WEBVTT

1
00:00.000 --> 00:03.400
Now with our Windows client logging into the server,

2
00:03.400 --> 00:05.760
and VMware tools installed on that client,

3
00:05.760 --> 00:08.040
it's now time to train NSX on how to

4
00:08.040 --> 00:10.800
interact and work with the Active Directory server.

5
00:10.800 --> 00:12.800
This is a required step even if we have

6
00:12.800 --> 00:15.200
the VMware client software installed here.

7
00:15.200 --> 00:17.760
Because even though the client may be logging into

8
00:17.760 --> 00:19.120
an Active Directory environment,

9
00:19.120 --> 00:20.960
we still need to know via LDAP,

10
00:20.960 --> 00:24.080
which group that user is a member of,

11
00:24.080 --> 00:25.680
and we're going to be using the interaction between

12
00:25.680 --> 00:29.040
NSX and Active Directory in LDAP to determine that.

13
00:29.040 --> 00:32.200
So let's head over to the NSX manager and tell it about
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.040 --> 00:32.200
So let's head over to the NSX manager and tell it about

14
00:32.200 --> 00:36.720
our Windows Active Directory server right here at 10.10.0.100.

15
00:36.720 --> 00:39.280
So to do that here in the NSX manager,

16
00:39.280 --> 00:42.760
we are going to click on the System tab right there.

17
00:42.760 --> 00:46.840
So here with the System tab selected and the Identity Firewall AD selected,

18
00:46.840 --> 00:49.640
we are going to add Active Directory by clicking on

19
00:49.640 --> 00:51.720
Add Active Directory right here.

20
00:51.720 --> 00:52.760
So we'll click on that.

21
00:52.760 --> 00:53.920
And then on the left-hand side,

22
00:53.920 --> 00:56.400
I'm going to collapse that column to give us a little bit more room,

23
00:56.400 --> 00:58.440
and here it's asking for our domain.

24
00:58.440 --> 01:00.040
So let's bring back our server for a moment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:58.440 --> 01:00.040
So let's bring back our server for a moment.

25
01:00.040 --> 01:01.880
So here is our server,

26
01:01.880 --> 01:03.800
and we click here on Local Server.

27
01:03.800 --> 01:06.680
Here it's showing us the server name is server-10.

28
01:06.680 --> 01:10.120
And the domain is NSXdemo.local right there.

29
01:10.120 --> 01:11.640
All right, so let me minimize that.

30
01:11.640 --> 01:15.000
And I'll put in the domain as NSXdemo.local.

31
01:15.000 --> 01:17.480
Let me go ahead and move the column over a little bit so we can see that.

32
01:17.480 --> 01:19.880
And then for the NetBios name and upper case,

33
01:19.880 --> 01:21.960
that's going to be NSXdemo.

34
01:21.960 --> 01:23.720
And then for the base distinguished name,

35
01:23.720 --> 01:28.040
effectively that's telling NSX where to start querying and looking

36
01:28.040 --> 01:29.240
instead of Active Directory.

37
01:29.240 --> 01:34.520
So I'm going to use DC for domain component equals NSXdemo, comma,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.240 --> 01:34.520
So I'm going to use DC for domain component equals NSXdemo, comma,

38
01:34.520 --> 01:36.520
and then DC equals local.

39
01:36.520 --> 01:38.920
And then for the Delta synchronization interval,

40
01:38.920 --> 01:41.080
the default is 180 minutes.

41
01:41.080 --> 01:43.800
And what I'm going to do in the lab environment only,

42
01:43.800 --> 01:45.320
I'm going to set that to five minutes.

43
01:45.320 --> 01:48.440
And I want it to query and synchronize super frequently.

44
01:48.440 --> 01:50.680
However, in a large Active Directory environment,

45
01:50.680 --> 01:53.400
you probably don't want to set it to such a small value.

46
01:53.400 --> 01:56.200
But for responsiveness here in my lab environment,

47
01:56.200 --> 01:57.800
I'm going to set it for five minutes.

48
01:57.800 --> 02:01.000
We also have options of limiting our scope in Active Directory as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:57.800 --> 02:01.000
We also have options of limiting our scope in Active Directory as well.

49
02:01.000 --> 02:02.120
So for my lab environment,

50
02:02.120 --> 02:03.560
because my Active Directory is pretty small,

51
02:03.560 --> 02:04.920
I'm going to leave that to all.

52
02:04.920 --> 02:06.120
And then for the LDAP server,

53
02:06.120 --> 02:08.120
which is used behind the scenes for mapping

54
02:08.120 --> 02:10.680
a individual user to a specific group,

55
02:10.680 --> 02:12.040
we need to specify that as well.

56
02:12.040 --> 02:13.560
Hence the little red asterisk there.

