WEBVTT

1
00:00.000 --> 00:04.000
So, now that we have this first rule in place for NSX to look for and pay

2
00:04.000 --> 00:07.830
attention and analyze effectively our DNS traffic to implement the fully

3
00:07.830 --> 00:11.130
qualified domain name filtering, we are going to create another role that says,

4
00:11.130 --> 00:16.180
you know what, if the traffic is HTTPS, which means is going to TCP port 443,

5
00:16.180 --> 00:20.000
this layer for information and at the application layer, if it's HTTPS

6
00:20.000 --> 00:23.880
specifically and they're trying to go to anything at Cisco.com, let's go ahead

7
00:23.880 --> 00:24.500
and reject it.

8
00:24.500 --> 00:27.890
So, let's create that second part right now as part of the fully qualified

9
00:27.890 --> 00:31.620
domain name filtering. So, we'll select our policy again, click on add rule.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.890 --> 00:31.620
domain name filtering. So, we'll select our policy again, click on add rule.

10
00:31.620 --> 00:35.350
Now, it doesn't actually matter if you put this rule above or below the other

11
00:35.350 --> 00:38.500
rule inside this policy, but it does have to exist.

12
00:38.500 --> 00:42.030
The one that's doing the basic inspection of DNS. So, just for visual purposes,

13
00:42.030 --> 00:45.530
I'm going to take the new rule and drag it down and put it right here below the

14
00:45.530 --> 00:48.600
one that's doing the DNS inspection, but again, it doesn't have to be right

15
00:48.600 --> 00:50.000
below it. It can be right above it.

16
00:50.000 --> 00:54.200
Or anywhere inside of this policy that we're using for FQD and filtering. So,

17
00:54.200 --> 00:58.000
for the new rule, let's go ahead and call it, no Cisco via HTTPS.

18
00:58.000 --> 01:01.930
And then for the source, let's go ahead and specify this is going to apply to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:58.000 --> 01:01.930
And then for the source, let's go ahead and specify this is going to apply to

19
01:01.930 --> 01:05.590
any machines that are in the group called all clients. So, we'll click on all

20
01:05.590 --> 01:08.000
clients there, click on apply just to confirm.

21
01:08.000 --> 01:11.160
So, I want to make sure that Mint one and two are in that group, they are, we

22
01:11.160 --> 01:14.000
'll click on close and with that selected, we'll click on apply.

23
01:14.000 --> 01:17.440
And then for the destination, it could be anywhere on the internet, so I'm

24
01:17.440 --> 01:20.000
going to leave that as any and then for the services.

25
01:20.000 --> 01:24.580
Let's imagine we only want to filter clients from going to Cisco.com if they're

26
01:24.580 --> 01:28.000
trying to use HTTPS. So, let's go ahead and click on the edit there.

27
01:28.000 --> 01:32.230
And then for the layer four information, let's go ahead and type in HTTP as a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:28.000 --> 01:32.230
And then for the layer four information, let's go ahead and type in HTTP as a

28
01:32.230 --> 01:35.000
filter. And then here is HTTPS.

29
01:35.000 --> 01:39.120
And if we wanted to, we could also include TCP port 80. But if all we're

30
01:39.120 --> 01:42.000
concerned about is TCP port 443.

31
01:42.000 --> 01:46.180
All we really need to match on is TCP port 443. So, I'm going to select just

32
01:46.180 --> 01:47.000
that, click on apply.

33
01:47.000 --> 01:50.040
And then for the context profile, regarding what's really happening at the

34
01:50.040 --> 01:54.000
application layer, I want to make sure that the client is going to be rejected

35
01:54.000 --> 01:55.000
if they're using HTTPS.

36
01:55.000 --> 02:00.060
So, once again, specify HTTPS here as part of the context profile and another
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:55.000 --> 02:00.060
So, once again, specify HTTPS here as part of the context profile and another

37
02:00.060 --> 02:04.000
attribute, including any domain that ends in Cisco.com.

38
02:04.000 --> 02:07.000
And so, at the application layer with the context profile, once it sees that,

39
02:07.000 --> 02:11.000
it'll match on this rule, and then we can simply set this to a reject.

40
02:11.000 --> 02:14.850
So, right here on context profiles, for this new rule, we'll click on the

41
02:14.850 --> 02:16.000
pencil to edit it.

42
02:16.000 --> 02:19.510
And although there's quite a few context profiles that are pre-set up, so if we

43
02:19.510 --> 02:22.000
do SSH, which we used earlier, you notice we have one for that.

