WEBVTT

1
00:00.000 --> 00:03.760
So now that we've got a few minutes to analyze the screenshots and take a look

2
00:03.760 --> 00:05.000
at what we think is wrong,

3
00:05.000 --> 00:08.710
let's confirm together what is wrong and we'll also put these solutions in

4
00:08.710 --> 00:10.700
place to solve it for Carmine.

5
00:10.700 --> 00:14.600
Again, we're trying to have Carmine at this VM called Win11 client to be able

6
00:14.600 --> 00:18.000
to go ahead and SSH to this IP address right there.

7
00:18.000 --> 00:22.130
As part of our troubleshooting, I'm just going to verify that indeed we cannot

8
00:22.130 --> 00:24.000
use SSH up to that IP address.

9
00:24.000 --> 00:27.870
So if you're enough, it's being rejected. Let's go and take a look at the

10
00:27.870 --> 00:30.000
configuration. Let's start in NSX.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:30.000 --> 00:34.400
So here in the NSX manager, let's go to system and I just want to verify that

12
00:34.400 --> 00:37.000
we have active directory set up and we do.

13
00:37.000 --> 00:42.000
So that looks OK. And if we click here on check status, that looks good.

14
00:42.000 --> 00:46.350
And if we click here and click on sync all, although I have a set for five

15
00:46.350 --> 00:48.000
minutes synchronization interval,

16
00:48.000 --> 00:52.840
that's being synchronized pretty frequently. So all that part looks good. Let's

17
00:52.840 --> 00:55.000
next go to security and under security,

18
00:55.000 --> 00:58.410
we'll go down to distributed firewall and then with distributed firewall

19
00:58.410 --> 01:00.000
selected, we'll click on settings.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
01:00.000 --> 01:04.290
That's why I make sure that we are enabled for identity firewall on the

21
01:04.290 --> 01:06.000
distributed firewall.

22
01:06.000 --> 01:09.520
And so if we scroll down here, it looks like we've enabled it here. That looks

23
01:09.520 --> 01:10.000
great.

24
01:10.000 --> 01:14.310
And identity firewall status is enabled for host transport nodes cluster. And

25
01:14.310 --> 01:16.000
that's where the VM in question is.

26
01:16.000 --> 01:20.120
It's running a host in that cluster. So that part looks OK. So if we click here

27
01:20.120 --> 01:22.000
on category specific rules,

28
01:22.000 --> 01:25.500
let's take a look at the rules involved. I'm going to collapse the left hand

29
01:25.500 --> 01:27.000
side there so we can have a better look.

30
01:27.000 --> 01:32.400
So here in this policy called domain admins, we have a rule that permits SSH.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:27.000 --> 01:32.400
So here in this policy called domain admins, we have a rule that permits SSH.

31
01:32.400 --> 01:34.000
So it says allow traffic.

32
01:34.000 --> 01:39.540
If it's sourced from domain admins, that's our NSX group. If it's going to 23 1

33
01:39.540 --> 01:44.000
.2.1 and it's using TCP and the destination port is 22.

34
01:44.000 --> 01:48.000
So that part looks good and it's being applied to the distributed firewall.

35
01:48.000 --> 01:51.990
And then we have the next rule as part of that policy, which is denying

36
01:51.990 --> 01:55.000
anything sourced from 10 anything going to the IP address.

37
01:55.000 --> 02:00.560
If it's TCP and going to part 22 and then the action there is reject and both
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:55.000 --> 02:00.560
If it's TCP and going to part 22 and then the action there is reject and both

38
02:00.560 --> 02:02.000
those are enabled.

39
02:02.000 --> 02:06.000
So it looks like we are not getting matched on this rule. So what we could do

40
02:06.000 --> 02:09.000
is we could click on inventory and go take a look at domain admins

41
02:09.000 --> 02:13.010
or we could just click the pencil right here and then here showing us domain

42
02:13.010 --> 02:14.000
admins selected.

43
02:14.000 --> 02:18.000
I'll go ahead and say please let me show the one selected. So domain admins,

44
02:18.000 --> 02:19.000
that's the NSX group.

45
02:19.000 --> 02:23.390
If we click here on view members, that shows us that we do have one virtual

46
02:23.390 --> 02:26.000
machine there. Oh, that's the wrong virtual machine.

47
02:26.000 --> 02:30.300
That is our Windows server. So I'm currently logged on to the Windows server as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:26.000 --> 02:30.300
That is our Windows server. So I'm currently logged on to the Windows server as

48
02:30.300 --> 02:34.000
a user administrator who's a member of domain admins.

49
02:34.000 --> 02:38.150
So the Windows server is showing up, but that's not the Windows client. So this

50
02:38.150 --> 02:39.000
is the IP address of our Windows server.

