WEBVTT

1
00:00.000 --> 00:04.240
To help us reinforce the concept of ID/IPS.

2
00:04.240 --> 00:08.640
Whether they are distributed rules applied across the entire topology or

3
00:08.640 --> 00:09.080
whether they're

4
00:09.080 --> 00:13.040
a gateway-based rule applied to a specific gateway, this scenario is going to

5
00:13.040 --> 00:13.680
help us

6
00:13.680 --> 00:15.080
confirm our understanding.

7
00:15.080 --> 00:16.080
And here's the scenario.

8
00:16.080 --> 00:21.260
The customer thinks or believes that the ID/IPS functionality is enabled to

9
00:21.260 --> 00:22.560
protect all VM

10
00:22.560 --> 00:28.840
traffic within the segments of segment 10 over here and segment 20 over here.

11
00:28.840 --> 00:34.610
However, unfortunately, the ID/IPS events that should be popping up and should
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.840 --> 00:34.610
However, unfortunately, the ID/IPS events that should be popping up and should

12
00:34.610 --> 00:35.640
be appearing

13
00:35.640 --> 00:40.680
instead of NSX for two VMs, for example, like these two right here or, for

14
00:40.680 --> 00:41.520
example, like

15
00:41.520 --> 00:42.960
these two right here.

16
00:42.960 --> 00:46.280
The traffic between those two VMs that normally should be triggering off

17
00:46.280 --> 00:47.080
signatures and there

18
00:47.080 --> 00:50.320
should be alerts and alarms, they are not being recorded.

19
00:50.320 --> 00:53.480
So here is your mission, my friend, should you choose to accept it.

20
00:53.480 --> 00:57.640
I'd like you to take a peek at the following series of screenshots right below

21
00:57.640 --> 00:58.280
this video

22
00:58.280 --> 01:02.420
and take a look at each one of them regarding the NSX configuration with an eye
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:58.280 --> 01:02.420
and take a look at each one of them regarding the NSX configuration with an eye

23
01:02.420 --> 01:02.960
towards

24
01:02.960 --> 01:06.040
IPS/IDS and using those screenshots.

25
01:06.040 --> 01:08.280
Here's what I would love for you to determine.

26
01:08.280 --> 01:12.240
Identify why, for example, these two VMs here or these two VMs here in the same

27
01:12.240 --> 01:12.880
segment.

28
01:12.880 --> 01:17.430
Why it is that the ID/IPS isn't identifying or seeing any traffic which would

29
01:17.430 --> 01:18.080
normally

30
01:18.080 --> 01:20.840
be picked up by ID/IPS.

31
01:20.840 --> 01:24.350
Something is wrong with the config and based on the screenshots, the customer

32
01:24.350 --> 01:24.600
would like

33
01:24.600 --> 01:26.640
us to help identify what the problem is.

34
01:26.640 --> 01:28.800
So here is what I would like you to do.

35
01:28.800 --> 01:32.650
Take the next minute or two to consider the topology and the existing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.800 --> 01:32.650
Take the next minute or two to consider the topology and the existing

36
01:32.650 --> 01:33.720
screenshots and

37
01:33.720 --> 01:35.640
identify what you think the problem is.

38
01:35.640 --> 01:38.530
And then once you've had some time to go through it, join me in the next video

39
01:38.530 --> 01:38.680
as we

40
01:38.680 --> 01:43.160
take a moment and compare notes about what we think is wrong and why the ID/IPS

41
01:43.160 --> 01:43.600
isn't

42
01:43.600 --> 01:46.360
working as expected for this customer.

43
01:46.360 --> 01:49.490
So have some fun with this scenario and I'll see you in a little bit when you

44
01:49.490 --> 01:50.200
are ready.

45
01:50.200 --> 02:00.200
[BLANK_AUDIO]