44
02:22.000 --> 02:25.500
However, there's not likely going to be one that's matching on just HTTPS

45
02:25.500 --> 02:28.000
traffic and if it's going to Cisco.com.

46
02:28.000 --> 02:32.480
So, we're going to go ahead and create a brand new context profile that we can
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
02:28.000 --> 02:32.480
So, we're going to go ahead and create a brand new context profile that we can

47
02:32.480 --> 02:34.000
use as part of our rule.

48
02:34.000 --> 02:36.000
So, we'll click right here on add context profile.

49
02:36.000 --> 02:39.750
And let's call this one CP for context profile, no Cisco via HTTP and then

50
02:39.750 --> 02:44.320
regarding the attributes regarding what we want to match on at the application

51
02:44.320 --> 02:45.000
layer.

52
02:45.000 --> 02:46.000
Let's go ahead and click on set.

53
02:46.000 --> 02:48.850
And the first thing I want to match on is let's go ahead and focus on the

54
02:48.850 --> 02:50.000
domain in Cisco.com.

55
02:50.000 --> 02:54.370
So, as far as this context profile that we're creating, we're going to click

56
02:54.370 --> 02:56.000
here on add attribute.

57
02:56.000 --> 02:59.000
And then from the dropdown, we'll click on domain FQDN name.

58
02:59.000 --> 03:01.450
Then we have this beautiful reminder right here that says, "Hey, you know what?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
02:59.000 --> 03:01.450
Then we have this beautiful reminder right here that says, "Hey, you know what?

59
03:01.450 --> 03:05.000
If you want this to work, you also need to have a app ID that's looking for DNS

60
03:05.000 --> 03:05.000
."

61
03:05.000 --> 03:09.000
Which we already did, so I will say, please don't show that again.

62
03:09.000 --> 03:13.870
And then for the domain name, if we type in Cisco right here, there's currently

63
03:13.870 --> 03:17.000
no existing attributes that are looking for Cisco anything.

64
03:17.000 --> 03:19.000
Although there's a few, there's not one for Cisco.

65
03:19.000 --> 03:23.300
So, to create a new entry for a fully qualified domain name for Cisco, we'll

66
03:23.300 --> 03:25.000
click on the three dots right here.

67
03:25.000 --> 03:27.000
And then click add FQDN.

68
03:27.000 --> 03:32.700
And then we'll put in asterisk.cisco.com, which would cover everything with the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
03:27.000 --> 03:32.700
And then we'll put in asterisk.cisco.com, which would cover everything with the

69
03:32.700 --> 03:34.000
domain ending in Cisco.com.

70
03:34.000 --> 03:39.000
Including www.cisco.com and FTP.cisco.com, etc.

71
03:39.000 --> 03:41.000
And then we'll click on save.

72
03:41.000 --> 03:44.020
So, there it is right there. And that's all we're looking for as far as domain

73
03:44.020 --> 03:45.000
name is concerned.

74
03:45.000 --> 03:46.000
So, we'll click on add.

75
03:46.000 --> 03:48.790
Now, for our purposes, based on our plan, I also want to confirm that if we're

76
03:48.790 --> 03:53.000
trying to access Cisco.com, that we're also trying to access it via HTTPS.

77
03:53.000 --> 03:57.420
So, I'm going to add a second attribute here by clicking on add attribute, then

78
03:57.420 --> 03:59.000
click on app ID.

79
03:59.000 --> 04:03.000
And then we'll go ahead and do a search. I'm going to type in HTTP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:59.000 --> 04:03.000
And then we'll go ahead and do a search. I'm going to type in HTTP.

80
04:03.000 --> 04:08.000
And there's HTTP, HTTP2. If we scroll down far enough, here's HTTPS.

81
04:08.000 --> 04:11.720
And remember that because we're dealing with a context profile, this is what we

82
04:11.720 --> 04:14.000
're looking for at the application layer.

83
04:14.000 --> 04:17.750
So, we'll go ahead and click on add. So, once we apply this at the application

84
04:17.750 --> 04:22.000
layer, this context profile is looking for both HTTPS,

85
04:22.000 --> 04:25.310
which is the primary protocol we're using on the internet today for secure

86
04:25.310 --> 04:26.000
connections,

87
04:26.000 --> 04:29.640
as well as a client attempting to go to anything ending in Cisco.com as part of

88
04:29.640 --> 04:31.000
their HTTPS session.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
04:29.640 --> 04:31.000
their HTTPS session.

89
04:31.000 --> 04:34.000
So, with those two in place, we'll click on apply.

