WEBVTT

1
00:00.000 --> 00:04.610
To reinforce the concepts of using and working with the identity services as

2
00:04.610 --> 00:06.160
part of our distributed firewall rules,

3
00:06.160 --> 00:09.120
here is a scenario I'd like you to walk through with me.

4
00:09.120 --> 00:10.440
And here's the scenario.

5
00:10.440 --> 00:14.540
People who are in the Domain Admins Active Directory group, for example, let's

6
00:14.540 --> 00:16.400
say that a user is logged in right here,

7
00:16.400 --> 00:20.440
and that user is a member of that group, they should be able to get access with

8
00:20.440 --> 00:22.960
the SSH to this IP address right here.

9
00:22.960 --> 00:27.330
Unfortunately, there's a user named Carmine, and when Carmine is logged into

10
00:27.330 --> 00:30.160
this VM, this VM is called VM-11-client.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:27.330 --> 00:30.160
this VM, this VM is called VM-11-client.

11
00:30.160 --> 00:34.900
When Carmine is logged in and attempts to access SSH to that IP address of 23.1

12
00:34.900 --> 00:37.280
.2.1, it is not working.

13
00:37.280 --> 00:41.120
In fact, let's take just a moment. Let's go to this VM, we'll log in this Carm

14
00:41.120 --> 00:45.960
ine, and we'll verify that we cannot access this IP address with SSH.

15
00:45.960 --> 00:49.730
So here we are at that VM, we'll go ahead and log in this Carmine, let's also

16
00:49.730 --> 00:51.360
make sure we're logged into the right domain.

17
00:51.360 --> 00:55.910
So we're logging on to NSX demo, we're going to log in as Carmine, and we'll

18
00:55.910 --> 00:59.080
put in the password, and click on the arrow to log in.

19
00:59.080 --> 01:02.480
And that looks like it's working, so we're logging in as Carmine.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:59.080 --> 01:02.480
And that looks like it's working, so we're logging in as Carmine.

20
01:02.480 --> 01:07.480
So from a command line, let's verify we can ping 23.1.2.1, and that is working.

21
01:07.480 --> 01:12.660
So we have IP connectivity, but if we try to use SSH, we'll do a dash L to log

22
01:12.660 --> 01:16.160
in as a user of iOS to the IP address 23.1.2.1,

23
01:16.160 --> 01:22.800
and Survey says that is being rejected. So connection refused right there.

24
01:22.800 --> 01:26.850
So what I would like you to do is right below this video, there are a series of

25
01:26.850 --> 01:30.560
screenshots showing some configurations done in NSX.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
01:26.850 --> 01:30.560
screenshots showing some configurations done in NSX.

26
01:30.560 --> 01:34.800
We're getting group membership, there's also configuration in Active Directory,

27
01:34.800 --> 01:36.120
we're getting group membership.

28
01:36.120 --> 01:38.990
And what I'd like you to do is take a look at the screenshots, and based on

29
01:38.990 --> 01:43.290
those, identify what you think the problem is regarding the white Carmine

30
01:43.290 --> 01:45.160
logged into this client VM right here,

31
01:45.160 --> 01:48.760
is unable to access this IP address using SSH.

32
01:48.760 --> 01:51.950
And then also, in addition to it, just identifying the problem, I would love

33
01:51.950 --> 01:55.840
for you to take a moment and think about what we would do to solve the problem.

34
01:55.840 --> 01:58.990
So that, my friend, is our troubleshooting scenario. I would encourage you to

35
01:58.990 --> 02:00.360
give this a few minutes of thought.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:58.990 --> 02:00.360
give this a few minutes of thought.

36
02:00.360 --> 02:04.600
And then when you're ready, join me in the next video, and we'll walk through

37
02:04.600 --> 02:06.760
this troubleshooting scenario together.

38
02:06.760 --> 02:16.760
[BLANK_AUDIO]