WEBVTT

1
00:00.000 --> 00:02.720
So now that we have verified our basic connectivity,

2
00:02.720 --> 00:06.000
as well as confirming SSH and access out to the internet,

3
00:06.000 --> 00:07.600
to Cisco and eBay,

4
00:07.600 --> 00:10.640
let's begin our process based on our game plan of

5
00:10.640 --> 00:13.400
eliminating some of that traffic on the distributed firewall,

6
00:13.400 --> 00:15.360
leveraging context profiles.

7
00:15.360 --> 00:16.840
So for our first task right here,

8
00:16.840 --> 00:20.920
we're going to deny SSH from clients that would include these VMs.

9
00:20.920 --> 00:23.320
So we'll make sure they're in the clients group,

10
00:23.320 --> 00:26.080
and we'll set up a deny so that if they're trying to go to

11
00:26.080 --> 00:30.160
this IP address right here at 23.1.2.1 using SSH,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:26.080 --> 00:30.160
this IP address right here at 23.1.2.1 using SSH,

12
00:30.160 --> 00:31.600
that we're going to drop it.

13
00:31.600 --> 00:33.040
So as part of setting up the new rule,

14
00:33.040 --> 00:35.680
we're going to identify the SSH service,

15
00:35.680 --> 00:39.280
basically the TCP protocol and port 22,

16
00:39.280 --> 00:43.360
as well as using a context profile to confirm it's really SSH.

17
00:43.360 --> 00:44.480
So without further ado,

18
00:44.480 --> 00:46.160
let's head over to the NSX manager,

19
00:46.160 --> 00:50.400
and let's create a new policy and a new rule that does exactly that.

20
00:50.400 --> 00:53.200
So here in NSX manager, we'll click on the security tab,

21
00:53.200 --> 00:54.240
and then on the left,

22
00:54.240 --> 00:57.600
we'll go down under policy management to distributed firewall.

23
00:57.600 --> 00:59.440
So that's where we are in the interface.

24
00:59.440 --> 01:02.480
I'm also going to go ahead and collapse the left-hand side
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:59.440 --> 01:02.480
I'm also going to go ahead and collapse the left-hand side

25
01:02.480 --> 01:04.080
to give us a little more room right here.

26
01:04.080 --> 01:05.360
So here in the distributed firewall,

27
01:05.360 --> 01:07.520
if we click on the all rules sub tab here,

28
01:07.520 --> 01:11.040
it's showing us all the rules that exist from any of the categories.

29
01:11.040 --> 01:13.040
And so if we want to see the category specific rules,

30
01:13.040 --> 01:14.240
we can click right here.

31
01:14.240 --> 01:15.680
And here we have Ethernet,

32
01:15.680 --> 01:18.880
emergency, infrastructure, environment, and application.

33
01:18.880 --> 01:21.360
And so these are going to be processed going from left to right.

34
01:21.360 --> 01:22.960
And then within each category,

35
01:22.960 --> 01:24.320
it's done from top down.

36
01:24.320 --> 01:27.520
So for example, here in the application category,

37
01:27.520 --> 01:29.120
we currently have three rules.

38
01:29.120 --> 01:32.240
And these are three of the default rules that came with the system.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:29.120 --> 01:32.240
And these are three of the default rules that came with the system.

39
01:32.240 --> 01:33.920
One for neighbor discovery protocol,

40
01:33.920 --> 01:35.760
one for DHCP services,

41
01:35.760 --> 01:38.800
and one for anything else that happens to be layer three.

42
01:38.800 --> 01:41.840
And those are all being permitted by default in the default rules.

43
01:41.840 --> 01:45.360
So I'll go ahead and collapse the default policy with his three rules.

44
01:45.360 --> 01:47.200
And actually before we limit SSH,

45
01:47.200 --> 01:49.120
let's verify that we can do SSH.

46
01:49.120 --> 01:49.920
This is Mint1.

47
01:49.920 --> 01:51.360
So we'll type in SSH,

48
01:51.360 --> 01:53.440
and it'll do a dash L for login.

49
01:53.440 --> 02:00.320
And we'll log in as the user bios to the IP address 23.1.2.1 press enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:53.440 --> 02:00.320
And we'll log in as the user bios to the IP address 23.1.2.1 press enter.

