WEBVTT 1 00:00.000 --> 00:01.880 So regarding this scenario, 2 00:01.880 --> 00:05.480 we probably want to ask a few additional questions to the customer just to make 3 00:05.480 --> 00:07.120 sure we're on the same sheet of music. 4 00:07.120 --> 00:11.130 For example, when they talk about clients, we want to make sure we're clear on 5 00:11.130 --> 00:13.360 who those clients are and what those devices are. 6 00:13.360 --> 00:17.340 And while we're at it, it wouldn't be a bad idea to clearly identify where the 7 00:17.340 --> 00:19.200 web servers are and where the database servers are, 8 00:19.200 --> 00:21.760 and if they intend on growing them. 9 00:21.760 --> 00:24.760 For example, if in the future they add two more web servers and five more 10 00:24.760 --> 00:25.680 database servers, 11 00:25.680 --> 00:28.960 we want to make sure we have a scalable solution where we can just add those 12 00:28.960 --> 00:31.360 additional servers or they could add the new servers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 12 00:28.960 --> 00:31.360 additional servers or they could add the new servers. 13 00:31.360 --> 00:33.600 And as a result, still have the security they want. 14 00:33.600 --> 00:37.590 Another question we'd want to confirm with them is regarding the connectivity 15 00:37.590 --> 00:40.720 between the application web servers here and the database servers. 16 00:40.720 --> 00:45.810 It says here we want to permit TCP 5432 being used by the database service 17 00:45.810 --> 00:46.720 function. 18 00:46.720 --> 00:49.870 However, we also may want to confirm if they want to restrict all other traffic 19 00:49.870 --> 00:50.160 . 20 00:50.160 --> 00:54.230 So maybe that's the only traffic they want and if they want to deny all other 21 00:54.230 --> 00:56.960 traffic, we'd also want to make sure we incorporate that as well. 22 00:56.960 --> 01:01.520 Because remember, at the end of a distributed firewall policy, the rule is by WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 22 00:56.960 --> 01:01.520 Because remember, at the end of a distributed firewall policy, the rule is by 23 01:01.520 --> 01:06.080 default to allow anything that hasn't been matched earlier in the policies. 24 01:06.080 --> 01:09.190 So for this one right here, for web server access to database servers, if we 25 01:09.190 --> 01:12.840 did nothing except take the defaults, that would allow that traffic to go 26 01:12.840 --> 01:13.280 through. 27 01:13.280 --> 01:17.180 So let's also presume the customers told us they want to allow this traffic and 28 01:17.180 --> 01:21.040 nothing else between the web servers and the backend database servers. 29 01:21.040 --> 01:25.040 So they only want to allow TCP port 5432. 30 01:25.040 --> 01:27.600 So we're getting tags and groups. Let's start off with tags first. 31 01:27.600 --> 01:32.020 If we want to identify all the client VMs, we probably want to create a tag WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 31 01:27.600 --> 01:32.020 If we want to identify all the client VMs, we probably want to create a tag 32 01:32.020 --> 01:33.520 called clients. 33 01:33.520 --> 01:35.920 And I'm going to put clients tag just so we can see that. 34 01:35.920 --> 01:40.300 And then we can dynamically make a group based on that tag and we can call that 35 01:40.300 --> 01:41.520 group clients group. 36 01:41.520 --> 01:44.580 And that way in the future, if we create new VMs, they're gonna be clients when 37 01:44.580 --> 01:47.850 we create those VMs, we simply associate them with this tag and that will 38 01:47.850 --> 01:51.120 automatically put them into this dynamic group called clients group. 39 01:51.120 --> 01:55.120 And for the servers, we have two types. So I'd probably create a web server tag 40 01:55.120 --> 01:55.120 . 41 01:55.120 --> 01:58.270 We'll call it web tag for short and also one for database servers, we'll call 42 01:58.270 --> 01:58.800 it DB tag. 43 01:58.800 --> 02:00.880 And then create those respective groups as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 43 01:58.800 --> 02:00.880 And then create those respective groups as well. 44 02:00.880 --> 02:03.840 So over here, we can create a web group and a database group. 45 02:03.840 --> 02:07.220 And again, the benefit of using the tags and having dynamic membership in these 46 02:07.220 --> 02:11.200 groups is that if we create, for example, two or three more database servers 47 02:11.200 --> 02:15.360 or 100 more web servers, if we associate them with a respective tag when they 48 02:15.360 --> 02:16.000 're created, 49 02:16.000 --> 02:19.120 then those VMs will automatically be in these groups. 50 02:19.120 --> 02:22.700 So the distributed firewall rules will apply to those new devices that we've 51 02:22.700 --> 02:23.920 added to the network. 52 02:23.920 --> 02:27.760 So then for our distributed firewall and its policies and rules for the clients 53 02:27.760 --> 02:30.720 to web servers using HTTPS only, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 53 02:27.760 --> 02:30.720 to web servers using HTTPS only, 54 02:30.720 --> 02:34.220 we can say for the source, if it's the clients group, and it's going to the 55 02:34.220 --> 02:36.480 destination of the web server group. 