WEBVTT

1
00:00.000 --> 00:04.160
For our game plan to help reinforce the concept of using context profiles,

2
00:04.160 --> 00:05.680
let's do the following.

3
00:05.680 --> 00:08.800
And again, these are all going to be related to the distributed firewall.

4
00:08.800 --> 00:11.600
So for the first demonstration of using the context profiles,

5
00:11.600 --> 00:14.640
which we're looking at what's really going on at the application layer,

6
00:14.640 --> 00:21.040
let's deny SSH. If it's really SSH, not just the well-known port of TCP port 22

7
00:21.040 --> 00:21.040
,

8
00:21.040 --> 00:26.400
but if it's really SSH, let's go ahead and deny it if it's attempting to go to

9
00:26.400 --> 00:27.120
this interface

10
00:27.120 --> 00:32.240
right here. So this is a little virus router that has the IP address 23 1.2.1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.120 --> 00:32.240
right here. So this is a little virus router that has the IP address 23 1.2.1.

11
00:32.240 --> 00:35.280
And we have reachability from our previous skills on getting there.

12
00:35.280 --> 00:38.640
So we should be able to initially before we deny the SSH traffic,

13
00:38.640 --> 00:42.100
we should be able to go to a VM like this one right here, connect up to that IP

14
00:42.100 --> 00:43.360
address via SSH,

15
00:43.360 --> 00:47.920
and that should work just fine. So let's go ahead and deny SSH from clients to,

16
00:47.920 --> 00:48.240
and I'm going to

17
00:48.240 --> 00:52.690
point to that IP address right there to 23.1.2.1. So as part of our rule, to

18
00:52.690 --> 00:53.280
identify which

19
00:53.280 --> 00:56.320
machines are actually clients, we also want to take a moment and make sure that

20
00:56.320 --> 00:56.800
we have the

21
00:56.800 --> 01:00.960
tags associated with each of our client VMs, and then make sure that we have a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:56.800 --> 01:00.960
tags associated with each of our client VMs, and then make sure that we have a

22
01:00.960 --> 01:01.920
dynamic group

23
01:01.920 --> 01:05.040
that's looking for all those tags and putting them into a group called clients

24
01:05.040 --> 01:05.760
that we can then use

25
01:05.760 --> 01:09.270
as part of our security policy rule. So I'm going to add to this deny SSH from

26
01:09.270 --> 01:13.280
clients to 23.1.2.1.

27
01:13.280 --> 01:18.970
So as part of that, we will specify for the services that we want TCP port 22

28
01:18.970 --> 01:19.840
to be blocked,

29
01:19.840 --> 01:22.400
but we're not just going to rely on these services looking at the layer for

30
01:22.400 --> 01:23.040
information,

31
01:23.040 --> 01:26.340
we're also going to go ahead and use a context profile. So I'll put a little

32
01:26.340 --> 01:27.520
plus symbol there,

33
01:27.520 --> 01:31.300
and then in green, let me go ahead and put context profile. So the context
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:27.520 --> 01:31.300
and then in green, let me go ahead and put context profile. So the context

34
01:31.300 --> 01:32.320
profile will be looking

35
01:32.320 --> 01:37.290
at the application layer to verify based on a signature ID that it really is

36
01:37.290 --> 01:38.160
SSH, and not just

37
01:38.160 --> 01:42.180
some other application layer services that's being tunneled or sent over TCP

38
01:42.180 --> 01:43.200
port 22. Again,

39
01:43.200 --> 01:46.980
that's the benefit of a context profile is we can take a closer look at what's

40
01:46.980 --> 01:47.920
really going on at

41
01:47.920 --> 01:51.750
the application layer. And for our second task, let's do some fully qualified

42
01:51.750 --> 01:53.280
domain name filtering

43
01:53.280 --> 01:56.400
if clients, meaning VMs that are in the clients group, if they're trying to go

44
01:56.400 --> 01:57.280
out to the internet

45
01:57.280 --> 02:01.990
using HTTPS to and for the domain name, let's go ahead and use asterisk, which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:57.280 --> 02:01.990
using HTTPS to and for the domain name, let's go ahead and use asterisk, which

46
02:01.990 --> 02:03.280
means anything at

47
02:03.280 --> 02:07.970
unless you Cisco.com. Now, to pull this one off, we are going to have to do a

48
02:07.970 --> 02:08.720
couple of things.

