WEBVTT

1
00:00.000 --> 00:04.080
In this video, you and I get to chat about a concept called a gateway firewall.

2
00:04.080 --> 00:07.510
And one of the first things I'd like to do is compare and contrast it to a

3
00:07.510 --> 00:09.040
distributed firewall.

4
00:09.040 --> 00:12.480
So the acronym here would be a DFW for the distributed firewall.

5
00:12.480 --> 00:16.640
And for a gateway firewall, we just call it a gateway firewall like that.

6
00:16.640 --> 00:20.270
And in previous skills, we've taken a look at using a distributed firewall and

7
00:20.270 --> 00:21.120
setting up rules

8
00:21.120 --> 00:24.960
based on the source and destination, whether it's group membership or IP

9
00:24.960 --> 00:26.160
addresses and the ports

10
00:26.160 --> 00:29.360
and protocols involved, and that distributed firewall can control east-west

11
00:29.360 --> 00:29.920
traffic.

12
00:29.920 --> 00:32.800
We also had it controlled traffic as it was trying to go out to the internet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.920 --> 00:32.800
We also had it controlled traffic as it was trying to go out to the internet.

13
00:32.800 --> 00:35.280
We also did some FQDN filtering.

14
00:35.280 --> 00:38.490
It was all wonderful. And the beautiful thing about a distributed firewall is

15
00:38.490 --> 00:39.760
that it's distributed,

16
00:39.760 --> 00:42.960
meaning all of our transport nodes know about it and they can enforce it.

17
00:42.960 --> 00:47.270
So if this VM here, VM1 is trying to communicate down here to this VM, let's

18
00:47.270 --> 00:48.160
call it VM2.

19
00:48.160 --> 00:51.430
Let's imagine that based on our security policy rules for the distributed

20
00:51.430 --> 00:51.920
firewall,

21
00:51.920 --> 00:55.940
that we are either based on source and destination group membership or IP

22
00:55.940 --> 00:57.280
address or the ports and

23
00:57.280 --> 01:01.360
protocols in use, let's imagine that the action for our security policy rule
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:57.280 --> 01:01.360
protocols in use, let's imagine that the action for our security policy rule

24
01:01.360 --> 01:02.080
for the distributed

25
01:02.080 --> 01:06.040
firewall was set to reject or drop that traffic. In that case, when this

26
01:06.040 --> 01:06.800
traffic is trying to be

27
01:06.800 --> 01:10.410
sent by this client, host A, who's the competing resource right there, because

28
01:10.410 --> 01:11.120
as a copy that

29
01:11.120 --> 01:14.840
distributed firewall can go ahead and enforce that policy and stop that traffic

30
01:14.840 --> 01:15.680
from ever leaving host

31
01:15.680 --> 01:20.330
A. So again, the distributed firewall is a set of policies and rules that are

32
01:20.330 --> 01:21.200
distributed across

33
01:21.200 --> 01:24.640
our transport nodes so that any one of them can enforce the policy.

34
01:24.640 --> 01:28.160
So the next logical question is, okay, what is the big difference then between

35
01:28.160 --> 01:29.680
a distributed firewall

36
01:29.680 --> 01:33.320
that we looked at previously that can be implemented across the board on all
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:29.680 --> 01:33.320
that we looked at previously that can be implemented across the board on all

37
01:33.320 --> 01:34.880
our transport nodes and

38
01:34.880 --> 01:38.720
a gateway firewall? And here's one of the big differences, even though we still

39
01:38.720 --> 01:39.680
can with a gateway

40
01:39.680 --> 01:44.210
firewall implement security policies based on group membership for source and

41
01:44.210 --> 01:45.520
destination or IP

42
01:45.520 --> 01:49.160
addresses for source and destination. And we can specify exactly in our rules

43
01:49.160 --> 01:50.080
what protocols and

44
01:50.080 --> 01:54.480
ports we want to allow or not allow instead of having it hover and existing

45
01:54.480 --> 01:55.120
everywhere across

46
01:55.120 --> 01:58.940
all our transport nodes with a gateway based firewall, we're implementing it

47
01:58.940 --> 02:00.000
specifically on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:00.000 --> 02:03.770
one of our gateways. So let go ahead and remove the DFW component here for a

49
02:03.770 --> 02:04.640
moment. And let's

50
02:04.640 --> 02:08.650
imagine we're setting up a gateway firewall and we're implementing it right

51
02:08.650 --> 02:09.840
here on gateway A.