90
04:34.000 --> 04:37.020
So, the attributes here, with the two there represent the one for the fully

91
04:37.020 --> 04:38.000
qualified domain name,

92
04:38.000 --> 04:43.170
and the other one for the application layer service of HTTPS, and we'll click

93
04:43.170 --> 04:44.000
on save.

94
04:44.000 --> 04:47.000
So, that was added successfully. So, we'll click on apply.

95
04:47.000 --> 04:49.730
So, there's our context profile right there. And if you want to see the details

96
04:49.730 --> 04:52.000
for it, we can click on the icon for editing.

97
04:52.000 --> 04:56.000
And then here, there's an option for only show what's currently selected.

98
04:56.000 --> 05:00.000
So, if we click on that radio button, it's showing us right here, that profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
05:00.000 --> 05:04.530
Oh, I meant to call it HTTPS. Let me edit that. And let me go ahead and call it

100
05:04.530 --> 05:07.000
HTTPS, because that's really what it's doing.

101
05:07.000 --> 05:10.000
We'll click on save. That looks good. And then we'll click apply.

102
05:10.000 --> 05:13.300
So, currently, this is up to allows. So, before we flip that to reject, let's

103
05:13.300 --> 05:16.000
take a moment and verify from our client that we can,

104
05:16.000 --> 05:20.000
indeed, connect out to Cisco.com using HTTPS.

105
05:20.000 --> 05:26.000
So, here at our client, let's go ahead and do a dig for www.sisco.com.

106
05:26.000 --> 05:34.500
So, DNS is working no problem. Let's also do a curl -i for HTTPS to www.sisco.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
05:26.000 --> 05:34.500
So, DNS is working no problem. Let's also do a curl -i for HTTPS to www.sisco.

107
05:34.500 --> 05:35.000
com.

108
05:35.000 --> 05:38.750
All that looks good. There's all the output there from that. And from a browser

109
05:38.750 --> 05:40.000
, let's test that as well.

110
05:40.000 --> 05:44.170
So, there's a bookmark for Cisco.com. And I'm going to do a control R to do a

111
05:44.170 --> 05:45.000
refresh.

112
05:45.000 --> 05:50.000
Just to verify we're getting current information there. And we are fantastic.

113
05:50.000 --> 05:54.560
So, let me go ahead and close that and minimize that. And let's flip this over

114
05:54.560 --> 05:57.000
to now a reject if that is matched.

115
05:57.000 --> 06:00.000
So, we'll go ahead and publish that. And let's bring back in our client.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
06:00.000 --> 06:05.050
So, here's our client that's just a moment ago, had success with this command.

117
06:05.050 --> 06:06.000
And now we'll do it again.

118
06:06.000 --> 06:10.000
And that says connection reset. And the reason for that is because of this rule

119
06:10.000 --> 06:14.000
right here that's looking for traffic going to Cisco.com.

120
06:14.000 --> 06:18.360
If it's HTTPS and that match, that's why it got rejected. So, if we did this,

121
06:18.360 --> 06:19.000
we went to a different site.

122
06:19.000 --> 06:23.000
Let's go ahead and do the same thing but for VMware.com.

123
06:23.000 --> 06:27.000
So, that works no problem. Let's also do that for ebay.com, which is coming up.

124
06:27.000 --> 06:33.000
It'll go ebay.com. And that works as well. So, what it doesn't work for is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
06:27.000 --> 06:33.000
It'll go ebay.com. And that works as well. So, what it doesn't work for is

125
06:33.000 --> 06:36.000
anything at Cisco.com because this rule is being matched.

126
06:36.000 --> 06:39.240
And if we disable this rule for a moment, so I'll go ahead and disable it. And

127
06:39.240 --> 06:41.000
we'll click on publish.

128
06:41.000 --> 06:44.730
So, now that rule is disabled, if we went back to our client and we hit the up

129
06:44.730 --> 06:49.380
arrow key and try it again, no problem whatsoever because the rule is no longer

130
06:49.380 --> 06:50.000
enabled.

131
06:50.000 --> 06:53.710
So, in this section, we've configured a effectively a layer seven inspection

132
06:53.710 --> 06:57.000
rule looking for DNS traffic and allowing it but doing the inspection.

133
06:57.000 --> 07:01.540
And then with that in place, we're then able to go ahead and set up a specific
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
06:57.000 --> 07:01.540
And then with that in place, we're then able to go ahead and set up a specific

134
07:01.540 --> 07:06.930
rule for FQDN filtering that was conditional upon HTTPS traffic going to

135
07:06.930 --> 07:09.000
anything at Cisco.com.