WEBVTT

1
00:00.000 --> 00:03.120
So, as the very first step before we start setting up filtering and denying

2
00:03.120 --> 00:03.440
stuff,

3
00:03.440 --> 00:07.740
let's just do a quick verification of our topology. So, over here on segment 10

4
00:07.740 --> 00:07.840
,

5
00:07.840 --> 00:12.760
I have a little VM, it's called Mint-1. It's lint minx on the 1010 zero network

6
00:12.760 --> 00:12.880
,

7
00:12.880 --> 00:16.880
it's getting an IP address via DHCP. And I've got another Mint Linux device

8
00:16.880 --> 00:17.520
right here,

9
00:17.520 --> 00:22.130
which is Mint 2 that's on the 1020 zero network. And currently, they should

10
00:22.130 --> 00:23.280
have access to,

11
00:23.280 --> 00:28.890
if they want to, SSH up here to my external router at .1 on the 2312 network.

12
00:28.890 --> 00:29.520
And they should be able

13
00:29.520 --> 00:34.570
to get out to, for example, the internet and go to sites like Cisco.com and e
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.520 --> 00:34.570
to get out to, for example, the internet and go to sites like Cisco.com and e

14
00:34.570 --> 00:35.840
bay.com. And I think

15
00:35.840 --> 00:39.300
we should take just a moment to verify all that before we start putting in the

16
00:39.300 --> 00:40.320
filtering. So,

17
00:40.320 --> 00:44.710
let's go to the vSphere client. And let's make sure these two VMs, Mint 1 and

18
00:44.710 --> 00:45.440
Mint 2,

19
00:45.440 --> 00:48.810
are on their correct network segments and we'll power them up. So, here in the

20
00:48.810 --> 00:49.440
vSphere client,

21
00:49.440 --> 00:53.190
let's go to the VM and templates view. And I've got a folder called VMs for

22
00:53.190 --> 00:54.080
testing. So,

23
00:54.080 --> 00:57.280
with this folder selected and the VMs to have up here selected, let me go ahead

24
00:57.280 --> 00:58.480
and select Mint 1

25
00:58.480 --> 01:03.180
and Mint 2 and right click for those two and click power. And then from the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.480 --> 01:03.180
and Mint 2 and right click for those two and click power. And then from the

26
01:03.180 --> 01:04.480
menu, we'll power them

27
01:04.480 --> 01:07.990
on. And then we'll go ahead and open up remote consoles for each of them as

28
01:07.990 --> 01:08.960
well. So, let me

29
01:08.960 --> 01:12.990
click on Mint 1 here and let's go ahead and open a remote console by clicking

30
01:12.990 --> 01:14.080
here on launch remote

31
01:14.080 --> 01:18.880
console. And we'll do the same thing for Mint 2. Click on Mint 2 and click on

32
01:18.880 --> 01:20.400
launch remote console.

33
01:20.400 --> 01:24.140
And while those are powering up, let's also just verify from the networks tab

34
01:24.140 --> 01:25.280
here that on segment

35
01:25.280 --> 01:28.970
10, we have Mint 1 right there, great, great, great, great. And that on segment

36
01:28.970 --> 01:30.240
20, there we have Mint
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:28.970 --> 01:30.240
20, there we have Mint

37
01:30.240 --> 01:33.890
2, that looks good as well. So, let's start with Mint 1 and just verify that it

38
01:33.890 --> 01:34.880
can do SSH up to

39
01:34.880 --> 01:40.550
this router here, also that it can get to Cisco.com via HTTPS and also that it

40
01:40.550 --> 01:42.080
can get to eBay. So,

41
01:42.080 --> 01:45.810
here is the remote console for Mint 1 up here on the top left, Mint 1.

42
01:45.810 --> 01:47.360
Fantastic. Let's just confirm

43
01:47.360 --> 01:51.330
its IP address real quick. So, we'll open up a terminal window and we'll type

44
01:51.330 --> 01:52.000
in IF config.

45
01:52.000 --> 01:57.040
And it's at 10.10.0.165, great, great, great. So, it's on the right subnet.

