WEBVTT

1
00:00.000 --> 00:03.600
Hello and welcome. My name is Keith Barker.

2
00:03.600 --> 00:06.960
And in a previous skill, we looked at the basic concept of a DFW,

3
00:06.960 --> 00:11.940
a distributed firewall, which is absolutely awesome to control traffic flows

4
00:11.940 --> 00:13.280
inside of NSX.

5
00:13.280 --> 00:17.200
And up to this point, we primarily used group membership for criteria,

6
00:17.200 --> 00:21.560
for matching on those rules, as well as layer four protocols like TCP and well-

7
00:21.560 --> 00:22.080
known ports

8
00:22.080 --> 00:26.640
for applications like SSH with a well-known port of TCP port 22.

9
00:26.640 --> 00:30.280
However, there comes a time in everyone's life when we may want to take a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:26.640 --> 00:30.280
However, there comes a time in everyone's life when we may want to take a

10
00:30.280 --> 00:31.040
closer look

11
00:31.040 --> 00:35.360
at what's really going on higher than layer four in the protocol stack.

12
00:35.360 --> 00:40.240
Specifically, looking at the application layer to see is it really SSH or is it

13
00:40.240 --> 00:42.400
really HTTPS and so forth.

14
00:42.400 --> 00:45.350
And so in this skill, we're going to kick it up a notch with our distributed

15
00:45.350 --> 00:45.840
firewall

16
00:45.840 --> 00:48.880
by introducing the concept of a context profile.

17
00:48.880 --> 00:52.560
And whenever we hear the term context profile, I'd like you to think,

18
00:52.560 --> 00:56.500
looking at the details of the application layer, because that's exactly what we

19
00:56.500 --> 00:57.440
're talking about.

20
00:57.440 --> 01:00.640
And if we're using context profiles and we're looking at the application layer,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:57.440 --> 01:00.640
And if we're using context profiles and we're looking at the application layer,

21
01:00.640 --> 01:04.650
we can now include rules that are based on what's really happening at the

22
01:04.650 --> 01:05.280
application layer.

23
01:05.280 --> 01:09.400
So if we want to permit SSH, for example, we can create a rule that at layer

24
01:09.400 --> 01:10.320
four is looking for

25
01:10.320 --> 01:14.780
TCP with a well-known port of 22. And at the application layer, we can take a

26
01:14.780 --> 01:15.440
closer look

27
01:15.440 --> 01:19.460
and make sure it's really SSH. Once again, using at the application layer, the

28
01:19.460 --> 01:20.560
context profile

29
01:20.560 --> 01:24.960
to identify exactly what attributes we're looking for in the application layer.

30
01:24.960 --> 01:27.820
So in this skill, you and I get to continue working with the distributed

31
01:27.820 --> 01:28.160
firewall,

32
01:28.160 --> 01:32.400
but adding on top of our configuration as part of the rules, we'll add on our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:28.160 --> 01:32.400
but adding on top of our configuration as part of the rules, we'll add on our

33
01:32.400 --> 01:33.600
context profiles

34
01:33.600 --> 01:37.360
to take a look at the details of what's happening at the application layer.

35
01:37.360 --> 01:41.920
So if you're ready, I'm ready, and I'll see you in the very next video.