WEBVTT 1 00:00.000 --> 00:04.300 So let's begin with the acronyms for IDS and IPS. 2 00:04.300 --> 00:07.280 IDS is the acronym for intrusion detection system. 3 00:07.280 --> 00:10.960 And then the IPS would be intrusion prevention system. 4 00:10.960 --> 00:14.360 And the biggest difference there between an IDS and an IPS 5 00:14.360 --> 00:17.680 is what the device that's running the IPS IDS software 6 00:17.680 --> 00:21.520 is going to do when it actually sees an attack. 7 00:21.520 --> 00:23.400 Or if it sees there's some abnormal behavior 8 00:23.400 --> 00:25.920 that triggers an IPS/IDS event. 9 00:25.920 --> 00:28.160 Is it going to just detect it and report it 10 00:28.160 --> 00:30.320 or is it going to go ahead and not only detect it, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:28.160 --> 00:30.320 or is it going to go ahead and not only detect it, 11 00:30.320 --> 00:32.640 but also prevent it from moving any forward 12 00:32.640 --> 00:33.680 through the network. 13 00:33.680 --> 00:36.680 And the biggest difference when implementing IDS versus IPS 14 00:36.680 --> 00:39.440 in NSX is what we specify on the rule. 15 00:39.440 --> 00:41.000 For the rule, we're going to have an action, 16 00:41.000 --> 00:42.880 which is going to say, do you want to go ahead and just 17 00:42.880 --> 00:43.360 detect this? 18 00:43.360 --> 00:45.520 Or do you want to go ahead and prevent it 19 00:45.520 --> 00:47.600 from making it any further through the network? 20 00:47.600 --> 00:48.960 And as a result of that rule, that 21 00:48.960 --> 00:52.280 would make it IDS for detection only or IPS. 22 00:52.280 --> 00:54.960 It was doing the detection as well as the prevention 23 00:54.960 --> 00:58.040 of that traffic flow going any further through the network. 24 00:58.040 --> 00:59.840 Now, one of the questions that might come up is, OK, 25 00:59.840 --> 01:03.120 well, why would we ever want to say intrusion detection only WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 25 00:59.840 --> 01:03.120 well, why would we ever want to say intrusion detection only 26 01:03.120 --> 01:04.120 and not prevention? 27 01:04.120 --> 01:06.240 And one of the big answers is, when you first 28 01:06.240 --> 01:09.240 enable the features, there may be traffic that's actually 29 01:09.240 --> 01:11.600 innocent production traffic going through the network 30 01:11.600 --> 01:15.680 that we are going to be accidentally denying and rejecting. 31 01:15.680 --> 01:18.240 And as a result, we can impact production networks. 32 01:18.240 --> 01:20.400 So one of the strategies is to go ahead and set up 33 01:20.400 --> 01:23.400 the policies and the rules and have it go ahead and do detection 34 01:23.400 --> 01:24.400 only initially. 35 01:24.400 --> 01:27.320 And then after we've let that run for, let's say, 45 days 36 01:27.320 --> 01:29.280 or a couple of months, and we've had a chance to take a look 37 01:29.280 --> 01:30.760 at all the events that are being generated, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 01:29.280 --> 01:30.760 at all the events that are being generated, 38 01:30.760 --> 01:34.240 then maybe we start to customize our profiles and policies 39 01:34.240 --> 01:35.920 and rules, and then we set up some of it 40 01:35.920 --> 01:37.600 to go ahead and do prevention. 41 01:37.600 --> 01:39.440 And again, that's like a one, two punch. 42 01:39.440 --> 01:41.160 And that way, we're not accidentally just 43 01:41.160 --> 01:43.120 turning it on and say, stop everything 44 01:43.120 --> 01:44.880 and possibly harming production traffic. 45 01:44.880 --> 01:47.400 And let's talk for a few moments about some of the methods 46 01:47.400 --> 01:50.960 that NSX is using to identify an intrusion. 47 01:50.960 --> 01:53.680 The primary tool is a set of signatures. 48 01:53.680 --> 01:55.240 And so in those signatures, we could 49 01:55.240 --> 01:57.840 be looking for an exact match regarding a traffic flow 50 01:57.840 --> 01:59.200 or a behavior. 51 01:59.200 --> 02:03.720 For example, for this VM to be doing a TCP send request WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 51 01:59.200 --> 02:03.720 For example, for this VM to be doing a TCP send request 52 02:03.720 --> 02:05.920 to the server right here, that's pretty normal. 53 02:05.920 --> 02:08.000 But this device right here is doing 54 02:08.000 --> 02:10.840 a scan or a TCP request of this device 55 02:10.840 --> 02:13.600 and every other device on the 1020 network. 56 02:13.600 --> 02:15.360 That's no longer so innocent. 57 02:15.360 --> 02:17.080 And if those connection requests happened 58 02:17.080 --> 02:19.040 at lots of different machines or we're scanning 59 02:19.040 --> 02:21.400 one individual machine and we're scanning 60 02:21.400 --> 02:24.120 on the first 10,000 TCP ports or UDP ports 61 02:24.120 --> 02:26.440 to find out what's available, that's a pretty good indicator 62 02:26.440 --> 02:29.480 that something abnormal is happening here from this VM. 63 02:29.480 --> 02:31.240 At which point, if we had some rules in place WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 02:29.480 --> 02:31.240 At which point, if we had some rules in place 64 02:31.240 --> 02:33.120 that said to go ahead and prevent it, 65 02:33.120 --> 02:35.520 when NSX sees that traffic and that signatures 66 02:35.520 --> 02:37.600 matched in the behavior scene, it can go ahead 67 02:37.600 --> 02:40.840 and stop that traffic from flowing further through the network. 