46
01:57.040 --> 01:57.520
Another way of seeing

47
01:57.520 --> 02:01.580
that information is IP address and pressing enter. And it also confirms for us
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:57.520 --> 02:01.580
that information is IP address and pressing enter. And it also confirms for us

48
02:01.580 --> 02:02.480
the IP address is

49
02:02.480 --> 02:07.080
involved. So, there's the 10, 10, 0, 165. So, here at the command lane, let's

50
02:07.080 --> 02:10.160
do a ping at to www.cisco.com,

51
02:10.160 --> 02:14.790
just to verify DNS is working great, great, great, or we can use dig for www.e

52
02:14.790 --> 02:17.600
bay.com. That looks great,

53
02:17.600 --> 02:22.320
or an NS lookup for VMware.com. That looks great. Another option we can use

54
02:22.320 --> 02:23.040
right here at the command

55
02:23.040 --> 02:27.730
line is curl, which is the command line URL. And so, with curl, we do a dash

56
02:27.730 --> 02:29.600
dash help and press enter.

57
02:29.600 --> 02:33.110
Here are options for curl. So, we can use, for example, right here, a dash i to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:29.600 --> 02:33.110
Here are options for curl. So, we can use, for example, right here, a dash i to

58
02:33.110 --> 02:33.840
include the

59
02:33.840 --> 02:36.510
protocol response headers, just to make sure we're really talking to the

60
02:36.510 --> 02:37.520
servers. So, let's go ahead

61
02:37.520 --> 02:43.550
and do a curl dash i and let's go out to www.ebay.com. In fact, let's put an

62
02:43.550 --> 02:44.640
HTTPS in front of that,

63
02:44.640 --> 02:48.770
so it doesn't default to HTTP or some other protocol. So, we'll do a curl,

64
02:48.770 --> 02:49.920
include the headers for

65
02:49.920 --> 02:54.470
HTTPS and then that URL will press enter. And sure enough, this is responding,

66
02:54.470 --> 02:55.520
fantastic. And

67
02:55.520 --> 03:02.430
let's do that also for cisco.com. Fantastic. We can also open up a browser and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:55.520 --> 03:02.430
let's do that also for cisco.com. Fantastic. We can also open up a browser and

68
03:02.430 --> 03:03.200
test it as well.

69
03:03.200 --> 03:07.410
So, we'll open up a browser and let's just verify basic connectivity real quick

70
03:07.410 --> 03:08.720
by using fast.com.

71
03:09.280 --> 03:14.000
And sure enough, we are connected out to the internet. So, that looks good. And

72
03:14.000 --> 03:14.320
let me

73
03:14.320 --> 03:18.800
open up another tab and let's go to ebay.com. So, even though I'm not typing in

74
03:18.800 --> 03:19.680
HTTPS, it's going

75
03:19.680 --> 03:25.040
to redirect me there. And there we go. There's ebay.com using HTTPS. And that

76
03:25.040 --> 03:25.520
looks like it's

77
03:25.520 --> 03:30.620
working as well. I go ahead and close those tabs. And just as a quick check,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:25.520 --> 03:30.620
working as well. I go ahead and close those tabs. And just as a quick check,

78
03:30.620 --> 03:31.520
let me also verify and

79
03:31.520 --> 03:34.890
mint to that it has the correct IP address. And it's also going to have the

80
03:34.890 --> 03:35.840
same connectivity,

81
03:35.840 --> 03:38.900
assuming it has an IP address that works. So, let's bring in mint to and here

82
03:38.900 --> 03:40.080
it is right here.

83
03:40.080 --> 03:43.890
This should be over on the 20 subnet. So, we'll go ahead and bring up a command

84
03:43.890 --> 03:44.560
prompt. And then

85
03:44.560 --> 03:49.760
here we'll do an IF config or the IPA for IP address. It's just to confirm that

86
03:49.760 --> 03:51.040
it has a valid IP address

87
03:51.040 --> 03:55.640
and it sure does says the .153 address on the network 10200. And that same

88
03:55.640 --> 03:57.040
information was

89
03:57.040 --> 04:01.270
output here from the output of IF config. And then just as a quick task, we did
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:57.040 --> 04:01.270
output here from the output of IF config. And then just as a quick task, we did

90
04:01.270 --> 04:02.400
a curl here.