50
02:00.320 --> 02:01.360
And it wants the password.

51
02:01.360 --> 02:02.400
I'll supply that.

52
02:02.400 --> 02:03.360
We'll press enter.

53
02:03.360 --> 02:04.320
And sure enough, that works.

54
02:04.320 --> 02:04.880
No problem.

55
02:04.880 --> 02:06.000
Multipine exit.

56
02:06.000 --> 02:06.960
Another option too,

57
02:06.960 --> 02:10.160
we can use to test connectivity on a port is we can use telnet.

58
02:10.160 --> 02:13.120
Now by default, telnet is going to be using TCP,

59
02:13.120 --> 02:15.360
going to the well-known port for telnet of 23.

60
02:15.360 --> 02:18.720
However, we can go ahead and change that here at the command line

61
02:18.720 --> 02:21.920
by saying we want to telnet to 23.1.2.1.

62
02:21.920 --> 02:24.400
However, we want to use port 22.

63
02:24.400 --> 02:27.680
So that's a convenient way to help check and test connectivity

64
02:27.680 --> 02:29.120
to see whether a port is open or not.

65
02:29.120 --> 02:30.720
So if we press enter here, check it out.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.120 --> 02:30.720
So if we press enter here, check it out.

66
02:30.720 --> 02:32.160
We connected on that port.

67
02:32.160 --> 02:33.680
Now once I press enter here,

68
02:33.680 --> 02:34.720
it's going to say, whoa,

69
02:34.720 --> 02:36.880
this isn't the SSH application.

70
02:36.880 --> 02:38.720
It says the device at the other end.

71
02:38.720 --> 02:40.960
And so there's a protocol mismatch error here

72
02:40.960 --> 02:42.080
and it's kicking us out.

73
02:42.080 --> 02:43.280
But we did get connectivity.

74
02:43.280 --> 02:45.520
So if we do that again and just waited,

75
02:45.520 --> 02:48.320
we have this open TCP session now here to port 22.

76
02:48.320 --> 02:51.120
Just a way to verify that port is being allowed

77
02:51.120 --> 02:54.640
through the network over to that gateway at 23.1.2.1.

78
02:54.640 --> 02:56.320
So press enter, we'll close that.

79
02:56.320 --> 02:58.320
And now that we've verified that SSH works

80
02:58.320 --> 03:00.560
and that the TCP port 22 is open,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:58.320 --> 03:00.560
and that the TCP port 22 is open,

81
03:00.560 --> 03:02.640
let's create a new policy.

82
03:02.640 --> 03:04.960
So here with the distributed firewall selected

83
03:04.960 --> 03:07.520
and the sub-tab of category specific rules

84
03:07.520 --> 03:09.600
and with the application category selected,

85
03:09.600 --> 03:11.280
let's click on add policy.

86
03:11.280 --> 03:13.840
And let's name this our SSH policy.

87
03:13.840 --> 03:15.120
So regarding this policy,

88
03:15.120 --> 03:18.160
over here, there's a little gear for advanced configuration.

89
03:18.160 --> 03:19.520
So we'll click on the gear.

90
03:19.520 --> 03:22.320
And here for these settings for our SSH policy,

91
03:22.320 --> 03:23.200
here are the defaults,

92
03:23.200 --> 03:25.360
including TCP strict is enabled,

93
03:25.360 --> 03:27.600
which basically means that there's a TCP segment

94
03:27.600 --> 03:28.960
that's going through.

95
03:28.960 --> 03:30.720
And it's not an initial send request.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:28.960 --> 03:30.720
And it's not an initial send request.

96
03:30.720 --> 03:33.440
It's not part of an existing TCP session

97
03:33.440 --> 03:34.800
that we've already seen.

98
03:34.800 --> 03:36.320
It's going to go ahead and drop it effectively.

99
03:36.320 --> 03:38.240
It's going to prevent something from manipulating

100
03:38.240 --> 03:40.160
or trying to inject TCP traffic

101
03:40.160 --> 03:42.080
if it's not part of an existing session.

102
03:42.080 --> 03:43.360
The next option is stateful.

