WEBVTT

1
00:00.000 --> 00:03.900
So to really appreciate the identity firewall and what that brings to the table

2
00:03.900 --> 00:04.000
,

3
00:04.000 --> 00:08.000
let's imagine that we have a whole bunch of users that are using these VMs.

4
00:08.000 --> 00:12.360
Perhaps they're running remote desktop connections to the VMs or they're using

5
00:12.360 --> 00:13.800
VDI solutions.

6
00:13.800 --> 00:17.280
And on the back end, let's also imagine all these VMs that they're using are

7
00:17.280 --> 00:19.000
part of Microsoft Active Directory.

8
00:19.000 --> 00:22.220
So if that's our scenario, let's imagine that we want to control traffic going

9
00:22.220 --> 00:23.000
through the network.

10
00:23.000 --> 00:26.710
We want to allow some traffic, so we'll use the green line here to represent

11
00:26.710 --> 00:28.000
traffic we want to allow.

12
00:28.000 --> 00:32.000
And we'll use the red to represent traffic that we want to deny.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.000 --> 00:32.000
And we'll use the red to represent traffic that we want to deny.

13
00:32.000 --> 00:36.000
Or in the world of NSX, as far as a security policy goes and the rules there,

14
00:36.000 --> 00:38.000
the options are drop or reject.

15
00:38.000 --> 00:41.330
So if we have firewall policies that we want to sit up to permit or deny

16
00:41.330 --> 00:45.000
certain types of traffic based on who's logged on to these VMs,

17
00:45.000 --> 00:48.280
how exactly are we going to pull that off? Well, the answer to that is if we

18
00:48.280 --> 00:50.000
are running Active Directory on the back end,

19
00:50.000 --> 00:54.060
we can actually base these rules in our firewall policies based on Active

20
00:54.060 --> 00:56.000
Directory group membership.

21
00:56.000 --> 01:00.000
So let's imagine over here in Active Directory that we have a domain.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
01:00.000 --> 01:04.000
And let's imagine that domain is NSX demo dot local.

23
01:04.000 --> 01:08.000
And within that domain, we have a container called users.

24
01:08.000 --> 01:11.650
And then furthermore, let's imagine inside that container, we have groups and

25
01:11.650 --> 01:13.000
also users.

26
01:13.000 --> 01:15.330
Let's also mention that one of our groups, I'll go ahead and use a little icon

27
01:15.330 --> 01:16.000
for a group here.

28
01:16.000 --> 01:20.880
Let's mention one of our groups is called yes, meaning in that group, we want

29
01:20.880 --> 01:24.000
to go ahead and permit certain types of traffic through the network.

30
01:24.000 --> 01:27.060
And then for everybody else who's not a member of that group, we want to go

31
01:27.060 --> 01:28.000
ahead and deny it.

32
01:28.000 --> 01:31.050
So in our firewall policy, this could apply to distributed firewall or a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:28.000 --> 01:31.050
So in our firewall policy, this could apply to distributed firewall or a

33
01:31.050 --> 01:32.000
gateway firewall.

34
01:32.000 --> 01:36.500
We could set up some rules. We could say, for example, if the source is a

35
01:36.500 --> 01:38.000
member of the yes group,

36
01:38.000 --> 01:41.000
then go ahead and allow the traffic, the traffic we want to permit.

37
01:41.000 --> 01:44.630
And that could include the ports and protocols and the applications that we're

38
01:44.630 --> 01:45.000
using.

39
01:45.000 --> 01:47.940
And it could also include specific IP addresses regarding where we want the

40
01:47.940 --> 01:49.000
traffic to be allowed.

41
01:49.000 --> 01:52.060
Then we get a follow up rule that says, if that's not the case, if it's not

42
01:52.060 --> 01:54.000
matching this certain group as a source,

43
01:54.000 --> 01:57.000
then we want to go ahead and deny that flow of traffic.

44
01:57.000 --> 02:01.200
So for a user that's using VDI or remote desk topping into this VM here and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:57.000 --> 02:01.200
So for a user that's using VDI or remote desk topping into this VM here and

45
02:01.200 --> 02:03.000
logging into active directory as that user,

46
02:03.000 --> 02:06.710
if they're in that group, they're going to get the permitted access because it

47
02:06.710 --> 02:09.000
's permitting that in the firewall rule.

48
02:09.000 --> 02:12.270
And if they're not in that group, they're not going to match on this rule, and

49
02:12.270 --> 02:15.700
then the traffic is going to be denied based on the second rule right here in

50
02:15.700 --> 02:16.000
red.

51
02:16.000 --> 02:20.000
So the cool benefit is that by managing and working with our AD groups,

52
02:20.000 --> 02:24.420
effectively we're controlling the traffic based on the existing rules, we're

53
02:24.420 --> 02:27.000
controlling traffic through the network with NSX,

54
02:27.000 --> 02:30.000
again, based on group membership here in active directory.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:30.000 --> 02:33.000
So let me clean that up a little bit and let's chat about the nitty gritty

56
02:33.000 --> 02:36.000
regarding how in the world does our NSX environment.

57
02:36.000 --> 02:40.000
How does it know which group a user is a member of?

58
02:40.000 --> 02:44.500
And the feature set that allows the interaction between NSX and the active

59
02:44.500 --> 02:48.000
directory environment is referred to as the identity firewall.