91
04:02.400 --> 04:07.920
-i to include the headers out to www.sisco.com. That works. Let's also go ahead

92
04:07.920 --> 04:08.880
and put HTTPS

93
04:08.880 --> 04:12.780
there in front of it. HTTPS colon slash slash enter. And that looks good as

94
04:12.780 --> 04:13.840
well. So, we have

95
04:13.840 --> 04:16.950
IP addresses. We have connectivity to the internet. Oh, one other thing I want

96
04:16.950 --> 04:18.400
to verify is connectivity

97
04:18.400 --> 04:22.820
up to this router right here in our topology with SSH. So, let's go back to

98
04:22.820 --> 04:23.920
mint one and verify

99
04:23.920 --> 04:28.770
just a quick SSH session from mint one up to this router right here. So, here

100
04:28.770 --> 04:29.600
is mint one. So,

101
04:29.600 --> 04:34.960
we'll go ahead and do an SSH space dash L to login as. And the user up there is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
04:29.600 --> 04:34.960
we'll go ahead and do an SSH space dash L to login as. And the user up there is

102
04:34.960 --> 04:36.400
VYOS. And the

103
04:36.400 --> 04:40.690
IP address is 23.1.2.1. We'll press enter. And we want to accept the

104
04:40.690 --> 04:41.920
fingerprint and continue.

105
04:41.920 --> 04:47.040
We'll say yes. And then the password is VYOS also. And then we are in. So, if

106
04:47.040 --> 04:48.080
we type in who here,

107
04:48.080 --> 04:52.230
it's going to show us who's currently connected. So, we are coming in from 2312

108
04:52.230 --> 04:53.040
115. And that's

109
04:53.040 --> 04:55.960
because we're going through the NAT process that we set up in a previous skill.

110
04:55.960 --> 04:56.800
So, as we go through

111
04:56.800 --> 05:00.700
the tier zero gateway, NAT services are there. So, as this VM connects to this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:56.800 --> 05:00.700
the tier zero gateway, NAT services are there. So, as this VM connects to this

112
05:00.700 --> 05:01.680
external router,

113
05:01.680 --> 05:05.840
it's showing up as that IP address on the 23.1.2 network based on the pool we

114
05:05.840 --> 05:06.720
have assigned for

115
05:06.720 --> 05:10.190
DHCP services. And just to verify that, let's peek at the NSX manager for a

116
05:10.190 --> 05:11.440
moment. So, here in the

117
05:11.440 --> 05:16.440
NSX manager, if we go to networking and on the left-hand side, if we go down to

118
05:16.440 --> 05:17.360
NAT under network

119
05:17.360 --> 05:21.280
services, here's our source NAT rule. Then we collapse to the left-hand side.

120
05:21.280 --> 05:21.760
It gives a little

121
05:21.760 --> 05:25.790
more room here. If we click on the little icon for statistics, here's showing

122
05:25.790 --> 05:26.880
we have one active

123
05:26.880 --> 05:30.990
sessions. And over time, we've had a lot of traffic flow through there. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:26.880 --> 05:30.990
sessions. And over time, we've had a lot of traffic flow through there. And

124
05:30.990 --> 05:31.920
that would include all

125
05:31.920 --> 05:35.970
the traffic from our fast speed test and other traffic that's being sent from

126
05:35.970 --> 05:36.960
our network out

127
05:36.960 --> 05:40.590
through the gateway zero. And now that we've verified all of our existing

128
05:40.590 --> 05:42.320
connectivity from our VMs

129
05:42.320 --> 05:47.810
here, including SH up to here, and also the fact that they can get up to Cisco.

130
05:47.810 --> 05:48.640
com, and also the

131
05:48.640 --> 05:52.020
fact that they can get to eBay. Now, we didn't test every single option on both

132
05:52.020 --> 05:53.120
VMs, but between the

133
05:53.120 --> 05:57.080
two of them, we verified all of this connectivity. And currently, they are

134
05:57.080 --> 05:58.000
using the default

135
05:58.000 --> 06:02.310
distributed firewall policy rules for traffic going through our NSX environment
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
05:58.000 --> 06:02.310
distributed firewall policy rules for traffic going through our NSX environment

136
06:02.310 --> 06:03.440
. And by default,

137
06:03.440 --> 06:07.600
the last entry is permitting all traffic. And that's why none of this traffic

138
06:07.600 --> 06:08.320
as it goes through the

139
06:08.320 --> 06:12.220
network and out to the public internet or up to this router interface for SSH.

140
06:12.220 --> 06:13.040
That's why none of

141
06:13.040 --> 06:16.540
this traffic is being denied because the default distributed firewall rules

142
06:16.540 --> 06:17.680
permit the traffic.

143
06:17.680 --> 06:21.470
However, we are going to change that as we begin to implement our plan and

144
06:21.470 --> 06:22.000
leverage

145
06:22.000 --> 06:27.000
distributed firewall rules in conjunction with context profiles to deny certain

146
06:27.000 --> 06:28.080
flows of traffic.

147
06:28.080 --> 06:38.080
[BLANK_AUDIO]