WEBVTT 1 00:00.000 --> 00:02.000 So as we continue our journey, 2 00:02.000 --> 00:04.320 our third example here in working with 3 00:04.320 --> 00:07.320 context profiles as part of a distributed firewall rule, 4 00:07.320 --> 00:09.320 what I'd like to do at the service layer, 5 00:09.320 --> 00:11.360 I'd like to set up a match for 6 00:11.360 --> 00:13.040 TCP traffic going to 443, 7 00:13.040 --> 00:15.320 which is a well-known port for HTTPS. 8 00:15.320 --> 00:16.880 In addition to that, 9 00:16.880 --> 00:21.520 there's an app ID already in place as part of NSX for eBay. 10 00:21.520 --> 00:24.240 It knows what eBay looks like and feels like. 11 00:24.240 --> 00:26.400 I'd like to use it as an example of 12 00:26.400 --> 00:28.240 sending up a rule to match on that. 13 00:28.240 --> 00:32.000 If so, to go ahead and take a specific action in our topology, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:28.240 --> 00:32.000 If so, to go ahead and take a specific action in our topology, 14 00:32.000 --> 00:33.040 we're going to go ahead and say, 15 00:33.040 --> 00:34.680 "We want to deny that from happening." 16 00:34.680 --> 00:35.800 In preparation for that, 17 00:35.800 --> 00:38.600 I'm also going to go back to these previous two examples that we did 18 00:38.600 --> 00:41.320 and disable all the rules associated with them, 19 00:41.320 --> 00:43.760 so that when we do this filtering for eBay traffic, 20 00:43.760 --> 00:45.400 we'll know exactly why it's happening. 21 00:45.400 --> 00:49.000 Also, one of the options that exists inside of ESX is the concept of 22 00:49.000 --> 00:51.120 URL filtering. 23 00:51.120 --> 00:53.280 That's going to be based on, for example, category. 24 00:53.280 --> 00:55.240 When you are all filtering, we could say, 25 00:55.240 --> 00:58.800 "We want to restrict people from going to banking websites 26 00:58.800 --> 01:03.000 and from auction websites or sites regarding drugs or alcohol," WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 26 00:58.800 --> 01:03.000 and from auction websites or sites regarding drugs or alcohol," 27 01:03.000 --> 01:03.920 or whatever it is. 28 01:03.920 --> 01:07.800 That's using the concept of URL filtering using a database 29 01:07.800 --> 01:10.880 that has a big lineup regarding a whole bunch of websites 30 01:10.880 --> 01:12.560 and what categories they fall into. 31 01:12.560 --> 01:14.440 That'll be in a separate skill. 32 01:14.440 --> 01:17.840 What we're going to do on here is still reinforce the concept 33 01:17.840 --> 01:19.360 of using an app ID. 34 01:19.360 --> 01:21.280 Again, they have one just for eBay, 35 01:21.280 --> 01:25.040 but it's matching on eBay as opposed to using the URL filtering function. 36 01:25.040 --> 01:28.760 We'll have a separate skill on URL filtering, but for right now, 37 01:28.760 --> 01:33.040 I just want to match on the context profile looking for the app called eBay. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 01:28.760 --> 01:33.040 I just want to match on the context profile looking for the app called eBay. 38 01:33.040 --> 01:37.120 Here in the NSX Manager, under Security and under Distributed Firewall, 39 01:37.120 --> 01:39.200 let me go ahead and collapse that so we can see more here, 40 01:39.200 --> 01:43.560 I'm going to go ahead and disable all the rules that we custom created up to 41 01:43.560 --> 01:44.200 this point, 42 01:44.200 --> 01:49.200 including the two here for the FQDN filtering and also for SSH. 43 01:49.200 --> 01:51.280 I want to go ahead and disable that one as well, 44 01:51.280 --> 01:52.880 and then we'll click on Publish. 45 01:52.880 --> 01:56.310 That way, there's no rules that are in place currently that are denying any 46 01:56.310 --> 01:57.200 kind of traffic. 47 01:57.200 --> 02:00.760 Then we'll click on Refresh right here just to make sure that it's all up to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 47 01:57.200 --> 02:00.760 Then we'll click on Refresh right here just to make sure that it's all up to 48 02:00.760 --> 02:01.120 date. 49 02:01.120 --> 02:02.000 Fantastic. 50 02:02.000 --> 02:06.200 Also, before we add a new rule to deny traffic based on the app ID for eBay, 51 02:06.200 --> 02:08.240 let's verify our clients can get to eBay. 52 02:08.240 --> 02:09.160 So we'll bring up a client. 