WEBVTT 1 00:00.000 --> 00:04.480 To really appreciate the use of a context profile, let's take just a moment and 2 00:04.480 --> 00:08.510 review some of the basic concepts of a distributed firewall and then we'll add 3 00:08.510 --> 00:10.000 on top of it context profiles. 4 00:10.000 --> 00:14.510 When setting up a distributed firewall, think of it like a firewall service 5 00:14.510 --> 00:17.000 that hovers over the entire topology. 6 00:17.000 --> 00:20.000 So, I think we set up our rules as part of a distributed firewall. 7 00:20.000 --> 00:23.130 All of our transport nodes involved, including host transport nodes and edge 8 00:23.130 --> 00:24.000 transport nodes. 9 00:24.000 --> 00:26.540 They all have a copy of that distributed firewall and they can enforce that 10 00:26.540 --> 00:27.000 policy. 11 00:27.000 --> 00:30.610 And that's a good thing because if we have a VM like this, VM number one right WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:27.000 --> 00:30.610 And that's a good thing because if we have a VM like this, VM number one right 12 00:30.610 --> 00:33.940 here, that wants to communicate down here with VM number two, when VM number 13 00:33.940 --> 00:37.760 one tries to communicate or sends traffic over to VM number two, because the 14 00:37.760 --> 00:41.000 host A, which is one of our transport nodes has a copy of that distributed 15 00:41.000 --> 00:41.000 firewall. 16 00:41.000 --> 00:45.210 If that traffic is not permitted, it's host A, they can go ahead and squash 17 00:45.210 --> 00:48.000 that right there, very close to the source. 18 00:48.000 --> 00:51.650 We're not wasting a lot of resources over on ESXAB or other edge nodes because 19 00:51.650 --> 00:55.000 we're stopping that traffic as close to the source as possible. 20 00:55.000 --> 00:58.000 If that traffic is not allowed by the rules in the distributed firewall. 21 00:58.000 --> 01:01.500 And as far as the rules in a distributed firewall go, we can filter based on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 00:58.000 --> 01:01.500 And as far as the rules in a distributed firewall go, we can filter based on 22 01:01.500 --> 01:05.000 source or destination IP address information. 23 01:05.000 --> 01:08.000 That'd be at the layer three or the network layer of our protocol stack. 24 01:08.000 --> 01:10.000 So put S and D for source and destination. 25 01:10.000 --> 01:13.490 And an example of source and destination should be, for example, traffic coming 26 01:13.490 --> 01:16.000 from the 1010 zero network, trying to go to the 1020 zero network. 27 01:16.000 --> 01:20.050 There'd be an example of including some IP information as part of our 28 01:20.050 --> 01:22.000 distributed firewall rule. 29 01:22.000 --> 01:25.300 In addition to specifying the source and or destination addresses involved as 30 01:25.300 --> 01:28.630 part of one of our policy rules for the distributed firewall, we can also 31 01:28.630 --> 01:33.000 specify specifically what services we want to permit or deny. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 31 01:28.630 --> 01:33.000 specify specifically what services we want to permit or deny. 32 01:33.000 --> 01:36.060 And that would be information, for example, right here, the transport layer of 33 01:36.060 --> 01:41.000 our protocol stack. So things like TCP or UDP, including the ports involved. 34 01:41.000 --> 01:46.400 So, for example, SSH uses the well known port at the server of TCP port 22 and 35 01:46.400 --> 01:51.130 the traditional flavor of DNS uses UDP at the transport layer with port number 36 01:51.130 --> 01:52.000 53. 37 01:52.000 --> 01:55.640 So we can specifically permit or deny traffic based on that layer for 38 01:55.640 --> 01:57.000 information as well. 39 01:57.000 --> 02:02.000 I also want to throw in ICMP, which is protocol number one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 39 01:57.000 --> 02:02.000 I also want to throw in ICMP, which is protocol number one. 40 02:02.000 --> 02:07.320 So TCP is protocol number six, UDP is protocol number 17 in decimal and ICMP is 41 02:07.320 --> 02:09.000 protocol number one. 42 02:09.000 --> 02:12.760 And once again, in our distributed firewall, we can permit or deny based on any 43 02:12.760 --> 02:14.000 of that information. 