57
02:13.560 --> 02:15.560
So we'll click on set for LDAP server,

58
02:15.560 --> 02:16.600
and it's the same server.

59
02:16.600 --> 02:18.440
So I'm going to click on add LDAP server,

60
02:18.440 --> 02:21.720
and that server down there is at 10.10.0.100.

61
02:21.720 --> 02:24.600
And I don't have LDAP S set up yet.

62
02:24.600 --> 02:28.840
So I will just use the plain old LDAP with port 389.

63
02:28.840 --> 02:30.200
And then for those LDAP queries,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:28.840 --> 02:30.200
And then for those LDAP queries,

64
02:30.200 --> 02:32.680
I'll specify the username that I can log in as,

65
02:32.680 --> 02:34.120
as well as specify the password.

66
02:34.120 --> 02:35.480
And in a production environment,

67
02:35.480 --> 02:38.760
it's super common to have specific service accounts

68
02:38.760 --> 02:42.140
with limited rights that have just enough permissions to do what we need them

69
02:42.140 --> 02:42.440
to do.

70
02:42.440 --> 02:43.480
So in this case,

71
02:43.480 --> 02:45.000
even though I'm using administrator,

72
02:45.000 --> 02:49.520
that is way too many rights and way above what's seen as just four LDAP queries

73
02:49.520 --> 02:49.720
.

74
02:49.720 --> 02:50.920
But because I have it set up,

75
02:50.920 --> 02:52.440
I'm going to go ahead and use that right now.

76
02:52.440 --> 02:54.920
So with those details in place, I'll click on add,

77
02:54.920 --> 02:56.040
and that looks good.

78
02:56.040 --> 02:59.160
And we'll click on apply, and then we'll click on save.

79
02:59.160 --> 02:59.800
All right.

80
02:59.800 --> 03:02.440
So because it's in an error, that looks pretty positive.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:59.800 --> 03:02.440
So because it's in an error, that looks pretty positive.

81
03:02.440 --> 03:05.960
So let me click here on check status, and that looks good.

82
03:05.960 --> 03:08.520
So the test, let's bring in our active directory environment.

83
03:08.520 --> 03:11.560
And let's just create a brand new group.

84
03:11.560 --> 03:13.480
So let me make this a little bit bigger.

85
03:13.480 --> 03:16.280
So here in server manager, we'll click on tools,

86
03:16.280 --> 03:20.600
and let's go down to active directory users and computers right there.

87
03:20.600 --> 03:24.550
And here it is. And I've got a user called 80 NSX user to this currently logged

88
03:24.550 --> 03:24.760
on.

89
03:24.760 --> 03:28.040
And let's take a peek to see what groups that user is currently a member of.

90
03:28.040 --> 03:32.600
So we go to member of that user is a member of domain admins and domain users.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:28.040 --> 03:32.600
So we go to member of that user is a member of domain admins and domain users.

91
03:32.600 --> 03:35.480
And what I propose we do, let's create a brand new group.

92
03:35.480 --> 03:37.720
So I'm going to click here to create a new group.

93
03:37.720 --> 03:40.840
And let's call this yes to SSH.

94
03:40.840 --> 03:43.480
So we'll make this a group in active directory.

95
03:43.480 --> 03:47.000
And then as we refer to this active directory group as part of an NSX group,

96
03:47.000 --> 03:48.760
we can then use that NSX group

97
03:48.760 --> 03:52.120
instead of a security policy rule to permit access to SSH.

98
03:52.120 --> 03:54.920
So here in active directory, I'm going to call it yes to SSH.

99
03:54.920 --> 03:55.960
Click on OK.

100
03:55.960 --> 04:00.040
And then we'll double click on that yes to SSH and click on members.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:55.960 --> 04:00.040
And then we'll double click on that yes to SSH and click on members.

101
04:00.040 --> 04:01.800
And let's click on add.

102
04:01.800 --> 04:04.520
Then for the user, I'll type in AD and click check names.

103
04:04.520 --> 04:09.480
And there's our AD NSX user to click on OK to add that person to the group.

104
04:09.480 --> 04:10.920
And click on OK.

105
04:10.920 --> 04:12.360
And click on OK.

106
04:12.360 --> 04:15.480
So now if we go back to this user, AD NSX user to,

107
04:15.480 --> 04:20.600
it's a member of this group right here, which is yes to SSH.

108
04:20.600 --> 04:22.120
So let's click on OK.

109
04:22.120 --> 04:24.200
And I'll minimize the Windows server.

110
04:24.200 --> 04:27.160
So also because I just made a change in active directory,

111
04:27.160 --> 04:29.080
we could probably wait five minutes and that would work.