51
02:39.000 --> 02:43.270
And just to confirm the group membership of the click here on group definition,

52
02:43.270 --> 02:47.000
AD groups, it's pulling based on the members in domain admins.

53
02:47.000 --> 02:50.630
And so this all looks pretty good to me. So that leads me to leave. It might be

54
02:50.630 --> 02:53.000
a problem with active directory itself.

55
02:53.000 --> 02:58.000
Maybe the user Carmine is not included in that group called domain admins.

56
02:58.000 --> 03:02.300
So let's bring up active directory and take a look. So here is our Windows
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:58.000 --> 03:02.300
So let's bring up active directory and take a look. So here is our Windows

57
03:02.300 --> 03:03.000
server. Let me make that a little bit bigger.

58
03:03.000 --> 03:06.720
And on the Windows server, we'll go ahead and log in. So here's our active

59
03:06.720 --> 03:08.000
directory users and computers.

60
03:08.000 --> 03:13.870
So there is Carmine. There's our domain admins group. Let's take a peek at the

61
03:13.870 --> 03:15.000
user Carmine. So we'll double click on it.

62
03:15.000 --> 03:20.590
And then we'll ask to see what members he's a group of. And he is a member of

63
03:20.590 --> 03:24.000
domain users, but not domain admins.

64
03:24.000 --> 03:28.480
And that is the problem. So let's go ahead and add Carmine to the domain admins

65
03:28.480 --> 03:29.000
group.

66
03:29.000 --> 03:33.090
So we'll click on add and we'll type in domain and then we'll click right here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:29.000 --> 03:33.090
So we'll click on add and we'll type in domain and then we'll click right here

67
03:33.090 --> 03:34.000
and check names.

68
03:34.000 --> 03:38.410
And we want to add him to domain admins. So we'll click on domain admins. Click

69
03:38.410 --> 03:41.000
on OK. Click on OK again.

70
03:41.000 --> 03:45.370
So the fact that Carmine was not a member in AD of domain admins and that our

71
03:45.370 --> 03:47.000
NSX group was based on domain admins,

72
03:47.000 --> 03:51.000
that would be a really good reason why his virtual machine wasn't showing up.

73
03:51.000 --> 03:52.000
So let's click on add.

74
03:52.000 --> 03:56.090
So we'll click on apply here and OK. And then I'm just going to go in and

75
03:56.090 --> 04:00.000
double check. We'll click on Carmine. Click on member of.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
04:00.000 --> 04:04.840
And now Carmine's a member of domain admins. All right. So we'll click OK there

77
04:04.840 --> 04:07.000
. And let me minimize the Windows server.

78
04:07.000 --> 04:12.130
So back at our distributed firewall, if we went in and edited the source and

79
04:12.130 --> 04:14.000
went to domain admins, we clicked right here on a few members.

80
04:14.000 --> 04:18.490
Now there's our Win11 client right there. Fantastic, which is Carmine's

81
04:18.490 --> 04:21.000
computer. So as a result of this,

82
04:21.000 --> 04:25.900
we'll click on close here without making any changes here to our configuration

83
04:25.900 --> 04:27.000
as part of NSX.

84
04:27.000 --> 04:31.580
Let's bring back Carmine's virtual machine. And let's check now and see whether
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:27.000 --> 04:31.580
Let's bring back Carmine's virtual machine. And let's check now and see whether

85
04:31.580 --> 04:34.000
or not Carmine can access that external router.

86
04:34.000 --> 04:38.140
So here's Carmine's computer again. And a moment ago, when we tested it, it

87
04:38.140 --> 04:42.430
wouldn't work. So let the upper key press enter and survey says still not

88
04:42.430 --> 04:43.000
working.

89
04:43.000 --> 04:47.730
Why is that? Hmm. Look at that. And we looked at that group. Let's take a

90
04:47.730 --> 04:49.000
second peek here.

91
04:49.000 --> 04:52.950
I hope we got inventory and on the left, go to groups and just to confirm

92
04:52.950 --> 04:58.000
domain admins, if click on view members, there's his computer right there.

93
04:58.000 --> 05:01.080
So it looks like he's being included, but just to air on the side of caution, I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
04:58.000 --> 05:01.080
So it looks like he's being included, but just to air on the side of caution, I

94
05:01.080 --> 05:05.650
'm going to go to system identity firewall and then click on the three dots

95
05:05.650 --> 05:08.000
right here and say, let's go ahead and sync everything.

96
05:08.000 --> 05:12.570
So I'll click on sync all then also just for grins. I'm going to go ahead and

97
05:12.570 --> 05:15.000
log out and log back in as Carmine.

98
05:15.000 --> 05:18.040
So we'll go ahead and sign out and then we'll go ahead and sign in again.

