's the name of it right there, and for the criteria,

56
02:33.200 --> 02:37.120
if the source is any VMs that are a member of the group,

57
02:37.120 --> 02:39.440
all clients, and then we'll click on apply.

58
02:39.440 --> 02:41.280
So the all clients group is the source,

59
02:41.280 --> 02:43.760
and for the destination, we'll click on the pencil there,

60
02:43.760 --> 02:46.160
and the source is going to be server group.

61
02:46.160 --> 02:48.800
So we'll click on server group, and click on apply.

62
02:48.800 --> 02:52.240
So there's the destination, and for the actual service based on our plan,

63
02:52.240 --> 02:54.080
we want to prevent telnet traffic.

64
02:54.080 --> 02:58.960
So we're going to go ahead and point to TCP with the station port of 23.

65
02:58.960 --> 03:01.520
So we'll click on the edit in the services column here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:58.960 --> 03:01.520
So we'll click on the edit in the services column here,

66
03:01.520 --> 03:03.120
and then we could create our own service,

67
03:03.120 --> 03:07.680
or we could just do a search up here for telnet and press enter,

68
03:07.680 --> 03:11.200
and that would show us the objects here regarding that protocol import.

69
03:11.200 --> 03:13.200
So here is telnet will select that,

70
03:13.200 --> 03:17.200
and that would match on TCP traffic with a destination port of 23,

71
03:17.200 --> 03:19.200
regardless of what source port is being used.

72
03:19.200 --> 03:20.960
So we'll go ahead and click on apply,

73
03:20.960 --> 03:23.920
and if we want to deny that traffic over here for the action,

74
03:23.920 --> 03:26.800
we'd want to specify either a drop or reject.

75
03:26.800 --> 03:30.320
So because we're dropping on telnet traffic, we could do a reject,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:26.800 --> 03:30.320
So because we're dropping on telnet traffic, we could do a reject,

76
03:30.320 --> 03:34.960
and that would cause a TCP reset message to be sent back to the clients

77
03:34.960 --> 03:37.360
from this group who are trying to initiate that conversation.

78
03:37.360 --> 03:39.920
And before we publish this, let's just verify that telnet

79
03:39.920 --> 03:41.200
is allowed through the network.

80
03:41.200 --> 03:43.520
So easy way to do that is go to plan and troubleshoot.

81
03:43.520 --> 03:47.200
I'm going to say, yes, let's navigate away, go down to traffic analysis,

82
03:47.200 --> 03:50.560
and then we will create a new trace flow, we'll proceed,

83
03:50.560 --> 03:54.720
and we want to use TCP to the well-known port of 23.

84
03:54.720 --> 03:58.640
We use some high-numbered port like 673 as a source,

85
03:58.640 --> 04:02.960
and then for testing, let's go ahead and test from how about even A,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:58.640 --> 04:02.960
and then for testing, let's go ahead and test from how about even A,

86
04:02.960 --> 04:08.160
which is one of our client VMs, and let's go to the VMDB server.

87
04:08.160 --> 04:10.560
So we'll select VMDB as a destination.

88
04:10.560 --> 04:13.520
So what this is doing is testing whether or not the network will allow

89
04:13.520 --> 04:17.760
TCP traffic destined to port 23 from this VM to this VM.

90
04:17.760 --> 04:19.680
So we'll scroll down, click on trace,

91
04:19.680 --> 04:22.460
and this should be allowed through the network because it's going to hit that

92
04:22.460 --> 04:23.920
end default rule

93
04:23.920 --> 04:26.560
of permitting all layer three traffic.

94
04:26.560 --> 04:29.440
So there's the output, and if we bring up the details,

95
04:29.440 --> 04:33.600
so it started off on ESXIA, went through distributed firewall rules there,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
04:29.440 --> 04:33.600
so it started off on ESXIA, went through distributed firewall rules there,

96
04:33.600 --> 04:38.100
it got routed from the gateway A up to the tier zero gateway down to the

97
04:38.100 --> 04:39.120
gateway B,

98
04:39.120 --> 04:43.280
and then logically shipped over to the tunnel endpoint over at ESXIB,

99
04:43.280 --> 04:45.680
and then ESXIB did the final delivery.

100
04:45.680 --> 04:46.640
So that'll work great.

101
04:46.640 --> 04:47.840
Let's go back to security.

102
04:47.840 --> 04:51.760
And on the left, we'll go to distributed firewall, and didn't save our changes.

103
04:51.760 --> 04:53.760
We'll go ahead and recreate that rule again.

104
04:53.760 --> 04:59.140
So we'll create our policy, add rule, also a note TCP 23, source client,

105
04:59.140 --> 05:00.560
destination server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
04:59.140 --> 05:00.560
destination server.

106
05:00.560 --> 05:02.240
So that'll be the name of our rule.

107
05:02.240 --> 05:05.280
For the source, we'll select all clients, click on apply,

108
05:05.280 --> 05:07.600
and for the destination, we'll click on the pencil there,

109
05:07.600 --> 05:09.360
and that's going to be our server group.

110
05:09.360 --> 05:10.800
And if we hadn't created that server group,

111
05:10.800 --> 05:14.960
we also could have just selected the DB group and then the web group.

112
05:14.960 --> 05:18.160
And if our servers were a member of one of those groups, that would also apply.

113
05:18.160 --> 05:21.520
So I'm going to go ahead and just take off the DB group there,

114
05:21.520 --> 05:24.160
and also take off the web group because we have the server group,

115
05:24.160 --> 05:27.440
and we already confirmed that our two servers are part of that group.