103
03:43.360 --> 03:45.280
It is also enabled by default,

104
03:45.280 --> 03:47.120
which basically means that the firewall

105
03:47.120 --> 03:49.760
is going to monitor and maintain state information

106
03:49.760 --> 03:52.320
for all the active connections going through it.

107
03:52.320 --> 03:53.840
And then the third option here is locked.

108
03:53.840 --> 03:54.960
It is off by default.

109
03:54.960 --> 03:56.560
So if we have multiple administrators

110
03:56.560 --> 03:59.040
and we want to lock the settings for this policy,

111
03:59.040 --> 04:00.480
we can do so, do our work,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
03:59.040 --> 04:00.480
we can do so, do our work,

112
04:00.480 --> 04:02.160
and then take off the lock when we're done.

113
04:02.160 --> 04:03.600
So I'm going to go ahead and leave the defaults

114
04:03.600 --> 04:05.840
for the policy called our SSH policy.

115
04:05.840 --> 04:07.040
We'll go ahead and click on cancel,

116
04:07.040 --> 04:08.160
no changes there.

117
04:08.160 --> 04:10.160
And now let's add a rule.

118
04:10.160 --> 04:12.160
So within this policy, with it selected,

119
04:12.160 --> 04:13.920
we'll click right here on add rule.

120
04:13.920 --> 04:16.080
And to help demonstrate the differences

121
04:16.080 --> 04:18.320
between this column here, which is services,

122
04:18.320 --> 04:20.400
which is again referring to things like the layer

123
04:20.400 --> 04:23.520
for protocol and the ports involved and context profiles,

124
04:23.520 --> 04:26.080
which is actually looking at the application layer information,

125
04:26.080 --> 04:29.120
I would like to make two separate rules here

126
04:29.120 --> 04:31.120
so we can compare and contrast the two.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
04:29.120 --> 04:31.120
so we can compare and contrast the two.

127
04:31.120 --> 04:35.360
So for the first rule, we'll call it deny TCP to 22,

128
04:35.360 --> 04:37.520
which means we're going to deny TCP traffic

129
04:37.520 --> 04:39.760
if it's going to TCP port 22.

130
04:39.760 --> 04:40.720
And then we're going to source.

131
04:40.720 --> 04:42.400
Let's click on the edit icon.

132
04:42.400 --> 04:45.040
And let's go ahead and say that's all clients.

133
04:45.040 --> 04:49.200
And let's click on view members and survey says,

134
04:49.200 --> 04:51.600
oh, I don't have my mint machines with that tag.

135
04:51.600 --> 04:53.680
So we'll correct that here in a moment.

136
04:53.680 --> 04:55.040
So I'm going to go ahead and use that group.

137
04:55.040 --> 04:57.760
And we'll include mint one and mint two as part of that group.

138
04:57.760 --> 05:00.560
So we'll click on close there, select that group, all clients,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
04:57.760 --> 05:00.560
So we'll click on close there, select that group, all clients,

139
05:00.560 --> 05:01.760
and click apply.

140
05:01.760 --> 05:03.760
And then before I forget, I'm going to go ahead

141
05:03.760 --> 05:06.640
and just click on publish here to save my changes.

142
05:06.640 --> 05:10.480
And let's go back and make sure that mint one and mint two

143
05:10.480 --> 05:12.960
are associated with that group called all clients.

144
05:12.960 --> 05:15.280
So to do that, we're going to go to inventory.

145
05:15.280 --> 05:17.680
And let me expand the left hand side here.

146
05:17.680 --> 05:20.320
So if we click on groups and go to all clients,

147
05:20.320 --> 05:23.040
and once again, click on view members at the moment,

148
05:23.040 --> 05:24.320
we don't have mint one and mint two

149
05:24.320 --> 05:26.640
because they don't have the correct tag associated with them.

150
05:26.640 --> 05:28.880
So let's fix that by going to virtual machines.

151
05:28.880 --> 05:31.600
Let's edit mint one and mint two by clicking on the three dots.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
05:28.880 --> 05:31.600
Let's edit mint one and mint two by clicking on the three dots.

152
05:31.600 --> 05:33.440
Next to each of them, clicking on edit.

153
05:33.440 --> 05:35.440
And we'll say that regarding tagging,

154
05:35.440 --> 05:38.160
we want to assign the tag of client tag.