112
04:29.080 --> 04:31.880
Or we could also just click on the three dots over here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:29.080 --> 04:31.880
Or we could also just click on the three dots over here

113
04:31.880 --> 04:35.720
and click right here on sync all to get any latest and greatest updates from

114
04:35.720 --> 04:36.680
active directory.

115
04:36.680 --> 04:41.000
So now just to test this, if we went to inventory and we went to groups

116
04:41.000 --> 04:43.560
and we wanted to add a new group, so we'll click on add group.

117
04:43.560 --> 04:45.720
And then for compute members, if we click on set,

118
04:45.720 --> 04:48.040
here we have an option for AD groups right here on the right.

119
04:48.040 --> 04:49.400
So we click that tile.

120
04:49.400 --> 04:52.360
And here showing us the AD groups and the fact that they all show up is a very,

121
04:52.360 --> 04:53.320
very good sign.

122
04:53.320 --> 04:55.880
It means we have the active directory integration set up correctly.

123
04:55.880 --> 04:59.320
So if we scroll down to the Y's here, here's yes to SSH.

124
04:59.320 --> 05:01.560
So I just want to confirm that that group that we just made,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
04:59.320 --> 05:01.560
So I just want to confirm that that group that we just made,

125
05:01.560 --> 05:04.680
which has that one member shows up here as an option.

126
05:04.680 --> 05:06.040
So I'm going to click on cancel.

127
05:06.040 --> 05:07.560
We'll make a group in a later step.

128
05:07.560 --> 05:11.160
I just want to verify that the active directory groups were showing up as

129
05:11.160 --> 05:14.280
options to be included as part of our NSX groups.

130
05:14.280 --> 05:16.040
Also, while we're here, let's do one other thing.

131
05:16.040 --> 05:20.120
And that is even though we don't at the moment have external windows servers

132
05:20.120 --> 05:20.680
that we also

133
05:20.680 --> 05:23.080
want to be able to identify group membership for.

134
05:23.080 --> 05:26.920
If we did have that, we'd also want the ability to do the scraping of the

135
05:26.920 --> 05:27.560
security logs

136
05:27.560 --> 05:30.440
to identify those users who have logged on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:27.560 --> 05:30.440
to identify those users who have logged on.

137
05:30.440 --> 05:35.240
So just as a preemptive step, because we may at a later time be adding a

138
05:35.240 --> 05:35.560
physical

139
05:35.560 --> 05:38.680
computer running a Windows client logging onto a domain,

140
05:38.680 --> 05:41.000
let's also add the analysis of the security logs.

141
05:41.000 --> 05:45.040
Because as I mentioned before, if we have a physical Windows client that's not

142
05:45.040 --> 05:45.720
running VMware

143
05:45.720 --> 05:50.040
tools, it won't be able to on its own do the introspection to be able to report

144
05:50.040 --> 05:50.840
to the NSX

145
05:50.840 --> 05:54.520
manager. So to add the log scraping, we'll click right here on security.

146
05:54.520 --> 05:58.120
And then on the left, we're going to scroll down and click on general settings.

147
05:58.120 --> 06:01.640
So the path is security and then under settings, general settings.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
05:58.120 --> 06:01.640
So the path is security and then under settings, general settings.

148
06:01.640 --> 06:04.360
And then over here in the main pane, we're going to click on the sub tab

149
06:04.360 --> 06:06.520
identity firewall event log

150
06:06.520 --> 06:11.200
sources. And then here under event log sources, we're going to enable the ad

151
06:11.200 --> 06:12.120
log scraper,

152
06:12.120 --> 06:14.120
which is taking a look at the security logs.

153
06:14.120 --> 06:19.080
So that way, if we do want to integrate and use security rules that leverage AD

154
06:19.080 --> 06:20.760
, including AD

155
06:20.760 --> 06:25.000
membership for physical computers that are not running VMware tools, and then

156
06:25.000 --> 06:25.640
use those security

157
06:25.640 --> 06:29.630
policy rules on the distributed firewall or a gateway firewall, we can now use

158
06:29.630 --> 06:30.120
them.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
06:29.630 --> 06:30.120
them.

159
06:30.120 --> 06:34.980
So now that is on. So even though we could now use the log scraping with the

160
06:34.980 --> 06:35.720
distributed firewall

161
06:35.720 --> 06:40.360
and the gateway firewall, we have yet another step to enable identity firewall

162
06:40.360 --> 06:41.160
services

163
06:41.160 --> 06:44.840
on both of those firewalls. And so in the next video, I'd like to walk you

164
06:44.840 --> 06:45.800
through enabling

165
06:45.800 --> 06:49.690
the identity firewall for both our distributed firewall and our gateway

166
06:49.690 --> 06:50.360
firewall.

167
06:50.360 --> 06:54.300
And again, we'll do that in the very next video. So I'll see you there in just

168
06:54.300 --> 06:55.160
a moment.