44 02:14.000 --> 02:17.850 Now, in addition to specifying as part of our DFW rules, information about the 45 02:17.850 --> 02:20.720 source and the association IP addresses and the transport protocols and our 46 02:20.720 --> 02:22.000 reports that are being used. 47 02:22.000 --> 02:26.260 We also have like 11 billion other things that we can also match on to control 48 02:26.260 --> 02:27.000 traffic. 49 02:27.000 --> 02:30.920 As we looked at in the previous skill on TFW, we also can do it based on group WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 02:27.000 --> 02:30.920 As we looked at in the previous skill on TFW, we also can do it based on group 50 02:30.920 --> 02:34.000 membership as a condition of source or destination. 51 02:34.000 --> 02:38.000 We also looked at how we can use dynamic group membership by, for example, 52 02:38.000 --> 02:41.670 giving a certain number of VMs, a certain tag, and then including any of those 53 02:41.670 --> 02:44.000 VMs that have that tag as part of a group. 54 02:44.000 --> 02:47.820 And I'm going to draw a little line right here between these lower layers, 55 02:47.820 --> 02:52.000 layer four, layer three, et cetera, and the application layer services. 56 02:52.000 --> 02:54.000 And I'd also like to pose a question. 57 02:54.000 --> 02:59.000 If the VM number one here is trying to initiate an SSH session down here to VM 58 02:59.000 --> 03:02.000 number two, which is over on the 1020s or network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 58 02:59.000 --> 03:02.000 number two, which is over on the 1020s or network. 59 03:02.000 --> 03:05.350 How do we really know that it's really the SSH application that this VM is 60 03:05.350 --> 03:07.000 trying to use as it connects over? 61 03:07.000 --> 03:10.690 Well, one way is to say, well, based on the traffic is going to TCP to the well 62 03:10.690 --> 03:12.000 known port of 22. 63 03:12.000 --> 03:15.000 So based on that, maybe it's an SSH session, but you know what? 64 03:15.000 --> 03:20.200 There's a lot of other ways that we can generate traffic using TCP port 22 that 65 03:20.200 --> 03:21.000 would not be SSH. 66 03:21.000 --> 03:25.280 So another option we want to include is to be able to take a deeper look and 67 03:25.280 --> 03:29.630 see what's really running at the application layer and not just what is the 68 03:29.630 --> 03:31.000 ports and protocols that are in use. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 68 03:29.630 --> 03:31.000 ports and protocols that are in use. 69 03:31.000 --> 03:35.580 So if we wanted to permit SSH sessions from VM one to VM two and we wanted to 70 03:35.580 --> 03:39.590 make really sure that it really is SSH, what we're going to do is we are going 71 03:39.590 --> 03:43.000 to leverage a context profile and a context profile. 72 03:43.000 --> 03:46.590 You can kind of think of it as taking a closer look at what's really going on 73 03:46.590 --> 03:48.000 at the application layer. 74 03:48.000 --> 03:52.240 So for example, if we're going to create a DFW rule that wants to make really 75 03:52.240 --> 03:56.870 sure that it really is SSH, not just some other application that's trying to 76 03:56.870 --> 04:00.000 use TCP port 22 to bypass some security policies that we have. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 76 03:56.870 --> 04:00.000 use TCP port 22 to bypass some security policies that we have. 77 04:00.000 --> 04:03.370 What we could do is this we could say in our security policy role, if the 78 04:03.370 --> 04:07.590 source, let's go ahead and say that this VM belongs to a group either manually 79 04:07.590 --> 04:10.000 or dynamically built group for clients. 80 04:10.000 --> 04:14.910 So let's say the source is a member of the group clients and the destination is 81 04:14.910 --> 04:17.000 a member of the group server. 82 04:17.000 --> 04:20.270 So we'll imagine that VM two is in the servers group or instead of using group 83 04:20.270 --> 04:23.000 membership, we could also do it based on IP addresses. 