116
05:27.440 --> 05:30.320
Sounds great. So we'll click on close there, click on apply,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
05:27.440 --> 05:30.320
Sounds great. So we'll click on close there, click on apply,

117
05:30.320 --> 05:33.600
and then for the service, we want to go ahead and use TCP port 23.

118
05:33.600 --> 05:35.760
So we'll go ahead and search for telnet.

119
05:35.760 --> 05:39.840
So we'll select telnet, come from the destination TCP port 23, click apply,

120
05:39.840 --> 05:42.480
and then for the action, let's go ahead and do a reject,

121
05:42.480 --> 05:43.840
and we'll publish that.

122
05:43.840 --> 05:45.040
All right, that looks good.

123
05:45.040 --> 05:47.360
So now that's configured, let's verify this rule,

124
05:47.360 --> 05:51.360
which has the idea of 407 for our current implementation here.

125
05:51.360 --> 05:56.080
Let's verify that that rule is going to prevent TCP traffic going to the well

126
05:56.080 --> 05:57.360
known port of 23,

127
05:57.360 --> 06:01.280
if it's sourced from any of our clients going to any of our servers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:57.360 --> 06:01.280
if it's sourced from any of our clients going to any of our servers.

128
06:01.280 --> 06:02.880
So we'll go to plan and troubleshoot.

129
06:02.880 --> 06:05.200
On the left, we'll click on traffic analysis,

130
06:05.200 --> 06:08.080
and we currently have our current test in place.

131
06:08.080 --> 06:11.040
So let me just do an edit real quick and click on proceed,

132
06:11.040 --> 06:12.720
and just to verify the details.

133
06:12.720 --> 06:19.280
So this will be TCP traffic sourced from 6783 going to 23 from VM even A,

134
06:19.280 --> 06:25.680
which is on ES6IA going over to VM-DB, which is over on segment 20,

135
06:25.680 --> 06:28.080
and being hosted on ES6IB.

136
06:28.080 --> 06:30.720
And there's the IP addresses involved, and we'll click on trace.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
06:28.080 --> 06:30.720
And there's the IP addresses involved, and we'll click on trace.

137
06:30.720 --> 06:35.200
So this one should fail, and that's because we have our distributed firewall

138
06:35.200 --> 06:39.680
with a security policy rule that says deny traffic from the clients group,

139
06:39.680 --> 06:43.600
going to the servers group if the destination port is TCP port 23.

140
06:43.600 --> 06:48.080
So here, if we scroll up here and take a look, ES6IA said, yep,

141
06:48.080 --> 06:50.000
I'm going to go ahead and kill it early.

142
06:50.000 --> 06:53.920
That traffic came into ES6IA, it went through the logic of the distributed

143
06:53.920 --> 06:54.640
firewall,

144
06:54.640 --> 06:59.040
and there's a rule 4074 that said, sorry, that traffic is not allowed,

145
06:59.040 --> 07:00.560
and it stopped right there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
06:59.040 --> 07:00.560
and it stopped right there.

146
07:00.560 --> 07:02.480
And so when implementing our security policy rules,

147
07:02.480 --> 07:05.520
there's lots of different options that we can use to implement it.

148
07:05.520 --> 07:08.000
So if we go back to security and distributed firewall,

149
07:08.000 --> 07:12.400
and we added a new rule, for example, click on our policy and click on add rule

150
07:12.400 --> 07:12.400
,

151
07:12.400 --> 07:15.040
here for the source and destination, if we clicked on the edit there,

152
07:15.040 --> 07:18.000
instead of just selecting groups, which is the default tab here,

153
07:18.000 --> 07:21.200
or clicking here on IP addresses and putting in an IP address or a range

154
07:21.200 --> 07:24.160
as part of the consideration, we can also specify sources based on other

155
07:24.160 --> 07:24.800
criteria,

156
07:24.800 --> 07:26.480
other than just groups or IP addresses.

157
07:26.480 --> 07:29.220
So over here on the right hand side, where it says filter by name, path, and

158
07:29.220 --> 07:29.360
more,

159
07:29.360 --> 07:31.760
if we click there, we can refine our search.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
07:29.360 --> 07:31.760
if we click there, we can refine our search.

160
07:31.760 --> 07:35.900
So if we said, for example, I want to go ahead and search based on virtual

161
07:35.900 --> 07:36.640
machines.

162
07:36.640 --> 07:38.400
Now it's showing us all the VMs available.

163
07:38.400 --> 07:43.200
So if I want to include, for example, VMDB or odd A and so forth,

164
07:43.200 --> 07:46.930
I could include them specifically as part of the source characteristics for

165
07:46.930 --> 07:47.680
this rule.

166
07:47.680 --> 07:51.360
So the actual source and destination information as part of our distributed

167
07:51.360 --> 07:52.480
firewall rule

168
07:52.480 --> 07:57.200
isn't restricted to just group membership, but we can also sort based on a lot

169
07:57.200 --> 07:58.640
of other criteria as well.

170
07:58.640 --> 08:01.040
So I'm not going to change anything there, so I'll click on cancel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
07:58.640 --> 08:01.040
So I'm not going to change anything there, so I'll click on cancel.

171
08:01.040 --> 08:03.770
So because we're not going to use that rule, I'll go ahead and select it and

172
08:03.770 --> 08:04.720
click on delete.

173
08:04.720 --> 08:08.800
So now we've had the opportunity to do three examples of specific security

174
08:08.800 --> 08:09.680
rules as part

175
08:09.680 --> 08:13.040
of a distributed firewall in the world of NSX.

176
08:13.040 --> 08:23.040
[BLANK_AUDIO]