WEBVTT 1 00:00.000 --> 00:03.660 Now that we have our Active Directory integration with the LDAP and also Logsc 2 00:03.660 --> 00:04.640 raping enabled, 3 00:04.640 --> 00:08.220 our next step is to train the distributed firewall and gateway firewall 4 00:08.220 --> 00:08.800 functions 5 00:08.800 --> 00:13.490 that we want to enable the ability to leverage identity-based firewall services 6 00:13.490 --> 00:13.680 . 7 00:13.680 --> 00:16.480 So think of it like this step, putting all the infrastructure in place, 8 00:16.480 --> 00:19.790 and then this step is actually telling the distributed firewalls and the 9 00:19.790 --> 00:20.480 gateway firewalls 10 00:20.480 --> 00:24.470 they can now start using identity services as part of their security policy 11 00:24.470 --> 00:25.040 rules. 12 00:25.040 --> 00:28.480 So to train those two firewalls, distributed firewall and the gateway firewall, 13 00:28.480 --> 00:32.080 that we want them to be able to use identity services as part of their security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:28.480 --> 00:32.080 that we want them to be able to use identity services as part of their security 14 00:32.080 --> 00:32.800 policy rules, 15 00:32.800 --> 00:36.320 we're going to click on security right here in the NSX manager. 16 00:36.320 --> 00:39.600 And then on the left, we're going to go to the distributed firewall and gateway 17 00:39.600 --> 00:40.000 firewall 18 00:40.000 --> 00:44.240 respectively to tell them, yes, we want to be able to use identity services. 19 00:44.240 --> 00:46.880 So we'll start off with the distributed firewall right there by clicking on 20 00:46.880 --> 00:48.000 distributed firewall. 21 00:48.000 --> 00:50.160 And then in the distributed firewall pane over here, 22 00:50.160 --> 00:53.280 we're going to click on the sub tab of settings right there. 23 00:53.280 --> 00:56.640 So we'll click on settings and you'll notice that here we have the distributed 24 00:56.640 --> 00:57.280 firewall service 25 00:57.280 --> 01:01.680 settings on by default. However, for the identity firewall services, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 25 00:57.280 --> 01:01.680 settings on by default. However, for the identity firewall services, 26 01:01.680 --> 01:04.400 we need to enable that specifically. So we're going to click right here in the 27 01:04.400 --> 01:05.360 sub tab called 28 01:05.360 --> 01:09.600 identity firewall settings. So here's warning us that if we want to provide 29 01:09.600 --> 01:10.400 identity firewall 30 01:10.400 --> 01:14.510 services for physical machines, make sure you turn on logs scraping, which we 31 01:14.510 --> 01:15.120 already did. 32 01:15.120 --> 01:18.760 So I'm going to dismiss that message. And then right here, for the distributed 33 01:18.760 --> 01:19.200 firewall, 34 01:19.200 --> 01:22.680 if we want to be able to use identity firewall services, we simply flip that 35 01:22.680 --> 01:23.520 switch and say, 36 01:23.520 --> 01:28.660 yes, there, and then furthermore, we'd scroll down and identify exactly which 37 01:28.660 --> 01:29.440 clusters. 38 01:29.440 --> 01:33.620 So because right now we have over on segment 10, we have our windows client WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 38 01:29.440 --> 01:33.620 So because right now we have over on segment 10, we have our windows client 39 01:33.620 --> 01:34.400 sitting there, 40 01:34.400 --> 01:37.840 and it's in the cluster called host transport nodes. In fact, let's verify that 41 01:37.840 --> 01:38.400 real quick. 42 01:38.400 --> 01:42.400 So back in the VCR client, here we have when 11 client, and we just click on 43 01:42.400 --> 01:43.520 the VMs for testing 44 01:43.520 --> 01:47.040 and click on the VMs tab right here. And that will show us where it's running. 45 01:47.040 --> 01:48.640 So when 11 client 46 01:48.640 --> 01:53.850 is currently running on ESXIA, and if we go over to our host and clusters view, 47 01:53.850 --> 01:54.400 and we go to our 48 01:54.400 --> 01:59.680 host transport nodes, sure enough ESXIA is in the host transport nodes cluster. 