155
05:38.160 --> 05:39.760
So we've assigned that to mint one.

156
05:39.760 --> 05:41.680
We'll go ahead and scroll down, click on save,

157
05:41.680 --> 05:44.080
and we'll do the same thing for mint two.

158
05:44.080 --> 05:46.560
So for mint two, we'll go ahead and click on the three dots,

159
05:46.560 --> 05:47.680
click on edit.

160
05:47.680 --> 05:49.280
And then for the tags column, we'll go ahead

161
05:49.280 --> 05:51.360
and choose the client tag there as well.

162
05:51.360 --> 05:53.440
And then scroll down, click on save.

163
05:53.440 --> 05:55.520
And then just to confirm I expand the left hand side,

164
05:55.520 --> 05:56.960
so we're still under inventory.

165
05:56.960 --> 05:59.360
We look at groups now for all clients

166
05:59.360 --> 06:01.520
and click on view members right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
05:59.360 --> 06:01.520
and click on view members right here.

167
06:01.520 --> 06:04.080
And sure enough, now we have mint one and mint two.

168
06:04.080 --> 06:04.880
Fantastic.

169
06:04.880 --> 06:05.280
All right.

170
06:05.280 --> 06:07.440
So now that those are both members of the group,

171
06:07.440 --> 06:09.280
let's go back to our firewall policy.

172
06:09.280 --> 06:10.960
So we'll go to security on the top.

173
06:10.960 --> 06:13.120
On the left, we'll click on distributed firewall.

174
06:13.120 --> 06:15.840
I'll collapse that so we have more room to work with right here.

175
06:15.840 --> 06:17.360
And let's continue our editing.

176
06:17.360 --> 06:20.560
So for this rule called deny TCP to 22,

177
06:20.560 --> 06:23.200
it's going to be rule ID 5096.

178
06:23.200 --> 06:25.920
The source it's matching on is the all clients group.

179
06:25.920 --> 06:27.120
And we can also change that too.

180
06:27.120 --> 06:30.080
If we wanted to change it to, for example, IP addresses,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
06:27.120 --> 06:30.080
If we wanted to change it to, for example, IP addresses,

181
06:30.080 --> 06:31.920
we could add IP addressing information here.

182
06:31.920 --> 06:34.720
So we could say, for example, 10, anything is going to match.

183
06:34.720 --> 06:36.960
But because we already have our groups identified

184
06:36.960 --> 06:39.280
with all clients and mint one and mint two are in that group,

185
06:39.280 --> 06:40.160
we are good to go.

186
06:40.160 --> 06:41.920
So we click on cancel there.

187
06:41.920 --> 06:45.280
For the destination, I want it to just be to our router interface

188
06:45.280 --> 06:47.360
at 23.1.2.1.

189
06:47.360 --> 06:50.320
So we'll click on the pencil and we'll put in just that IP address

190
06:50.320 --> 06:52.240
by clicking here on IP addresses

191
06:52.240 --> 06:56.080
and putting in the destination address of 23.1.2.1

192
06:56.080 --> 06:58.160
and clicking on apply.

193
06:58.160 --> 06:58.560
All right.

194
06:58.560 --> 07:00.000
So there's our destination.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

195
07:00.000 --> 07:02.800
And then for the service, let's go ahead and specify

196
07:02.800 --> 07:05.600
the layer four protocol and the well-known port.

197
07:05.600 --> 07:07.040
So to configure that, we'll click here

198
07:07.040 --> 07:10.640
in the services column on the icon to edit that section.

199
07:10.640 --> 07:13.040
So here in the services section, this

200
07:13.040 --> 07:16.080
has over 400 different services that are identified.

201
07:16.080 --> 07:18.480
And even though it has names of applications here

202
07:18.480 --> 07:20.320
in this name column, it's really focused

203
07:20.320 --> 07:23.280
on these service entries regarding the protocols

204
07:23.280 --> 07:24.400
and ports that they are using.

205
07:24.400 --> 07:29.440
So if we want to match on SSH, for example, port 22 for TCP,

206
07:29.440 --> 07:30.800
we can go ahead and filter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

206
07:29.440 --> 07:30.800
we can go ahead and filter.