49
02:08.720 --> 02:12.890
Number one, at the application layer, we need to tell the NSX environment that

50
02:12.890 --> 02:13.680
we want to pay

51
02:13.680 --> 02:18.090
attention and look at all the DNS traffic that's going through. So we'll create

52
02:18.090 --> 02:18.720
a rule that says,

53
02:18.720 --> 02:21.850
please look at all the DNS traffic. And that gives us the ability to take a

54
02:21.850 --> 02:22.960
closer look at what's going

55
02:22.960 --> 02:26.890
on with the DNS that's being used. And then secondly, once we have the DNS

56
02:26.890 --> 02:28.320
inspection effectively in

57
02:28.320 --> 02:31.750
place, we'll have another rule that says, you know what, if clients are trying
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:28.320 --> 02:31.750
place, we'll have another rule that says, you know what, if clients are trying

58
02:31.750 --> 02:32.800
to go to anything at

59
02:32.800 --> 02:37.500
Cisco.com using HTTPS, go ahead and stop it, meaning that the distributive

60
02:37.500 --> 02:38.480
firewall is going to stop

61
02:38.480 --> 02:42.820
that traffic. So to make that all happen, we are going to be looking at layer

62
02:42.820 --> 02:45.200
four at UDP port 53.

63
02:45.200 --> 02:50.490
So UDP port 53 is the older, well known port and protocol being used for a DNS

64
02:50.490 --> 02:51.760
request, a DNS

65
02:51.760 --> 02:55.440
lookup. However, in a production environment, just be where there's more than

66
02:55.440 --> 02:56.400
just UDP port 53

67
02:56.400 --> 03:00.580
that clients may be using for DNS requests. Examples of some alternatives to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:56.400 --> 03:00.580
that clients may be using for DNS requests. Examples of some alternatives to

68
03:00.580 --> 03:01.760
that would be

69
03:01.760 --> 03:06.330
DNS over TLS. And the acronym for that is DOT. At which point we wouldn't be

70
03:06.330 --> 03:07.360
using UDP at all,

71
03:07.360 --> 03:13.520
we're using TCP with TLS. And there's also DOH, which is DNS over HTTPS. So in

72
03:13.520 --> 03:14.080
the lab environment

73
03:14.080 --> 03:18.190
here for our demo, I'm going to go ahead and just use the UDP port 53, because

74
03:18.190 --> 03:19.120
that's what my clients

75
03:19.120 --> 03:22.330
are using by default when they make DNS requests. So as part of our setup for

76
03:22.330 --> 03:23.280
the fully qualified

77
03:23.280 --> 03:26.980
domain name filtering, we need a train that distributed firewall to pay

78
03:26.980 --> 03:28.480
attention to UDP traffic.

79
03:28.480 --> 03:31.300
And also the application layer, make sure it's not just using those ports, but
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:28.480 --> 03:31.300
And also the application layer, make sure it's not just using those ports, but

80
03:31.300 --> 03:31.680
make sure it's

81
03:31.680 --> 03:35.190
actually really DNS. And the second part of that fully qualified domain name

82
03:35.190 --> 03:36.160
filtering is stopping

83
03:36.160 --> 03:41.840
clients from actually getting to anything at Cisco.com. If it's HTTPS said to

84
03:41.840 --> 03:42.080
do that,

85
03:42.080 --> 03:45.770
we're going to implement at layer four, we're going to say, Hey, look for HTTPS

86
03:45.770 --> 03:46.240
traffic,

87
03:46.240 --> 03:52.300
which behind the scenes is TCP port 443, as well known port for HTTPS services.

88
03:52.300 --> 03:53.040
And at the application

89
03:53.040 --> 03:57.640
layer in a context profile, we can specify we're looking for HTTPS services.

90
03:57.640 --> 03:57.920
And again,

91
03:57.920 --> 04:02.130
at this point, we're really looking what's going on. And we're also looking for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:57.920 --> 04:02.130
at this point, we're really looking what's going on. And we're also looking for

92
04:02.130 --> 04:02.720
the domain they're

93
04:02.720 --> 04:08.560
trying to reach. So I'll put a little plus here and put asterisk. Cisco.com. So

94
04:08.560 --> 04:08.960
this first part

95
04:08.960 --> 04:12.390
right here is to train the NSX environment that we want to take a closer look

96
04:12.390 --> 04:13.760
at all the DNS traffic.