53 02:09.160 --> 02:10.920 In fact, this is Mint 1. 54 02:10.920 --> 02:12.160 We've been using it all the time. 55 02:12.160 --> 02:13.720 Let's go ahead and bring up Mint 2. 56 02:13.720 --> 02:15.280 So here is Mint 2. 57 02:15.280 --> 02:16.000 Fantastic. 58 02:16.000 --> 02:19.360 Let's just confirm its IP address by going to a command prompt 59 02:19.360 --> 02:22.320 and typing in IP address and pressing Enter. 60 02:22.320 --> 02:25.680 And its IP address is 10.20.0.153. 61 02:25.680 --> 02:31.170 Let's also verify we can get out to www.ebay.com from a connectivity WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 61 02:25.680 --> 02:31.170 Let's also verify we can get out to www.ebay.com from a connectivity 62 02:31.170 --> 02:32.040 perspective. 63 02:32.040 --> 02:33.240 That looks good. 64 02:33.240 --> 02:41.680 Let's also do a curl dash i for HTTPS, colon, whack, whack, www.ebay.com. 65 02:41.680 --> 02:43.880 And that looks good as well. 66 02:43.880 --> 02:46.080 And just to confirm, let's go to a browser. 67 02:46.080 --> 02:48.040 And here in the browser, let's go out to eBay. 68 02:48.040 --> 02:49.120 And that's looking good. 69 02:49.120 --> 02:51.960 Let me also create a bookmark for that to make it easier next time. 70 02:51.960 --> 02:53.000 So I'll call it eBay. 71 02:53.000 --> 02:54.080 Click on Save. 72 02:54.080 --> 02:55.080 And that looked great. 73 02:55.080 --> 02:56.560 So we'll go ahead and close that. 74 02:56.560 --> 02:58.200 And we'll minimize that client. 75 02:58.200 --> 03:00.000 And let's create a new rule that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 76 03:00.000 --> 03:03.720 going to block traffic if it matches on the app ID for eBay. 77 03:03.720 --> 03:05.880 So although we could add this as an existing rule in order 78 03:05.880 --> 03:09.240 to shoot a farewell policy, let's create a brand new policy. 79 03:09.240 --> 03:11.680 So we'll go ahead and click on Add Policy. 80 03:11.680 --> 03:15.120 And we'll call this policy, Sorry eBay, for what we're about to do. 81 03:15.120 --> 03:16.040 So that's the policy. 82 03:16.040 --> 03:18.440 And then let's click on Add Rule to add a rule to that. 83 03:18.440 --> 03:21.560 And we'll say no eBay app ID. 84 03:21.560 --> 03:25.600 Which can remind us that we're doing a block to eBay based on the app ID. 85 03:25.600 --> 03:28.240 And so for the source, let's go ahead and click on Edit there. 86 03:28.240 --> 03:29.640 Let's go ahead and use IP address. 87 03:29.640 --> 03:32.120 Also put in 10, 0, 0, 0, slash 8. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 87 03:29.640 --> 03:32.120 Also put in 10, 0, 0, 0, slash 8. 88 03:32.120 --> 03:35.170 And that'll apply to clients coming from 10, anything, whether it's 10, 10, or 89 03:35.170 --> 03:35.960 10, 20, 90 03:35.960 --> 03:38.240 where Mint 1 and Mint 2 are respectively. 91 03:38.240 --> 03:41.200 And then as far as the destinations, we'll say anywhere is fine. 92 03:41.200 --> 03:45.400 And then for services, let's lock it down to just TCP port 443. 93 03:45.400 --> 03:46.920 So we'll go ahead up here. 94 03:46.920 --> 03:48.760 And we'll type in HTTP. 95 03:48.760 --> 03:50.280 Press Enter for the filter. 96 03:50.280 --> 03:52.600 And with that filter in place, here's HTTP. 97 03:52.600 --> 03:54.400 And what we want is HTTPS. 98 03:54.400 --> 03:56.040 We'll click on the checkbox there. 99 03:56.040 --> 04:00.280 So for the services of HTTPS, it really means here that we're looking at the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 99 03:56.040 --> 04:00.280 So for the services of HTTPS, it really means here that we're looking at the 100 04:00.280 --> 04:00.480 layer 101 04:00.480 --> 04:04.080 for protocol called TCP, going to the well-known port of 443. 102 04:04.080 --> 04:08.240 Also right here, if we click on Show Only Selected, it'll filter out and only 103 04:08.240 --> 04:08.520 show you 104 04:08.520 --> 04:10.440 the ones that you have selected currently. 105 04:10.440 --> 04:14.560 So if we even remove that filter and the show only selected, it's going to show 106 04:14.560 --> 04:14.680 us 107 04:14.680 --> 04:16.960 just HTTPS here, fantastic. 