99
05:18.040 --> 05:23.310
Fantastic. We'll bring up a command prompt and let's type in SSH dash L for

100
05:23.310 --> 05:26.000
login as VYOS 223.1.2.1.

101
05:26.000 --> 05:30.670
We'll press enter and sure enough, it's working. So we'll go ahead and log in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
05:26.000 --> 05:30.670
We'll press enter and sure enough, it's working. So we'll go ahead and log in

102
05:30.670 --> 05:33.000
with the password for virus user.

103
05:33.000 --> 05:35.580
So I'll supply that and we are logged in. So it could have been in the

104
05:35.580 --> 05:36.000
background.

105
05:36.000 --> 05:39.520
So we just took a moment or two to sync up and now it is working. And as

106
05:39.520 --> 05:43.700
another test, let's also verify that other computers who are not members of the

107
05:43.700 --> 05:49.000
domain admin group, they cannot access that IP address using SSH.

108
05:49.000 --> 05:52.180
So if we go back to distributed firewall, I'll collapse the left hand side. Let

109
05:52.180 --> 05:56.660
's take a close look at our rule. So this rule right here should prevent anyone

110
05:56.660 --> 05:59.000
who is not in the domain admins group.

111
05:59.000 --> 06:02.120
So we're coming from this source address starting with 10 and going to that IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
05:59.000 --> 06:02.120
So we're coming from this source address starting with 10 and going to that IP

112
06:02.120 --> 06:06.040
address using SSH, they should be denied. So to confirm that, let's go grab a

113
06:06.040 --> 06:09.000
computer that's over here on segment 20.

114
06:09.000 --> 06:12.870
And just to be on the safe side, I'll grab a Linux machine, which I'm sure is

115
06:12.870 --> 06:17.660
not logging into Active Directory. So let's go ahead and use Mint 20 and we'll

116
06:17.660 --> 06:21.000
confirm right here that is connected to segment 20.

117
06:21.000 --> 06:24.400
And let's go and open up a remote console or to Mint 20. So we'll right click

118
06:24.400 --> 06:29.110
in from the menu. We'll click on open remote console. So here is our Windows

119
06:29.110 --> 06:35.000
machine where we're logged in as Carmine and SSH is working.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
06:29.110 --> 06:35.000
machine where we're logged in as Carmine and SSH is working.

120
06:35.000 --> 06:39.470
And this remote console right here is for Mint 20. It's a flavor of Linux and

121
06:39.470 --> 06:45.000
it is not logged into Active Directory. So if we do a IP address, press enter.

122
06:45.000 --> 06:51.270
The IP address is 10.20.0.165. Let's just verify with a quick ping that we can

123
06:51.270 --> 06:57.000
ping 23.1.2.1 just to confirm we have connectivity to that IP address.

124
06:57.000 --> 07:03.290
So if we try using SSH, so do SSH dash L will log in as the user Vios to 23.1.2
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
06:57.000 --> 07:03.290
So if we try using SSH, so do SSH dash L will log in as the user Vios to 23.1.2

125
07:03.290 --> 07:09.000
.1. That should be rejected, which it is as indicated right there.

126
07:09.000 --> 07:13.650
So as far as troubleshooting, all our NSX configuration, the two firewall rules

127
07:13.650 --> 07:18.450
have a else were perfect. However, the problem was in Active Directory. Carmine

128
07:18.450 --> 07:21.000
was not a member of the domain admins groups.

129
07:21.000 --> 07:25.550
So once we added Carmine to that domain admins group in Active Directory, and

130
07:25.550 --> 07:29.750
then we also gave a little push to the configuration on NSX to tell it to sync

131
07:29.750 --> 07:31.000
up with Active Directory.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
07:29.750 --> 07:31.000
up with Active Directory.

132
07:31.000 --> 07:35.240
Regarding that membership, then when we logged in as Carmine at this VM right

133
07:35.240 --> 07:39.130
here, it recognized that that source was a user who is part of the domain

134
07:39.130 --> 07:44.000
admins group, which in turn made that VM part of the NSX group that was mapping

135
07:44.000 --> 07:45.000
to the domain admins group.

136
07:45.000 --> 07:48.960
And then because that was used as part of a security policy rule to permit the

137
07:48.960 --> 07:52.850
SSH traffic that started to work. So thank you for joining me in this set of

138
07:52.850 --> 07:57.380
videos in this skill regarding using identity firewall services as part of our

139
07:57.380 --> 08:00.000
firewall rules inside of NSX.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
08:00.000 --> 08:04.450
And also you my friend in another skill very, very soon. Until then, I hope

141
08:04.450 --> 08:09.000
this has been informative and I'd like to thank you for viewing.