49 01:59.680 --> 02:00.320 So in NSX, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 01:59.680 --> 02:00.320 So in NSX, 50 02:00.320 --> 02:03.370 we'll simply say, you know what for that cluster, we want to go ahead and 51 02:03.370 --> 02:04.560 enable identity firewall 52 02:04.560 --> 02:09.040 services. So back in the NSX manager for that cluster called host transport 53 02:09.040 --> 02:09.920 nodes, we're going 54 02:09.920 --> 02:14.240 to go ahead and enable it and says, are you sure I'm gonna say yes, and boom, 55 02:14.240 --> 02:15.040 identity firewall 56 02:15.040 --> 02:20.520 services are now enabled on VMs that are running on hosts in that cluster. And 57 02:20.520 --> 02:21.200 then in my management 58 02:21.200 --> 02:27.350 cluster, those two ESXIA hosts are not enabled for NSX. And I don't have any V 59 02:27.350 --> 02:28.400 Ms on the management 60 02:28.400 --> 02:33.050 cluster ESXIA hosts that need to report in regarding logging on to AD. So I'm WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 60 02:28.400 --> 02:33.050 cluster ESXIA hosts that need to report in regarding logging on to AD. So I'm 61 02:33.050 --> 02:33.760 just going to go ahead 62 02:33.760 --> 02:37.560 and enable it for this one cluster host transport nodes, which is where our 63 02:37.560 --> 02:39.040 windows client is running. 64 02:39.040 --> 02:42.120 So that's how we would enable that feature for the distributed firewall. And 65 02:42.120 --> 02:42.720 while we're here, 66 02:42.720 --> 02:46.490 let's also enable it for the gateway firewall as well. So we'll click on 67 02:46.490 --> 02:47.520 gateway firewall on the 68 02:47.520 --> 02:50.720 left. And then once again, here in the pane for gateway firewall, we'll click 69 02:50.720 --> 02:51.280 on settings. 70 02:51.280 --> 02:55.650 And very similar, we're simply going to enable the identity firewall services 71 02:55.650 --> 02:56.480 on the gateways 72 02:56.480 --> 03:00.710 where we intend to use policies and rules that are going to be matching on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 72 02:56.480 --> 03:00.710 where we intend to use policies and rules that are going to be matching on the 73 03:00.710 --> 03:01.680 source information 74 03:01.680 --> 03:05.760 based on an NSX group, which behind the scenes is tied to our linking to an 75 03:05.760 --> 03:07.360 active directory group. 76 03:07.360 --> 03:11.960 So I'm going to go ahead and enable this for all three. So I just did it for 77 03:11.960 --> 03:13.360 the tier zero gateway, 78 03:13.360 --> 03:16.650 or we can just click on all of them and click right here and turn on and 79 03:16.650 --> 03:18.000 identity firewall 80 03:18.000 --> 03:21.660 and turn on. And that would enable all three as well. It's also warning us that 81 03:21.660 --> 03:22.080 we need to have 82 03:22.080 --> 03:26.340 at least one event log source turned on for identity firewall to work. So if we 83 03:26.340 --> 03:27.600 go back to the system 84 03:27.600 --> 03:32.490 tab here, and then on the left, if we go to identity firewall AD right there, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 84 03:27.600 --> 03:32.490 tab here, and then on the left, if we go to identity firewall AD right there, 85 03:32.490 --> 03:32.880 and here if we 86 03:32.880 --> 03:36.950 click on edit, here we can specify our event log server as well. Should we need 87 03:36.950 --> 03:37.760 it? However, 88 03:37.760 --> 03:41.610 in the lab, I'm just going to be using my one Windows client VM, which has the 89 03:41.610 --> 03:42.720 VMware tools fully 90 03:42.720 --> 03:45.340 installed. And we're going to be using that as a demo as part of the 91 03:45.340 --> 03:46.800 distributed firewall. So we 92 03:46.800 --> 03:49.640 don't really need to set that however, in the event we needed to, we could 93 03:49.640 --> 03:51.040 click set right here, 94 03:51.040 --> 03:54.600 and then click on add event log server and put in the details for our event log 95 03:54.600 --> 03:55.280 server. So I 96 03:55.280 --> 03:58.210 can't sell out of that with no changes there. So it's a quick summary of what 97 03:58.210 --> 03:59.440 we've done. We trained 98 03:59.440 --> 04:04.720 NSX about the active directory server, including the LDAP services to do the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 98 03:59.440 --> 04:04.720 NSX about the active directory server, including the LDAP services to do the 99 04:04.720 --> 04:05.840 group mapping association 100 04:05.840 --> 04:09.900 between a user and what groups to remember of. We also went to the security tab 101 04:09.900 --> 04:10.480 and we went to 102 04:10.480 --> 04:14.430 our distributed firewall and gateway firewall and under settings, we said 103 04:14.430 --> 04:15.360 please enable the 104 04:15.360 --> 04:19.260 identity firewall services. So we do that right here by enabling it and then 105 04:19.260 --> 04:20.320 specifically saying 106 04:20.320 --> 04:23.740 what clusters we want to enable that function on. And then our last step would 107 04:23.740 --> 04:25.040 be to make a group 108 04:25.040 --> 04:29.630 that is linking to or referring to the membership of an active directory group. 