84 04:23.000 --> 04:26.200 If we know what those IP addresses are, or we could say based on the subnet the 85 04:26.200 --> 04:29.390 client's and the subnet the servers in, it just depends on what we want to 86 04:29.390 --> 04:31.000 implement as far as our security. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 86 04:29.390 --> 04:31.000 implement as far as our security. 87 04:31.000 --> 04:34.250 So for this, we'll say if the source VM is in the client's group and the 88 04:34.250 --> 04:37.870 destination is in the servers group and if the service and I'm intentionally 89 04:37.870 --> 04:41.260 putting this here in orange because I want you to think of layer four 90 04:41.260 --> 04:42.000 information. 91 04:42.000 --> 04:42.710 If the service is TCP going to the well known port of 22 that service component 92 04:42.710 --> 04:51.000 in our DFW rule addresses the layer for information right here. 93 04:51.000 --> 04:55.390 So this is saying TCP going to port 22. And then what we're going to add on top 94 04:55.390 --> 04:58.950 of it is a context profile, which I will put in green to help us remember that 95 04:58.950 --> 05:01.000 this is looking at the application layer services. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 95 04:58.950 --> 05:01.000 this is looking at the application layer services. 96 05:01.000 --> 05:06.550 So in the context profile, we could say we're looking for the characteristics 97 05:06.550 --> 05:10.890 of an application known as SSH. And I'm going to put right here on the left and 98 05:10.890 --> 05:15.000 say that's the application identifier or the app that is recognizing. 99 05:15.000 --> 05:19.830 So in that case, if this VM right here tries to initiate a conversation to this 100 05:19.830 --> 05:23.720 VM here as long as the VM one is in the clients group and VM two is in the 101 05:23.720 --> 05:28.400 servers group and the initial flow of traffic is on TCP port 22 and at the 102 05:28.400 --> 05:29.000 application layer. 103 05:29.000 --> 05:33.000 And as [garbled] is identifying that, yep, this really is SSH. It's not some other WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 05:29.000 --> 05:33.000 And as [garbled] is identifying that, yep, this really is SSH. It's not some other 104 05:33.000 --> 05:37.300 tunnel traffic just going over TCP port 22 based on all those considerations 105 05:37.300 --> 05:41.380 matching that will allow that flow of traffic for an session from this VM right 106 05:41.380 --> 05:43.000 here via one going down to VM two. 107 05:43.000 --> 05:47.140 So the takeaway here is that a context profile gives us the ability to take a 108 05:47.140 --> 05:51.000 closer look at what's really going on at the application layer. 109 05:51.000 --> 05:54.650 And then we can use that as part of our rules. And if we choose not to use a 110 05:54.650 --> 05:58.850 context profile, which we don't always have to, then we're just relying on the 111 05:58.850 --> 06:03.400 matching and permitting or denying based on layer for protocols such as TCP or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 111 05:58.850 --> 06:03.400 matching and permitting or denying based on layer for protocols such as TCP or 112 06:03.400 --> 06:05.000 UDP or ICMP. 113 06:05.000 --> 06:08.730 And the case of TCP and UDP, the ports involved for the initial flow of traffic 114 06:08.730 --> 06:09.000 . 115 06:09.000 --> 06:13.190 And so in a world where hackers and attackers can do tunneling of protocols 116 06:13.190 --> 06:17.800 under different and non standard ports, it's important to have this additional 117 06:17.800 --> 06:22.530 application awareness component so that we can accurately control the flow of 118 06:22.530 --> 06:25.000 traffic with the intended apps that we want going through our network. 119 06:25.000 --> 06:30.760 And on the other hand denying certain applications that we don't want to flow WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 119 06:25.000 --> 06:30.760 And on the other hand denying certain applications that we don't want to flow 120 06:30.760 --> 06:37.000 through our network.