207
07:30.800 --> 07:32.560
We type in SSH, press enter.

208
07:32.560 --> 07:34.400
And here is an entry for that.

209
07:34.400 --> 07:36.400
So if we select this as a service,

210
07:36.400 --> 07:39.440
it's really just matching on TCP with a destination port

211
07:39.440 --> 07:42.320
of 22, which is the well-known port for SSH.

212
07:42.320 --> 07:45.200
So we'll go ahead and click on that, click on apply.

213
07:45.200 --> 07:47.200
And now we're matching on SSH.

214
07:47.200 --> 07:48.880
And if we want to deny that traffic,

215
07:48.880 --> 07:51.120
we would simply right here in the action section,

216
07:51.120 --> 07:53.120
go ahead and click on either drop or reject.

217
07:53.120 --> 07:55.520
So because it's TCP based, if we do a drop,

218
07:55.520 --> 07:57.280
it'll just leave the client hanging.

219
07:57.280 --> 08:00.080
If we do a reject, it'll cause a TCP reset
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

219
07:57.280 --> 08:00.080
If we do a reject, it'll cause a TCP reset

220
08:00.080 --> 08:01.360
to be sent to the client.

221
08:01.360 --> 08:03.680
So before I click on publish, let's do a quick check

222
08:03.680 --> 08:08.240
just to make sure that currently that port 22 is open.

223
08:08.240 --> 08:11.680
So back here at Mint 1, if we do that telnet to port 22,

224
08:11.680 --> 08:13.600
see how it's open right there, no problem.

225
08:13.600 --> 08:16.000
Also, if we do an SSH to that router interface

226
08:16.000 --> 08:18.320
and put in the password, we are connected.

227
08:18.320 --> 08:20.080
So that's all working at the moment.

228
08:20.080 --> 08:21.520
So they minimize this.

229
08:21.520 --> 08:23.920
And let's go ahead and click on publish

230
08:23.920 --> 08:26.880
and push those changes out to the distributed firewall.

231
08:26.880 --> 08:29.520
So if we wanted to also, we don't have to apply this

232
08:29.520 --> 08:31.120
to the entire distributed firewall.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

232
08:29.520 --> 08:31.120
to the entire distributed firewall.

233
08:31.120 --> 08:33.040
We could also just have it apply to specific groups.

234
08:33.040 --> 08:35.760
But for our purposes, we want this to be a rule

235
08:35.760 --> 08:38.800
and have it applied to the distributed firewall as a whole.

236
08:38.800 --> 08:40.880
So I'm not going to make any changes right here

237
08:40.880 --> 08:42.000
on the apply to section.

238
08:42.000 --> 08:43.280
I'll click on cancel.

239
08:43.280 --> 08:46.640
And so with reject there selected and currently it's enabled,

240
08:46.640 --> 08:47.920
we'll click on publish.

241
08:47.920 --> 08:49.280
So right here where it says in progress,

242
08:49.280 --> 08:50.240
it's a little amber color.

243
08:50.240 --> 08:52.960
We'll click on refresh there and make sure it is green.

244
08:52.960 --> 08:53.600
Fantastic.

245
08:53.600 --> 08:54.320
So here's our client.

246
08:54.320 --> 08:56.160
We tested with a few moments ago Mint 1.

247
08:56.160 --> 08:59.280
So we did a telnet, which is just kind of like tricking the system,

248
08:59.280 --> 09:01.680
trying to connect on port 22, in this case,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

248
08:59.280 --> 09:01.680
trying to connect on port 22, in this case,

249
09:01.680 --> 09:03.600
with the 22 there and press enter.

250
09:03.600 --> 09:04.640
We have a reset that came back.

251
09:04.640 --> 09:06.160
And that's why it says connection refuse.

252
09:06.160 --> 09:09.680
So then we try to use SSH because it's also going to the well known port

253
09:09.680 --> 09:12.560
of TCP port 22 is being denied.

254
09:12.560 --> 09:15.440
Now at this point in our game, it's only being denied

255
09:15.440 --> 09:19.520
just because of the layer for port and protocol that was trying to go to.

256
09:19.520 --> 09:20.960
TCP port 22.