60
02:48.000 --> 02:50.000
So there's a few things involved in that.

61
02:50.000 --> 02:54.390
Number one, we're going to tell NSX exactly where our active directory is, and

62
02:54.390 --> 02:58.000
as part of that, we'll specify the LDAP services in active directory

63
02:58.000 --> 03:02.550
so that NSX knows exactly who to reach out to to determine which users are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:58.000 --> 03:02.550
so that NSX knows exactly who to reach out to to determine which users are

64
03:02.550 --> 03:04.000
parts of which groups.

65
03:04.000 --> 03:07.820
And if this VM right here is part of active directory and the user is using

66
03:07.820 --> 03:11.000
that VM as part of VDI or the remote desktop to that VM.

67
03:11.000 --> 03:15.610
And if that VM has the full complement of VMware tools installed on it, this

68
03:15.610 --> 03:19.000
little VM when that user logs on to active directory,

69
03:19.000 --> 03:22.160
that specific information about this user on this VM that's now logged into

70
03:22.160 --> 03:26.000
active directory that gets communicated over to the NSX manager

71
03:26.000 --> 03:29.000
and that's done via the VMware tools on this VM.

72
03:29.000 --> 03:33.080
So I'm going to make a little note here that VMware tools is critical for this,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:29.000 --> 03:33.080
So I'm going to make a little note here that VMware tools is critical for this,

73
03:33.080 --> 03:36.000
for the reporting or the informing of an NSX manager regarding

74
03:36.000 --> 03:40.000
the user who just logged into active directory via this VM.

75
03:40.000 --> 03:42.990
Now what if we have another segment where we have a physical Windows client

76
03:42.990 --> 03:45.000
that is also logging into active directory?

77
03:45.000 --> 03:47.000
So this is the client and this image.

78
03:47.000 --> 03:49.000
We also have a Windows server here.

79
03:49.000 --> 03:52.700
If we want to implement our security controls as part of our firewall based on

80
03:52.700 --> 03:54.000
this physical client,

81
03:54.000 --> 03:58.190
the problem is this physical client is not running VMware tools and it has no

82
03:58.190 --> 04:02.000
way to report to the NSX manager because it's not running VMware tools
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
03:58.190 --> 04:02.000
way to report to the NSX manager because it's not running VMware tools

83
04:02.000 --> 04:04.000
because it's a physical computer.

84
04:04.000 --> 04:07.010
So the solution there, if we have a physical client, what we're going to do is

85
04:07.010 --> 04:10.000
we're going to train NSX to go out to the active directory environment

86
04:10.000 --> 04:14.000
that that client is logging into and we're going to scrape the security logs.

87
04:14.000 --> 04:17.000
Effectively, that's a fancy way of saying we're going to read the security logs

88
04:17.000 --> 04:21.000
that include information about who just logged into that computer

89
04:21.000 --> 04:23.000
and what is their IP address.

90
04:23.000 --> 04:27.610
So by NSX going to that server and looking at these security logs, that's yet

91
04:27.610 --> 04:29.000
another way to inform NSX.

92
04:29.000 --> 04:33.860
So again, whether we have a VM natively with the VMware tools, that's logging
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
04:29.000 --> 04:33.860
So again, whether we have a VM natively with the VMware tools, that's logging

93
04:33.860 --> 04:37.000
into active directory, or we have an external physical client,

94
04:37.000 --> 04:40.530
that's logging into active directory and we're scraping the security logs

95
04:40.530 --> 04:42.000
looking for that information.

96
04:42.000 --> 04:46.380
Both of those options can be used to train NSX for clients that are logging

97
04:46.380 --> 04:48.000
into active directory.

98
04:48.000 --> 04:51.980
So with that information in place, what we would then do in NSX is we would

99
04:51.980 --> 04:53.000
create NSX groups.

100
04:53.000 --> 04:57.270
And as far as membership in those NSX groups, we could have those dynamically

101
04:57.270 --> 05:00.000
populated based on active directory groups.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
05:00.000 --> 05:04.370
So if we have nine or 10 users in this specific active directory group that's

103
05:04.370 --> 05:06.000
included as part of an NSX group,

104
05:06.000 --> 05:09.000
we could then use that NSX group as part of our security policy rules.

105
05:09.000 --> 05:13.050
Then these nine users, if they've logged on, will be included effectively in

106
05:13.050 --> 05:14.000
that NSX group.

107
05:14.000 --> 05:17.260
And then if we use that as a group as part of our security policy rule, they

108
05:17.260 --> 05:21.000
can then be permitted or denied based on that security policy rule.

109
05:21.000 --> 05:24.700
So one of the best ways to really appreciate the integration between active

110
05:24.700 --> 05:29.060
directory and the groups and NSX using the identity firewall is to actually see

111
05:29.060 --> 05:30.000
it in action.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
05:30.000 --> 05:34.410
So join me in the next video as we put a specific game plan together regarding

113
05:34.410 --> 05:36.000
what we want to accomplish.

114
05:36.000 --> 05:39.490
And then with that game plan in place, we'll walk through step by step the

115
05:39.490 --> 05:43.140
implementation and verification of identity firewall leveraging active

116
05:43.140 --> 05:44.000
directory.

117
05:44.000 --> 05:46.000
I'll see you in the next video.

118
05:46.000 --> 05:54.960
[BLANK_AUDIO]