109 04:29.630 --> 04:30.400 So let's do that as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 109 04:29.630 --> 04:30.400 So let's do that as 110 04:30.400 --> 04:35.150 well right here by clicking on inventory on the left, we'll click on groups and 111 04:35.150 --> 04:36.000 let's create a new 112 04:36.000 --> 04:39.270 group. So I'll click right here on ad group and I'm going to put a period in 113 04:39.270 --> 04:40.080 front that way it 114 04:40.080 --> 04:44.970 sorts to the very top and be super easy to find. And let's call this NSX group 115 04:44.970 --> 04:47.120 tied to AD group. 116 04:47.120 --> 04:50.330 So when we refer to this group on the back end, it's going to be looking at the 117 04:50.330 --> 04:50.880 group membership 118 04:50.880 --> 04:53.820 in active directory. So I'm going to name it like that. So when we see it, we 119 04:53.820 --> 04:54.640 'll know what it does. 120 04:54.640 --> 04:57.400 And then as far as who's going to be a member of this group under compute 121 04:57.400 --> 04:58.640 members, we'll click on 122 04:58.640 --> 05:02.470 set. So then for the criteria regarding who is a member of this group, instead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 122 04:58.640 --> 05:02.470 set. So then for the criteria regarding who is a member of this group, instead 123 05:02.470 --> 05:03.520 of using the option 124 05:03.520 --> 05:08.060 here for member criteria, we have this sub tab over here called AD groups. So 125 05:08.060 --> 05:08.720 currently, there's 126 05:08.720 --> 05:11.610 nothing being identified as far as being a member of this group. So we're going 127 05:11.610 --> 05:12.720 to change that by 128 05:12.720 --> 05:16.360 clicking here on AD groups. And then we're going to scroll all the way down or 129 05:16.360 --> 05:17.360 we can just filter 130 05:17.360 --> 05:21.570 the group I made an ad was called yes, I believe, so I'll type in yes. And 131 05:21.570 --> 05:23.120 there's yes to SSH. So 132 05:23.120 --> 05:27.450 we're going to select that ad group and that group called yes to SSH is in the 133 05:27.450 --> 05:28.480 users container, 134 05:28.480 --> 05:32.160 which is the domain component NSX demo, which is in the top level domain WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 134 05:28.480 --> 05:32.160 which is the domain component NSX demo, which is in the top level domain 135 05:32.160 --> 05:33.840 component called local. 136 05:33.840 --> 05:36.900 So we're going to include any users that are a member of that group and 137 05:36.900 --> 05:37.520 effectively, 138 05:37.520 --> 05:41.240 they're going to be a member of this group called NSX group tied to AD group 139 05:41.240 --> 05:42.480 and we'll click on apply 140 05:42.480 --> 05:46.820 and then click on save and check this out. So here's our group. So here is our 141 05:46.820 --> 05:48.000 windows computer. 142 05:48.000 --> 05:52.320 Let me go ahead and log back in. So we are definitely logged on to the domain. 143 05:52.320 --> 05:54.160 So here in this group, 144 05:54.160 --> 05:58.530 if we click right here on view members, it should show us that machine. So 145 05:58.530 --> 05:59.040 right here, 146 05:59.040 --> 06:02.600 this is effective members, it's all zeros, let me click on refresh. And you WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 146 05:59.040 --> 06:02.600 this is effective members, it's all zeros, let me click on refresh. And you 147 06:02.600 --> 06:02.960 know what, 148 06:02.960 --> 06:07.040 let me just log out and log back in because we just added that group a moment 149 06:07.040 --> 06:07.840 ago. In fact, 150 06:07.840 --> 06:11.400 let's do a couple things. I'm going to click on close here and let's go back to 151 06:11.400 --> 06:12.320 system and we'll 152 06:12.320 --> 06:16.730 go down to identity firewall ad. I'm going to click right here and say, please 153 06:16.730 --> 06:17.760 sync everything. 