257
09:20.960 --> 09:23.840
And to confirm that we can hover over here on the SSH,

258
09:23.840 --> 09:26.160
click on it and it'll give us a little pop-up saying, yep,

259
09:26.160 --> 09:28.720
TCP, destination port equals 22.

260
09:28.720 --> 09:30.960
And that's what it means for this SSH service.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

260
09:28.720 --> 09:30.960
And that's what it means for this SSH service.

261
09:30.960 --> 09:35.220
Also, if there was a certain port and protocol that didn't exist already pred

262
09:35.220 --> 09:35.760
efined,

263
09:35.760 --> 09:40.160
you can also create new service entries to specify pretty much any port and

264
09:40.160 --> 09:40.880
protocol.

265
09:40.880 --> 09:44.160
And then you can include that as part of your security policy rule.

266
09:44.160 --> 09:46.000
Also, there's another verification of this.

267
09:46.000 --> 09:48.000
We could test this by using trace flow.

268
09:48.000 --> 09:51.040
So if we go to plan and troubleshoot right here,

269
09:51.040 --> 09:53.440
and then on the left, we'll expand our left-hand column,

270
09:53.440 --> 09:55.520
go down to traffic analysis.

271
09:55.520 --> 09:58.720
And then here on the tile for trace flow, we'll click on get started.

272
09:58.720 --> 10:02.960
So for this trace, instead of using the default ICMP, we can choose TCP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

272
09:58.720 --> 10:02.960
So for this trace, instead of using the default ICMP, we can choose TCP.

273
10:02.960 --> 10:05.440
We can choose the destination port of 22.

274
10:05.440 --> 10:09.050
It's very likely the clients can be using some random high-numbered port for

275
10:09.050 --> 10:09.520
that session.

276
10:09.520 --> 10:11.840
So we just make one up 6, 7, 8, 3.

277
10:11.840 --> 10:16.000
For the TCP flags inside the TCP header, it's going to include a SIN flag,

278
10:16.000 --> 10:18.320
which effectively looks like a SIN request.

279
10:18.320 --> 10:21.430
So if you want to include more, we can click here and simply specify what we

280
10:21.430 --> 10:22.080
want included.

281
10:22.080 --> 10:23.920
So a SIN is fantastic.

282
10:23.920 --> 10:27.040
And then for the source, we'll go ahead and choose Mint 1.

283
10:27.040 --> 10:30.200
And for the destination, we'll go ahead and say, we don't want to test to a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

283
10:27.040 --> 10:30.200
And for the destination, we'll go ahead and say, we don't want to test to a

284
10:30.200 --> 10:30.800
virtual machine,

285
10:30.800 --> 10:32.160
but rather to an IP address.

286
10:32.160 --> 10:34.530
And for the IP address, we'll click on layer 3, because we also don't care

287
10:34.530 --> 10:34.960
about the layer 2

288
10:34.960 --> 10:35.600
address there.

289
10:35.600 --> 10:38.640
The destination IP address is 23.1.2.1.

290
10:38.640 --> 10:41.520
And with that in place, we'll click on trace.

291
10:41.520 --> 10:45.440
And because it's a distributed firewall, the host, that's currently the compute

292
10:45.440 --> 10:46.160
resource

293
10:46.160 --> 10:49.600
for Mint 1, it should be dropping that traffic immediately.

294
10:49.600 --> 10:50.160
And here we go.

295
10:50.160 --> 10:54.500
So that traffic was injected on ESXIB, because that's the host that's hosting

296
10:54.500 --> 10:55.280
Mint 1.

297
10:55.280 --> 10:57.520
And then logically went through the distributed firewall.

298
10:57.520 --> 10:58.640
And it was then rejected.

299
10:58.640 --> 11:02.810
And that's saying it's real 5096, which is going to be the rule that we just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

299
10:58.640 --> 11:02.810
And that's saying it's real 5096, which is going to be the rule that we just

300
11:02.810 --> 11:04.240
set up to deny traffic

301
11:04.240 --> 11:05.920
to TCP port 22.

302
11:05.920 --> 11:09.280
So to verify that, if we go back to security and distributed firewall,

303
11:09.280 --> 11:12.960
and we open up our SSH rule right here, let me collapse the left-hand side,

304
11:12.960 --> 11:17.200
give us a little more room, there's the rule ID right there, 5096.