108 04:16.960 --> 04:20.480 Or if we say, I want to see everything, it's going to show us all the possible 109 04:20.480 --> 04:20.800 options 110 04:20.800 --> 04:23.760 here, all 412 of them, page by page by page. 111 04:23.760 --> 04:27.780 So we'll click on Apply and confirm now that we have it layer 4, looking for 112 04:27.780 --> 04:29.920 TCP to port 443. 113 04:29.920 --> 04:33.520 So for context profile, we want to match in the app ID for eBay. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 113 04:29.920 --> 04:33.520 So for context profile, we want to match in the app ID for eBay. 114 04:33.520 --> 04:37.120 So we'll click on the pencil here to edit the column for context profiles for 115 04:37.120 --> 04:38.160 this new rule. 116 04:38.160 --> 04:43.250 So there's no currently created specific context profiles looking for the app 117 04:43.250 --> 04:43.520 eBay, 118 04:43.520 --> 04:45.000 but they do have the app ID for eBay. 119 04:45.000 --> 04:49.480 So if we click on the cancel here to hide the filter, let's just add a context 120 04:49.480 --> 04:49.880 profile 121 04:49.880 --> 04:53.440 of our own, we'll call it looking for eBay. 122 04:53.440 --> 04:57.080 And then for the attributes, we'll click on Set, we'll click on Add Attribute, 123 04:57.080 --> 04:57.200 and for 124 04:57.200 --> 05:01.760 the app ID, let's go ahead and search here for eBay. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 124 04:57.200 --> 05:01.760 the app ID, let's go ahead and search here for eBay. 125 05:01.760 --> 05:02.760 And there it is right there. 126 05:02.760 --> 05:04.640 So they have the app ID already. 127 05:04.640 --> 05:08.290 They just don't have a context profile specifically looking for that app ID, 128 05:08.290 --> 05:09.200 but we do know, 129 05:09.200 --> 05:10.200 we just made it. 130 05:10.200 --> 05:13.950 So this context profile that we just created is that we're looking for matching 131 05:13.950 --> 05:14.320 on the 132 05:14.320 --> 05:15.920 app ID for eBay. 133 05:15.920 --> 05:20.200 We'll click on Add, we'll click on Apply, and then we'll click on Save. 134 05:20.200 --> 05:24.170 So currently out of 65 now, context profiles, we have one that's selected as 135 05:24.170 --> 05:24.880 shown right 136 05:24.880 --> 05:25.880 here. 137 05:25.880 --> 05:28.530 So if we want to see just that one that's selected, we just use a slider right 138 05:28.530 --> 05:28.920 here to 139 05:28.920 --> 05:29.920 show us that. 140 05:29.920 --> 05:30.920 Fantastic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 140 05:29.920 --> 05:30.920 Fantastic. 141 05:30.920 --> 05:31.920 There it is. 142 05:31.920 --> 05:32.920 And we'll click on Apply. 143 05:32.920 --> 05:36.920 So currently this rule says traffic from 10, anything going anywhere. 144 05:36.920 --> 05:40.080 If at layer four, it's going to TCP port 443. 145 05:40.080 --> 05:44.720 And from the application layer perspective, it's matching on the app ID for 146 05:44.720 --> 05:45.360 eBay, then 147 05:45.360 --> 05:46.520 take this action. 148 05:46.520 --> 05:49.910 So we'll go ahead and change that action from Allow to Reject, and we'll click 149 05:49.910 --> 05:50.280 right 150 05:50.280 --> 05:51.280 here on Publish. 151 05:51.280 --> 05:54.490 And then to make sure that's taken, we'll just click on the Refresh here next 152 05:54.490 --> 05:54.960 to where 153 05:54.960 --> 05:58.560 it says in Progress and it says Success, Fantastic. 154 05:58.560 --> 06:00.320 Let's bring back our client and test. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 154 05:58.560 --> 06:00.320 Let's bring back our client and test. 155 06:00.320 --> 06:01.320 So here is our client. 156 06:01.320 --> 06:04.520 And the last command we did was a curl to this URL. 157 06:04.520 --> 06:07.510 And if we do it now, check it out, we now have a reset that says, "Uh-uh, not 158 06:07.510 --> 06:07.880 going to 159 06:07.880 --> 06:08.880 happen." 160 06:08.880 --> 06:13.280 And that's one of the actions we associated with this rule right here. 161 06:13.280 --> 06:18.240 Or if we went to a browser and we went to eBay, assuming it's not in our cache, 162 06:18.240 --> 06:18.360 that 163 06:18.360 --> 06:21.440 should also give us a message indicating that there's a problem. 