68 02:40.840 --> 02:43.960 Now another question is, where do we want our NSX 69 02:43.960 --> 02:46.080 to implement the ID/IPS? 70 02:46.080 --> 02:47.480 And the answer is hopefully we're 71 02:47.480 --> 02:49.240 going to implement it where it's needed. 72 02:49.240 --> 02:50.360 But there are a few options. 73 02:50.360 --> 02:54.080 One is we could implement a policy for ID/IPS 74 02:54.080 --> 02:56.720 as distributed, so think of that like hovering 75 02:56.720 --> 02:58.160 over our entire network. 76 02:58.160 --> 03:02.240 Or we had the option of implementing the ID/IPS on a gateway. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 76 02:58.160 --> 03:02.240 Or we had the option of implementing the ID/IPS on a gateway. 77 03:02.240 --> 03:04.880 And so currently with the current flavor of NSX, 78 03:04.880 --> 03:07.600 we can implement it on any of our tier one gateways. 79 03:07.600 --> 03:10.400 And let's imagine we just want to apply here on gateway A. 80 03:10.400 --> 03:12.640 And then whenever policies and rules we configure 81 03:12.640 --> 03:15.400 and create regarding ID/IPS will be implemented 82 03:15.400 --> 03:17.160 for traffic that's being routed through 83 03:17.160 --> 03:18.640 this logical gateway A. 84 03:18.640 --> 03:20.320 So in the interface, when we go to work with 85 03:20.320 --> 03:23.000 and configure the ID/IPS, when it asks us 86 03:23.000 --> 03:25.040 about protecting East West traffic, 87 03:25.040 --> 03:27.600 what it's really referring to with ID/IPS 88 03:27.600 --> 03:30.760 is the IPS policy being implemented WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 88 03:27.600 --> 03:30.760 is the IPS policy being implemented 89 03:30.760 --> 03:32.240 on our distributed firewall. 90 03:32.240 --> 03:35.680 And if we implement our ID/IPS on our gateway 91 03:35.680 --> 03:37.480 in the interface, it'll offer refer to that 92 03:37.480 --> 03:39.200 as North-South traffic. 93 03:39.200 --> 03:41.680 Although that's not 100% completely true, 94 03:41.680 --> 03:44.080 because we could also have this gateway right here 95 03:44.080 --> 03:47.120 running the ID/IPS policies and rules. 96 03:47.120 --> 03:49.400 They would also protect, for example, traffic from here 97 03:49.400 --> 03:50.960 that's trying to go over here. 98 03:50.960 --> 03:53.320 Because once again, it's going through this firewall. 99 03:53.320 --> 03:55.960 But in the interface, just be aware that for DFW, 100 03:55.960 --> 03:57.960 it's often referring to East West traffic 101 03:57.960 --> 04:00.440 and for the ID/IPS implement on the gateway WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 101 03:57.960 --> 04:00.440 and for the ID/IPS implement on the gateway 102 04:00.440 --> 04:02.600 is focused on North-South traffic. 103 04:02.600 --> 04:05.040 And one other feature that's very commonly talked about 104 04:05.040 --> 04:08.040 right in the same paragraph as ID/IPS 105 04:08.040 --> 04:11.080 is the concept of malware protection. 106 04:11.080 --> 04:14.000 And while ID/IPS is focused on seeing 107 04:14.000 --> 04:15.600 if there's intrusion attempts, 108 04:15.600 --> 04:17.360 malware protection is actually taking a look 109 04:17.360 --> 04:19.960 at the files and content that are being sent 110 04:19.960 --> 04:21.600 in the payload of our packets, 111 04:21.600 --> 04:24.240 and logically assembling those segments together 112 04:24.240 --> 04:25.360 to take a look at the payload, 113 04:25.360 --> 04:27.400 and then identify whether or not that payload 114 04:27.400 --> 04:29.520 is carrying any type of malware. 115 04:29.520 --> 04:31.560 So the implementation of malware protection WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 115 04:29.520 --> 04:31.560 So the implementation of malware protection 116 04:31.560 --> 04:32.840 is a few additional steps, 117 04:32.840 --> 04:35.000 including some appliances that we'll need to pull it off. 118 04:35.000 --> 04:38.160 However, for just the ID/IPS part, 119 04:38.160 --> 04:40.240 we can do that with our existing nodes, 120 04:40.240 --> 04:43.000 our host transport nodes and our edge transport nodes. 121 04:43.000 --> 04:45.120 And we don't need to add a separate appliance 122 04:45.120 --> 04:49.080 or component instead of NSX, just for the ID/IPS. 123 04:49.080 --> 04:51.600 And also one other thing I should mention about ID/IPS 124 04:51.600 --> 04:54.160 is that we also need to have an appropriate license 125 04:54.160 --> 04:55.360 to go ahead and run it. 126 04:55.360 --> 04:58.240 So in the lab here, I've got my license from Vmug, 127 04:58.240 --> 05:00.880 which is an evaluation license for NSX, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 04:58.240 --> 05:00.880 which is an evaluation license for NSX, 128 05:00.880 --> 05:02.120 and it does support the basics 129 05:02.120 --> 05:04.720 of implementing the ID/IPS functionality.