WEBVTT

1
00:00.000 --> 00:03.850
Now that you have the opportunity to take a look at some of those screenshots

2
00:03.850 --> 00:04.240
and the

3
00:04.240 --> 00:08.080
configuration that's currently in place, let's take a look together at this

4
00:08.080 --> 00:08.760
environment

5
00:08.760 --> 00:13.270
that's leveraging those screenshots and identify why in the world is IPS not

6
00:13.270 --> 00:14.240
functioning or

7
00:14.240 --> 00:17.800
picking up traffic between two VMs in the same segment.

8
00:17.800 --> 00:21.900
So let's begin our checking by going to the security tab and the left under

9
00:21.900 --> 00:23.160
policy management.

10
00:23.160 --> 00:27.440
Let's click right here on ID/IPSM malware prevention.

11
00:27.440 --> 00:30.460
If it wasn't configured at all, we get the wizard right here that says, "Hey,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:27.440 --> 00:30.460
If it wasn't configured at all, we get the wizard right here that says, "Hey,

12
00:30.460 --> 00:30.600
do you

13
00:30.600 --> 00:31.600
want to set this up?"

14
00:31.600 --> 00:35.240
But based on the snocking the wizard, that would appear that it's enabled.

15
00:35.240 --> 00:40.800
So let's click right here on settings for ID/IPSM and scroll down.

16
00:40.800 --> 00:42.400
And here it's enabled for gateway services.

17
00:42.400 --> 00:46.740
That means we can go ahead and apply a policy for ID/IPSM to gateway A or

18
00:46.740 --> 00:48.320
gateway B. However,

19
00:48.320 --> 00:52.070
if we scroll up a little bit, it is currently not enabled for our host

20
00:52.070 --> 00:53.200
transport node.

21
00:53.200 --> 00:58.970
So that means our ESXi hosts that want to be part of the implementation of ID/

22
00:58.970 --> 00:59.480
IPSM to

23
00:59.480 --> 01:02.640
be used as part of a distributed rule, they won't be able to do it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.480 --> 01:02.640
be used as part of a distributed rule, they won't be able to do it.

24
01:02.640 --> 01:05.970
So I'm going to go ahead and enable that right now and click on yes, because

25
01:05.970 --> 01:06.280
that's

26
01:06.280 --> 01:08.440
really what we want to solve the customer's problem.

27
01:08.440 --> 01:13.120
We want the ability to have ID/IPSM distributed rules.

28
01:13.120 --> 01:16.060
And that way we can identify and control the traffic right there on a single

29
01:16.060 --> 01:16.760
segment between

30
01:16.760 --> 01:18.400
two VMs on that segment.

31
01:18.400 --> 01:22.590
So with the policies as part of a gateway, the traffic would have to go through

32
01:22.590 --> 01:22.840
the

33
01:22.840 --> 01:23.840
gateway.

34
01:23.840 --> 01:27.410
And that wouldn't match for traffic between two VMs that are on the same exact

35
01:27.410 --> 01:27.640
overlay

36
01:27.640 --> 01:28.640
segment.

37
01:28.640 --> 01:31.490
So now that we verify that we have it enabled, let's take a look at our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:28.640 --> 01:31.490
So now that we verify that we have it enabled, let's take a look at our

38
01:31.490 --> 01:32.120
profiles.

39
01:32.120 --> 01:35.550
So we have two profiles, the default and the one we actually put together in

40
01:35.550 --> 01:36.240
our previous

41
01:36.240 --> 01:37.240
videos.

42
01:37.240 --> 01:40.200
So our ID/IPSM profile looks like it's including everything.

43
01:40.200 --> 01:41.200
Fantastic.

44
01:41.200 --> 01:43.280
So now if we go to gateway rules, we can see where it's applied.

45
01:43.280 --> 01:45.640
So let me go ahead and collapse the left hand side here.

46
01:45.640 --> 01:47.800
And let me make this a little bit bigger.

47
01:47.800 --> 01:50.920
So here in this policy is called ID/S on gateway A.

48
01:50.920 --> 01:52.360
If we expand that.

49
01:52.360 --> 01:56.040
Finally, this is being applied to gateway A as shown right up here.

50
01:56.040 --> 01:59.700
And we have one rule called use our profile and the conditions are from

51
01:59.700 --> 02:00.920
anywhere to anywhere
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:59.700 --> 02:00.920
anywhere to anywhere

52
02:00.920 --> 02:01.920
any service.

53
02:01.920 --> 02:05.040
Please use our ID/IPSM profile.