305
11:17.200 --> 11:21.340
So effectively, at this point, any traffic, if it's going to this IP address

306
11:21.340 --> 11:22.000
and it's going

307
11:22.000 --> 11:27.000
on TCP port 22 as the destination port, that's going to match this rule and be

308
11:27.000 --> 11:27.680
rejected.

309
11:27.680 --> 11:29.600
So let me go ahead and disable that for a moment.

310
11:29.600 --> 11:33.600
And we go ahead and make a new rule that's going to match just on the context
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

310
11:29.600 --> 11:33.600
And we go ahead and make a new rule that's going to match just on the context

311
11:33.600 --> 11:34.080
profile,

312
11:34.080 --> 11:37.360
looking for the application ID for SSH.

313
11:37.360 --> 11:40.800
So to do that, we'll go ahead and choose our SSH policy.

314
11:40.800 --> 11:42.400
We'll click on add rule.

315
11:42.400 --> 11:46.640
And I'm going to drag and drop this to just below the other one we just made.

316
11:46.640 --> 11:48.240
So there's the new rule right there.

317
11:48.240 --> 11:50.240
We'll call this deny SSH app.

318
11:50.240 --> 11:53.040
And then for the source, let's go ahead and use the all clients group once

319
11:53.040 --> 11:53.280
again.

320
11:53.280 --> 11:57.760
So we'll click on the pencil, select all clients right there, click apply,

321
11:57.760 --> 11:59.600
and we'll use the same destination.

322
11:59.600 --> 12:04.080
So click on the pencil there for destination, and we'll click on IP addresses,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

322
11:59.600 --> 12:04.080
So click on the pencil there for destination, and we'll click on IP addresses,

323
12:04.080 --> 12:08.080
and we'll put in the IP address 23.1.2.1 as the destination IP address.

324
12:08.080 --> 12:09.680
So if you wanted to, you could go to range up there.

325
12:09.680 --> 12:14.160
So we can do zero slash 24 that cover the whole subnet or for a specific host,

326
12:14.160 --> 12:18.560
we could do 23.1.2.1 or we could do a slash 32.

327
12:18.560 --> 12:20.880
Either way is great with or without the slash 32.

328
12:20.880 --> 12:24.000
It's going to assume that we're talking about that specific host if we put that

329
12:24.000 --> 12:26.080
IP address in, then we'll click on apply.

330
12:26.080 --> 12:29.280
And then for services, for this example, I'm going to leave these services,

331
12:29.280 --> 12:32.800
which is looking at the layer for information, for example, TCP port 22,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

331
12:29.280 --> 12:32.800
which is looking at the layer for information, for example, TCP port 22,

332
12:32.800 --> 12:37.040
I'm going to leave that blank and tell it just with a context profile to look

333
12:37.040 --> 12:37.520
for

334
12:37.520 --> 12:41.920
and see whether or not is the SSH application being carried in the application

335
12:41.920 --> 12:42.400
layer

336
12:42.400 --> 12:43.360
in the protocol stack.

337
12:43.360 --> 12:45.200
So to do that, we'll click on the pencil.

338
12:45.200 --> 12:48.240
And lucky for us, there's already a context profile for SSH.

339
12:48.240 --> 12:52.480
So if we click on the filter and type in SSH and press enter, there it is right

340
12:52.480 --> 12:52.720
there.

341
12:52.720 --> 12:58.000
So this context profile is looking at the application layer for SSH traffic.

342
12:58.000 --> 13:00.320
So we're going to go ahead and select it, click on apply.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

342
12:58.000 --> 13:00.320
So we're going to go ahead and select it, click on apply.

343
13:00.320 --> 13:03.560
And then for the action for this new rule, I'm going to specify that we want to

344
13:03.560 --> 13:03.920
go ahead

345
13:03.920 --> 13:04.560
and reject it.

346
13:04.560 --> 13:06.720
So the previous one there is disabled.

347
13:06.720 --> 13:10.000
And now we only have this one reject rule regarding SSH.

348
13:10.000 --> 13:11.760
So we'll go ahead and click on publish.

349
13:11.760 --> 13:14.720
And here is the rule idea of 5097.