52
02:09.840 --> 02:13.950
So in this example, if we set up a gateway firewall right here on gateway A,

53
02:13.950 --> 02:14.800
and let's imagine we have

54
02:14.800 --> 02:18.440
this VM here, let's say it's VM three, that's trying to communicate with VM

55
02:18.440 --> 02:19.520
four, as part of our

56
02:19.520 --> 02:23.480
security policies and the rules in those policies in a gateway firewall, it's

57
02:23.480 --> 02:24.240
only traffic that's

58
02:24.240 --> 02:27.780
trying to be routed through this gateway that's going to be compared against

59
02:27.780 --> 02:28.880
those rules. So we

60
02:28.880 --> 02:32.830
could have one set of rules right here on gateway A and a different set of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:28.880 --> 02:32.830
could have one set of rules right here on gateway A and a different set of

61
02:32.830 --> 02:34.080
rules here on the tier

62
02:34.080 --> 02:38.670
zero gateway zero, and get a third set of rules here on gateway B. And the

63
02:38.670 --> 02:39.760
rules on each of those

64
02:39.760 --> 02:43.680
respective gateways is only going to be enforced for traffic if it's trying to

65
02:43.680 --> 02:44.720
be routed over those

66
02:44.720 --> 02:48.160
respective gateways. So if we need some centralized rules that are going to be

67
02:48.160 --> 02:48.720
implemented at the

68
02:48.720 --> 02:52.850
gateways only, we could modify our gateway firewall policy at the rules we want

69
02:52.850 --> 02:53.680
and add them to the

70
02:53.680 --> 02:57.100
correct gateway that we want them to be implemented on, and we're good to go.

71
02:57.100 --> 02:57.600
There's a couple of

72
02:57.600 --> 03:01.210
caveats that we want to be aware of as we implement a gateway firewall. Number
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:57.600 --> 03:01.210
caveats that we want to be aware of as we implement a gateway firewall. Number

73
03:01.210 --> 03:01.760
one, if we're

74
03:01.760 --> 03:05.560
implementing the gateway firewall services behind the scenes for that logical

75
03:05.560 --> 03:06.400
processing for the

76
03:06.400 --> 03:10.760
gateway firewall, it's going to be sent up to one of our edge notes. So at the

77
03:10.760 --> 03:11.440
moment in our

78
03:11.440 --> 03:15.770
environment, this gateway A and this gateway B, they are set up as distributed

79
03:15.770 --> 03:16.640
router gateways

80
03:16.640 --> 03:21.360
only at tier one. And so if we want to implement gateway firewalls at gateway A

81
03:21.360 --> 03:22.640
or gateway B,

82
03:22.640 --> 03:26.400
we need to go ahead and tell those two tier one gateways that they should be

83
03:26.400 --> 03:27.600
associated with

84
03:27.600 --> 03:30.800
our transport node cluster. Because behind the scenes, what's going to happen
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:27.600 --> 03:30.800
our transport node cluster. Because behind the scenes, what's going to happen

85
03:30.800 --> 03:31.600
is if this VM

86
03:31.600 --> 03:35.110
here VM one is trying to talk to VM number two, and we have a gateway firewall

87
03:35.110 --> 03:36.320
and gateway A

88
03:36.320 --> 03:40.260
behind the scenes host A, because a gateway firewall host A is going to send

89
03:40.260 --> 03:41.200
the traffic from this

90
03:41.200 --> 03:44.920
VM over to one of our edge nodes. So it can go ahead and actually implement the

91
03:44.920 --> 03:46.320
services of that

92
03:46.320 --> 03:50.800
gateway firewall. So if they distributed firewall, ESXIA, having a copy of that

93
03:50.800 --> 03:54.320
distributed firewall, get implement that security all on its own. However, if

94
03:54.320 --> 03:55.200
now we're implementing

95
03:55.200 --> 03:59.000
a gateway firewall, we are going to need an edge device to actually perform

96
03:59.000 --> 04:00.080
that logical function
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:59.000 --> 04:00.080
that logical function

97
04:00.080 --> 04:03.990
for us. Also in the lab environment, when I deploy these two edge nodes, I

98
04:03.990 --> 04:04.560
actually specified,

99
04:04.560 --> 04:08.400
I think the medium size for the deployment and some of the features that we can

100
04:08.400 --> 04:08.960
implement

101
04:08.960 --> 04:13.400
on our gateways also depend on the size of our deployment. So for example,

102
04:13.400 --> 04:14.320
there is some limitation

103
04:14.320 --> 04:18.220
on a few features. If we use the small option and we have additional features

104
04:18.220 --> 04:18.800
available,

105
04:18.800 --> 04:22.880
if we deploy it with the large option, and that boils down to how many CPUs and

106
04:22.880 --> 04:23.760
how much RAM

107
04:23.760 --> 04:25.680
each of our transport nodes are using.