97
04:13.760 --> 04:17.200
And the second part here is going to be used to identify both at layer four

98
04:17.200 --> 04:18.800
with TCP port 443

99
04:18.800 --> 04:23.280
and the application layer that they really are using HTTPS. And in addition,

100
04:23.280 --> 04:23.760
that they're trying

101
04:23.760 --> 04:27.510
to go to anything at Cisco.com. And when we set that up as a rule, we'll go

102
04:27.510 --> 04:28.160
ahead and save for

103
04:28.160 --> 04:31.460
this one to go ahead and tonight. And effectively, we're now doing fully
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
04:28.160 --> 04:31.460
this one to go ahead and tonight. And effectively, we're now doing fully

104
04:31.460 --> 04:32.560
qualified domain name

105
04:32.560 --> 04:36.800
filtering using a context profile. Now, I also want to point out that there's a

106
04:36.800 --> 04:37.520
separate feature,

107
04:37.520 --> 04:41.970
which will also cover in a separate skill called URL filtering, where we can

108
04:41.970 --> 04:43.040
categorize, for example,

109
04:43.040 --> 04:47.440
certain types of URLs, for example, auction sites or hate sites or whatever it

110
04:47.440 --> 04:48.400
is. And then we can

111
04:48.400 --> 04:52.180
filter based on those categories. So we'll cover the URL filtering in a

112
04:52.180 --> 04:54.000
separate skill. But for now,

113
04:54.000 --> 04:57.150
for the demonstration of using a context profile, we're simply going to be

114
04:57.150 --> 04:59.120
looking for HTTPS traffic

115
04:59.120 --> 05:02.560
and looking for a specific domain that the client might be trying to go to. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:59.120 --> 05:02.560
and looking for a specific domain that the client might be trying to go to. And

116
05:02.560 --> 05:03.200
then we're filtering

117
05:03.200 --> 05:07.120
based on that. And then as our final example here of using context profiles,

118
05:07.120 --> 05:07.680
let's do some

119
05:07.680 --> 05:13.690
filtering. If at the transport layer per call is TCP port 443, which is a well

120
05:13.690 --> 05:15.120
known port for HTTP

121
05:15.120 --> 05:18.810
services, and at the application layer as part of our context profile, let's

122
05:18.810 --> 05:19.600
look for the app

123
05:19.600 --> 05:24.630
for eBay. Now they have a specific app already set up that identifies eBay

124
05:24.630 --> 05:25.600
traffic looking at the

125
05:25.600 --> 05:28.310
application layer information going back and forth. So we're going to leverage

126
05:28.310 --> 05:28.880
that built-in

127
05:28.880 --> 05:32.540
application as a further demonstration of using a context profile. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:28.880 --> 05:32.540
application as a further demonstration of using a context profile. So

128
05:32.540 --> 05:33.760
everything in green here

129
05:33.760 --> 05:37.620
represents using a context profile. So up here, we're actually literally wrote

130
05:37.620 --> 05:38.640
out context profile

131
05:38.640 --> 05:42.320
looking for SSH. I'm going to go ahead and clean that up just a little bit. And

132
05:42.320 --> 05:43.280
I'm going to literally

133
05:43.280 --> 05:47.440
write in the app ID we're looking for. So we'll go ahead and just write an SSH.

134
05:47.440 --> 05:48.240
So just a reminder

135
05:48.240 --> 05:51.980
here, the green color represents a context profile focusing on the application

136
05:51.980 --> 05:53.040
layer information.

137
05:53.040 --> 05:56.450
And the orange color here represents layer for information and where

138
05:56.450 --> 05:57.680
appropriate the actual

139
05:57.680 --> 06:02.880
ports associated, for example, with TCP or UDP. So in parentheses, I'll put TCP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:57.680 --> 06:02.880
ports associated, for example, with TCP or UDP. So in parentheses, I'll put TCP

140
06:02.880 --> 06:04.080
and UDP, although

141
06:04.080 --> 06:07.440
there could be other protocols there at layer four as well, including matching

142
06:07.440 --> 06:08.160
on other protocols

143
06:08.160 --> 06:14.240
like GRE and IPsec and ICMP and others. And instead of our distributed firewall

144
06:14.240 --> 06:15.280
policy rules,

145
06:15.280 --> 06:19.360
that layer for information is referred to as services. So in the NSX interface,

146
06:19.360 --> 06:19.760
when we see

147
06:19.760 --> 06:23.650
services, I'd like you to think of layer for information. And when you see

148
06:23.650 --> 06:24.720
context profile,

149
06:24.720 --> 06:27.690
I'd like you to think of the application layer information. In fact, I'm going

150
06:27.690 --> 06:28.320
to go ahead and

151
06:28.320 --> 06:31.900
rewrite these right down here next to where they fit in. So for the application
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
06:28.320 --> 06:31.900
rewrite these right down here next to where they fit in. So for the application

152
06:31.900 --> 06:32.800
layer inspection,

153
06:32.800 --> 06:36.590
we're using context profiles. And for layer four, we're using the concept of

154
06:36.590 --> 06:37.120
services,

155
06:37.120 --> 06:40.220
because that's what it'll look like inside of the distributed firewall, when we

156
06:40.220 --> 06:40.880
're setting up

157
06:40.880 --> 06:45.120
and configuring the rules.