350
13:14.720 --> 13:20.160
So now we only have this one rule that says deny traffic if it's the SSH using

351
13:20.160 --> 13:20.800
a context

352
13:20.800 --> 13:23.440
profile looking for the actual application itself.

353
13:23.440 --> 13:27.840
So from a services perspective, this rule doesn't really care if it's TCP port

354
13:27.840 --> 13:28.400
22 or

355
13:28.400 --> 13:29.440
try three or anything else.

356
13:29.440 --> 13:33.390
We're simply relying now completely on the context profile looking for the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

356
13:29.440 --> 13:33.390
We're simply relying now completely on the context profile looking for the

357
13:33.390 --> 13:34.240
application

358
13:34.240 --> 13:35.200
of SSH.

359
13:35.200 --> 13:38.600
So now if we bring back our client and we try to test, let's go ahead and do a

360
13:38.600 --> 13:39.520
SSH again,

361
13:39.520 --> 13:43.590
even though at layer four, we're not specifically looking just for TCP to port

362
13:43.590 --> 13:44.240
22,

363
13:44.240 --> 13:47.840
because at the application layer with our context profile, we're looking for

364
13:47.840 --> 13:48.320
SSH.

365
13:48.320 --> 13:49.680
And that's where attempting to use.

366
13:49.680 --> 13:52.720
That's what's causing this reset to be sent to us from NSX,

367
13:52.720 --> 13:55.680
because the distributive firewall policy is not allowing it.

368
13:55.680 --> 13:59.440
So for demonstration purposes, I use two specific rules, but most of the time,

369
13:59.440 --> 14:00.720
you're just going to want to have one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

369
13:59.440 --> 14:00.720
you're just going to want to have one.

370
14:00.720 --> 14:04.480
So if we take this one right here, that's just looking for TCP traffic going to

371
14:04.480 --> 14:04.960
the well known

372
14:04.960 --> 14:09.060
port of 22, let's go ahead and click on the three dots there and we'll delete

373
14:09.060 --> 14:09.600
that one,

374
14:09.600 --> 14:10.800
click on publish.

375
14:10.800 --> 14:14.240
And let's just edit our existing deny SSH app rule.

376
14:14.240 --> 14:17.840
So currently we're looking for just the application layer information for SSH,

377
14:17.840 --> 14:21.200
but we could also, in addition to that, say, hey, at layer four,

378
14:21.200 --> 14:25.120
we also are specifically looking for TCP going to 22.

379
14:25.120 --> 14:27.840
So we'll click on the pencil for the services column there,

380
14:27.840 --> 14:31.600
and then for the layer for protocol, we'll do a search for SSH.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

380
14:27.840 --> 14:31.600
and then for the layer for protocol, we'll do a search for SSH.

381
14:31.600 --> 14:34.480
And again, we'll choose this one right here, but remember, when it says

382
14:34.480 --> 14:34.960
services,

383
14:34.960 --> 14:37.040
we're talking about layer four information.

384
14:37.040 --> 14:39.120
This is TCP going to port 22.

385
14:39.120 --> 14:42.000
So we'll click on apply there and then click on publish.

386
14:42.000 --> 14:45.440
So originally we had two separate rules to compare and contrast,

387
14:45.440 --> 14:49.200
filtering just based on layer four information versus application layer

388
14:49.200 --> 14:50.000
information.

389
14:50.000 --> 14:53.040
And for this rule right here, we are now paying attention to both,

390
14:53.040 --> 14:57.760
including what is the specific layer for information regarding TCP going to

391
14:57.760 --> 14:58.560
port 22,

392
14:58.560 --> 15:02.080
as well as the application layer, checking to make sure it's really SSH.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

392
14:58.560 --> 15:02.080
as well as the application layer, checking to make sure it's really SSH.

393
15:02.080 --> 15:05.430
And if it is in both those conditions match, we're going to go ahead and reject

394
15:05.430 --> 15:06.160
the traffic.

395
15:06.160 --> 15:10.640
So as far as our game plan goes, our first example denying SSH,

396
15:10.640 --> 15:14.480
including the use of context profiles to look for the application SSH,

397
15:14.480 --> 15:16.960
we have implemented that and tested it.

398
15:16.960 --> 15:26.040
[BLANK_AUDIO]