164 06:21.440 --> 06:24.880 There was a reset, and that's because of our policy in our distributive 165 06:24.880 --> 06:25.760 firewall that's 166 06:25.760 --> 06:29.120 saying, "Hey, I'm matching on the eBay app ID, and as a result, the action is 167 06:29.120 --> 06:29.720 reject. 168 06:29.720 --> 06:30.720 I'm so sorry." WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 168 06:29.720 --> 06:30.720 I'm so sorry." 169 06:30.720 --> 06:34.260 So at our client, if we did a curl and we didn't go to HTTPS, for example, let 170 06:34.260 --> 06:34.560 's go 171 06:34.560 --> 06:41.070 ahead and just use HTTP, we no longer get a reset, or if we do a ping to www.eb 172 06:41.070 --> 06:42.000 ay.com 173 06:42.000 --> 06:46.300 and press enter, that works no problem because we're not filtering ICMP traffic 174 06:46.300 --> 06:47.560 or HTTP traffic. 175 06:47.560 --> 06:51.640 We're just matching on the app ID if it's being used in combination with HTTPS. 176 06:51.640 --> 06:54.120 And again, that's based on this rule right here. 177 06:54.120 --> 06:56.560 I'm going to make my screen a little bit smaller there. 178 06:56.560 --> 06:59.230 So another way of resizing the screen, we can see this icon right here, and 179 06:59.230 --> 06:59.680 that's the 180 06:59.680 --> 07:00.680 icon for a stat. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 180 06:59.680 --> 07:00.680 icon for a stat. 181 07:00.680 --> 07:03.680 So if we click on that, it's showing us a zero hit count. 182 07:03.680 --> 07:07.110 Now the reason for that is that rule statistics right here showing us may be 183 07:07.110 --> 07:07.840 stale as they're 184 07:07.840 --> 07:10.640 aggregated every 15 minutes. 185 07:10.640 --> 07:11.640 So we'll wait a little bit. 186 07:11.640 --> 07:14.510 And also for the gear right here on the rule itself, we click on the gear there 187 07:14.510 --> 07:15.040 , we have 188 07:15.040 --> 07:17.720 the option for enabling logging as well. 189 07:17.720 --> 07:20.800 So we're going to log IPV4 traffic in the direction and out. 190 07:20.800 --> 07:22.040 We'll click on apply. 191 07:22.040 --> 07:25.300 So now we've just enabled logging capabilities as well for traffic matching 192 07:25.300 --> 07:25.960 this specific 193 07:25.960 --> 07:28.240 rule called no ebay app ID. 194 07:28.240 --> 07:31.080 And for the actual statistics for the matches on that rule, once again, we may WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 194 07:28.240 --> 07:31.080 And for the actual statistics for the matches on that rule, once again, we may 195 07:31.080 --> 07:31.640 have to wait 196 07:31.640 --> 07:35.000 up to 15 minutes for them to be reflected right here. 197 07:35.000 --> 07:38.390 So with this skill, we focused on the concept of looking at and using 198 07:38.390 --> 07:39.200 application layer 199 07:39.200 --> 07:43.160 information as part of our distributed firewall rules. 200 07:43.160 --> 07:47.400 And the examples we used were matching on SSH and denying that and also 201 07:47.400 --> 07:48.240 matching on 202 07:48.240 --> 07:52.950 specific domain names if they're using HTTPS and denying on that and also 203 07:52.950 --> 07:53.960 denying based 204 07:53.960 --> 07:56.280 on an app ID for a specific vendor. 205 07:56.280 --> 07:59.430 And again, this was pretty easy to pull off on this one because they already 206 07:59.430 --> 07:59.960 have an app 207 07:59.960 --> 08:04.370 ID specific for eBay, which we simply had to create a context profile that said WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 207 07:59.960 --> 08:04.370 ID specific for eBay, which we simply had to create a context profile that said 208 08:04.370 --> 08:04.800 we want 209 08:04.800 --> 08:08.600 to match on that and then use that as part of a rule that blocks on effectively 210 08:08.600 --> 08:09.640 any traffic 211 08:09.640 --> 08:12.040 that's going from clients to eBay. 212 08:12.040 --> 08:16.640 And that's not just the IP address for eBay or the URLs associate eBay. 213 08:16.640 --> 08:20.840 It's on the application layer inspection that VMware has created as part of NSX 214 08:20.840 --> 08:20.980 that's 215 08:20.980 --> 08:24.000 matching on that traffic and realizes, hey, it's eBay.