WEBVTT 1 00:00.000 --> 00:05.040 Let's put a game plan together regarding leveraging Active Directory with our 2 00:05.040 --> 00:07.000 group membership in NSX. 3 00:07.000 --> 00:10.550 So for our first step, let's verify what we have in place, including Active 4 00:10.550 --> 00:13.000 Directory and also our VMs. 5 00:13.000 --> 00:15.570 And so what I expect to have in place is a little Windows server I put right 6 00:15.570 --> 00:16.000 here. 7 00:16.000 --> 00:19.000 This is a server and it's at .100. 8 00:19.000 --> 00:22.410 That's providing Active Directory services and then this is a little client 9 00:22.410 --> 00:23.000 right here. 10 00:23.000 --> 00:27.000 And it is a DHCP client getting an IP address via DHCP. 11 00:27.000 --> 00:31.770 So as part of our verification, I also want to verify that DHCP that we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:27.000 --> 00:31.770 So as part of our verification, I also want to verify that DHCP that we're 12 00:31.770 --> 00:33.000 getting on this segment, 13 00:33.000 --> 00:37.460 courtesy of gateway-based DHCP services in NSX, I want to make sure that we're 14 00:37.460 --> 00:40.000 handing out the correct DNS server. 15 00:40.000 --> 00:43.000 Because this little client is going to be logging on to the domain. 16 00:43.000 --> 00:48.000 So for DHCP, I want to make sure that DNS points to .100. 17 00:48.000 --> 00:51.840 We also want to make sure that this Windows client VM right here is running the 18 00:51.840 --> 00:54.000 full complement of VMware tools. 19 00:54.000 --> 00:57.490 Then once we've verified those are in place, next we need to do the integration 20 00:57.490 --> 01:01.000 between NSX and train it where this server is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 20 00:57.490 --> 01:01.000 between NSX and train it where this server is 21 01:01.000 --> 01:03.000 that's supporting our Active Directory environment. 22 01:03.000 --> 01:07.000 So we're going to add Active Directory and LDAP information to NSX. 23 01:07.000 --> 01:11.020 So for the VM running VMware tools, it'll be able to report to the NSX manager 24 01:11.020 --> 01:13.000 about its IP address and so forth. 25 01:13.000 --> 01:17.000 If it's running in a cluster where the identity firewall has been enabled. 26 01:17.000 --> 01:21.190 However, for external physical clients, we'd also want to go ahead and set up 27 01:21.190 --> 01:22.000 logs scraping 28 01:22.000 --> 01:24.000 so that those devices can be supported as well. 29 01:24.000 --> 01:26.000 So here I'll jot down plus logs scraping. 30 01:26.000 --> 01:30.480 Again, that'd be for non VM clients that we also want to include in group WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 30 01:26.000 --> 01:30.480 Again, that'd be for non VM clients that we also want to include in group 31 01:30.480 --> 01:33.000 membership and have NSX be aware of it. 32 01:33.000 --> 01:36.830 Another step is that we need to train our distributed firewall as well as our 33 01:36.830 --> 01:41.000 gateway firewall that we want to be able to use identity firewall services. 34 01:41.000 --> 01:45.780 So that way we can leverage groups that refer to AD groups as part of our 35 01:45.780 --> 01:48.000 distributed firewall and gateway firewall rules. 36 01:48.000 --> 01:53.090 So for distributed firewall and gateway firewall, we'll simply say enable IDFW 37 01:53.090 --> 01:55.000 or the identity firewall functionality there. 38 01:55.000 --> 01:59.780 Then the next step would be to go ahead and create some NSX groups that include 39 01:59.780 --> 02:01.000 some AD groups. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 39 01:59.780 --> 02:01.000 some AD groups. 40 02:01.000 --> 02:03.000 So I'll put a little I and C there for include. 41 02:03.000 --> 02:07.840 And then finally, we want to go ahead and use those NSX groups as part of our 42 02:07.840 --> 02:10.000 firewall security policy rules. 43 02:10.000 --> 02:13.470 And for a consistent test regarding what we want to permit and deny, here's 44 02:13.470 --> 02:15.000 what I propose we do. 45 02:15.000 --> 02:19.950 Let's go ahead and permit or deny access right here to this little IP address 46 02:19.950 --> 02:26.480 of 23.1.2.1, which is our little router here, our external router that supports 47 02:26.480 --> 02:27.000 SSH. 48 02:27.000 --> 02:30.000 So for rules, let's say permit SSH in group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 02:30.000 --> 02:31.000 And here's what I mean by that. 50 02:31.000 --> 02:35.380 If our user is logged on here and they're a member of a specific group and we 51 02:35.380 --> 02:38.420 use that group as the source in our rule, we want to go ahead and permit SSH 52 02:38.420 --> 02:39.000 traffic. 53 02:39.000 --> 02:43.000 Again, if their source is coming from one of the groups that we specified. 54 02:43.000 --> 02:47.230 And for everything else is not explicitly permitted using SSH to that IP 55 02:47.230 --> 02:48.000 address. 56 02:48.000 --> 02:52.200 Let's go ahead and deny all the other SSC traffic trying to do that same IP 57 02:52.200 --> 02:53.000 address. 58 02:53.000 --> 02:55.000 So we'll go ahead and say deny for all. 59 02:55.000 --> 02:57.000 And then we'll put the rules in this order. 60 02:57.000 --> 03:00.320 So if you're a member of the group in active directory, which makes you a group WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 60 02:57.000 --> 03:00.320 So if you're a member of the group in active directory, which makes you a group 61 03:00.320 --> 03:04.220 in the security policy rule and NSX, then you'll get SSH access to this IP 62 03:04.220 --> 03:05.000 address. 63 03:05.000 --> 03:08.000 And if you're not in that group, you'll have it denied. 64 03:08.000 --> 03:11.800 So now that we have our game plan in place, our very next step is to verify our 65 03:11.800 --> 03:15.440 topology and make sure that we have VMware tools installed on our Windows 66 03:15.440 --> 03:16.000 client. 67 03:16.000 --> 03:20.210 So we'll see you in the next video as we begin our verification of our existing 68 03:20.210 --> 03:21.000 topology.