56 02:36.480 --> 02:43.000 And if the service is TCP port 443, which is the well known port for HTTPS, 57 02:43.000 --> 02:45.840 then we want to go ahead and we want to allow that traffic. 58 02:45.840 --> 02:49.590 And then for the second entry here, we create a rule that says it's a source is 59 02:49.590 --> 02:51.280 the group called clients. 60 02:51.280 --> 02:53.840 And the destination is the group called DB group. 61 02:53.840 --> 02:57.200 Regardless of service, we could go ahead and we could go ahead and do a drop. 62 02:57.200 --> 02:59.440 So drop or reject would both be fine. 63 02:59.440 --> 03:03.710 And that way, as the distributed firewall rules are being processed, they go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 02:59.440 --> 03:03.710 And that way, as the distributed firewall rules are being processed, they go 64 03:03.710 --> 03:05.760 through category by category by category. 65 03:05.760 --> 03:07.840 And then in each category, their process top down. 66 03:07.840 --> 03:12.020 So as long as we have a rule in here that says for traffic from clients going 67 03:12.020 --> 03:13.600 to our database group to drop it, 68 03:13.600 --> 03:17.330 as long as that appears in our rules before the end, which by default is 69 03:17.330 --> 03:20.640 permitting all the traffic that would cause that traffic to be denied. 70 03:20.640 --> 03:24.290 And then for this entry right here for web server traffic, we say if the source 71 03:24.290 --> 03:28.920 is the group for web servers and the destination is the group for the database 72 03:28.920 --> 03:29.680 servers. 73 03:29.680 --> 03:33.840 And the TCP port is 5 4 3 2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 73 03:29.680 --> 03:33.840 And the TCP port is 5 4 3 2. 74 03:33.840 --> 03:37.920 Now, if there's already an object inside of the NSX manager that represents TCP 75 03:37.920 --> 03:40.080 port 5 4 3 2, we could just use it. 76 03:40.080 --> 03:44.000 Or if that doesn't exist, we can simply create that on our own and then use it 77 03:44.000 --> 03:45.360 as part of our rule here. 78 03:45.360 --> 03:48.400 And if that traffic matches, we want to go ahead and allow it. 79 03:48.400 --> 03:51.370 And then furthermore, if the customer said we don't want any other traffic 80 03:51.370 --> 03:54.480 besides this to be permitted between web servers and database servers, 81 03:54.480 --> 03:58.750 we create yet another rule that says if traffic is from web server group going 82 03:58.750 --> 04:00.160 to the database server group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 82 03:58.750 --> 04:00.160 to the database server group. 83 04:00.160 --> 04:03.520 Regardless of protocol or service, we want to go ahead and drop it. 84 04:03.520 --> 04:08.620 That would cover everything else that's not TCP port 5 4 3 2 going from our web 85 04:08.620 --> 04:12.000 servers and those application servers to the back end database servers. 86 04:12.000 --> 04:15.540 And then to test these and validate these, we could use trace flow to validate 87 04:15.540 --> 04:18.240 the flows of traffic we expect to be allowed are allowed. 88 04:18.240 --> 04:22.180 And then also validate that the traffic flows that we expect to be dropped are 89 04:22.180 --> 04:22.880 dropped. 90 04:22.880 --> 04:27.130 Also, as a heads up, sometimes there is protocols and ports that are needed for 91 04:27.130 --> 04:31.360 an application to function that the customer has failed to communicate to us or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 91 04:27.130 --> 04:31.360 an application to function that the customer has failed to communicate to us or 92 04:31.360 --> 04:34.000 that we failed to realize we're also needed. 93 04:34.000 --> 04:38.340 So another really good step to take would be to test a test environment with 94 04:38.340 --> 04:42.960 test application servers and test database servers to verify with our security 95 04:42.960 --> 04:46.700 policy rules in place as part of the distributed firewall to verify that the 96 04:46.700 --> 04:47.840 application does work. 97 04:47.840 --> 04:52.880 Because if this needs TCP port 5 4 3 2 between the web server and the back end 98 04:52.880 --> 04:57.000 database server, but it also needs some other protocol or port to be allowed 99 04:57.000 --> 05:00.410 and we're not allowing it that would cause the application as a whole not to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 99 04:57.000 --> 05:00.410 and we're not allowing it that would cause the application as a whole not to 100 05:00.410 --> 05:01.760 function as expected. 101 05:01.760 --> 05:07.600 So again, configure, test, verify and then go through change control and deploy 102 05:07.600 --> 05:07.960 . 103 05:07.960 --> 05:11.410 So thanks for joining me in this set of videos and the skill regarding the 104 05:11.410 --> 05:13.920 distributed firewall in an NSX environment. 105 05:13.920 --> 05:17.280 And I'll see you my friend in another skill very, very soon. 106 05:17.280 --> 05:21.340 Until then, I hope this has been informative and I'd like to thank you for 107 05:21.340 --> 05:22.080 viewing.