54
02:05.040 --> 02:08.640
And that is applied to our tier one gateway and it's in detect only mode.

55
02:08.640 --> 02:11.950
So the fact that it's in detect only isn't a huge problem because the customer

56
02:11.950 --> 02:12.720
is complaining

57
02:12.720 --> 02:14.960
it was traffic between two VMs on the same segment.

58
02:14.960 --> 02:20.100
So this entire rule right here being applied to a gateway wouldn't even match

59
02:20.100 --> 02:20.920
on traffic

60
02:20.920 --> 02:24.440
between two individual VMs on the same segment.

61
02:24.440 --> 02:27.800
So although this is in place, what we really need to look at is the distributed

62
02:27.800 --> 02:28.480
rules right

63
02:28.480 --> 02:29.480
here.

64
02:29.480 --> 02:33.120
So we'll click on distributed rules and currently we have nothing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:29.480 --> 02:33.120
So we'll click on distributed rules and currently we have nothing.

65
02:33.120 --> 02:38.040
And that is why we're not seeing any ID/IPSM events between two VMs on the same

66
02:38.040 --> 02:38.760
segment

67
02:38.760 --> 02:42.080
because there's no distributed rule currently in place.

68
02:42.080 --> 02:43.080
So let's add one.

69
02:43.080 --> 02:44.480
We'll click on add policy.

70
02:44.480 --> 02:48.990
We'll call it our ID/S distributed policy and then let's create a rule in that

71
02:48.990 --> 02:49.720
policy.

72
02:49.720 --> 02:53.530
We'll call this use our profile and then for the conditions for the security

73
02:53.530 --> 02:54.080
profile,

74
02:54.080 --> 02:58.840
we'll click on the pencil and we'll choose our profile and then click on apply.

75
02:58.840 --> 03:01.950
And then it's in detect only so we can do detect here or detect and prevent
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:58.840 --> 03:01.950
And then it's in detect only so we can do detect here or detect and prevent

76
03:01.950 --> 03:02.520
either way

77
03:02.520 --> 03:03.520
is great.

78
03:03.520 --> 03:04.560
So I'll leave it for detect it that way.

79
03:04.560 --> 03:09.160
We won't be unintentionally denying initial traffic if we have a false positive

80
03:09.160 --> 03:09.520
and with

81
03:09.520 --> 03:11.440
that in place we'll click on publish.

82
03:11.440 --> 03:14.900
And then as a test we could go to two VMs on the same segment, generate some

83
03:14.900 --> 03:15.760
traffic that

84
03:15.760 --> 03:20.220
in our baselines we've identified is going to be triggered as intrusion events

85
03:20.220 --> 03:20.960
and verify

86
03:20.960 --> 03:21.960
that they show up.

87
03:21.960 --> 03:25.230
So the two things we did here is first of all we made sure under settings that

88
03:25.230 --> 03:25.640
we had

89
03:25.640 --> 03:30.190
enabled our cluster with host A and host B so they could support distributed
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:25.640 --> 03:30.190
enabled our cluster with host A and host B so they could support distributed

90
03:30.190 --> 03:30.740
rules for

91
03:30.740 --> 03:31.740
ID/IPS.

92
03:31.740 --> 03:35.560
And then secondly we made sure that we had a distributed rule that was

93
03:35.560 --> 03:36.840
currently applied.

94
03:36.840 --> 03:40.080
And once we select the distributed rules tab those rules will show up right

95
03:40.080 --> 03:40.520
here.

96
03:40.520 --> 03:43.620
And as I mentioned furthermore we'd want to go ahead and test this with some

97
03:43.620 --> 03:44.400
known traffic

98
03:44.400 --> 03:49.140
that causes a match on the ID/IPS function just to make sure this rule, this

99
03:49.140 --> 03:50.440
now a distributed

100
03:50.440 --> 03:52.280
rule is working correctly.

101
03:52.280 --> 03:56.310
So thank you for joining me in this video and in this skill regarding using IDS

102
03:56.310 --> 03:56.600
and

103
03:56.600 --> 03:59.520
IPS services inside of NSX.

104
03:59.520 --> 04:03.400
And I look forward to seeing you my friend in another skill very very soon.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
03:59.520 --> 04:03.400
And I look forward to seeing you my friend in another skill very very soon.

105
04:03.400 --> 04:07.600
Until then I hope this has been informative and I'd like to thank you for

106
04:07.600 --> 04:08.000
viewing.

107
04:08.000 --> 04:18.000
[BLANK_AUDIO]