154 06:17.760 --> 06:21.980 And then with that done, I'm also going to hedge my bets and let's log out of 155 06:21.980 --> 06:22.800 this little windows 156 06:22.800 --> 06:26.880 client. So we'll go ahead and log out and then we'll go ahead and log back in. 157 06:26.880 --> 06:27.440 I'll put in the 158 06:27.440 --> 06:31.760 password there and we are now logged in. So now that everything has been WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 158 06:27.440 --> 06:31.760 password there and we are now logged in. So now that everything has been 159 06:31.760 --> 06:33.280 refreshed, this user is 160 06:33.280 --> 06:36.950 also logged in. We should now be able to go back to our inventory by clicking 161 06:36.950 --> 06:38.080 on the inventory tab, 162 06:38.080 --> 06:41.860 go to groups. So here's our NSX group tied to ad group. And now if we click 163 06:41.860 --> 06:43.200 here on view members, 164 06:43.200 --> 06:48.320 we should see that VM and I don't see it. So that's going to be a pretty boring 165 06:48.320 --> 06:49.200 demo if we don't 166 06:49.200 --> 06:52.540 get that user machine in this group. So let me go ahead and close that and let 167 06:52.540 --> 06:53.360 's just check our 168 06:53.360 --> 06:59.060 work. So system on the left hand side, identity firewall ad and that all looks 169 06:59.060 --> 07:00.240 good. If we click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 169 06:59.060 --> 07:00.240 good. If we click 170 07:00.240 --> 07:06.390 check status, this has success. So that looks good. And then under security and 171 07:06.390 --> 07:07.840 distributed firewall 172 07:07.840 --> 07:11.360 and settings for distributed firewall, we currently have identity firewall 173 07:11.360 --> 07:13.040 services enabled. And it's 174 07:13.040 --> 07:17.430 also enabled on our host transport nodes cluster. So that part looks good. And 175 07:17.430 --> 07:18.320 then for our gateway 176 07:18.320 --> 07:23.120 firewall and under settings for the gateway firewall, it's also enabled as well 177 07:23.120 --> 07:23.680 . So I'm going to go 178 07:23.680 --> 07:29.180 ahead and take my little VM here and I'm going to completely restart that VM. 179 07:29.180 --> 07:29.920 So I'm going to restart 180 07:29.920 --> 07:33.590 this VM and then log back in and let's go back and take a look now that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 180 07:29.920 --> 07:33.590 this VM and then log back in and let's go back and take a look now that we 181 07:33.590 --> 07:34.720 refreshed and checked 182 07:34.720 --> 07:39.340 all of our work. All right, so we'll log back in is 80 NSX user to so that 183 07:39.340 --> 07:40.560 looks good. Let's also 184 07:40.560 --> 07:44.680 verify connectivity out to the internet. So ping Google dot com. So name 185 07:44.680 --> 07:46.400 resolutions working. And 186 07:46.400 --> 07:49.920 if you do NS lookup, so I verify we're using the correct DNS server, we are 187 07:49.920 --> 07:50.960 fantastic. So I'll 188 07:50.960 --> 07:54.750 type an exit and let's go back and take a look at our work. So we'll minimize 189 07:54.750 --> 07:55.680 that. And let's go 190 07:55.680 --> 07:59.940 back to inventory. We'll go ahead and click on groups. We'll take a look at our 191 07:59.940 --> 08:00.800 NSX group tied to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 191 07:59.940 --> 08:00.800 NSX group tied to 192 08:00.800 --> 08:04.350 AV group, click here on view members. And sure enough, there we go. There's our 193 08:04.350 --> 08:05.840 win 11 clients. So 194 08:05.840 --> 08:11.520 our group definition is based on the AD group called yes to SSH. And that user 195 08:11.520 --> 08:12.080 is a member of 196 08:12.080 --> 08:15.270 that group. That's why that VM is showing up right here. So that's great news. 197 08:15.270 --> 08:16.320 We'll click on close 198 08:16.320 --> 08:20.720 there. And now we can leverage that group as part of our security rules. And we 199 08:20.720 --> 08:21.680 'll take that next 200 08:21.680 --> 08:26.880 logical step in the very next video. So I'll see you there in just a moment.