WEBVTT 1 00:00.000 --> 00:01.320 All right, my friends. 2 00:01.320 --> 00:06.330 So for our game plan regarding the implementation and testing of IDS and IPS, 3 00:06.330 --> 00:07.400 let's do the following. 4 00:07.400 --> 00:09.840 First, let's verify our topology. 5 00:09.840 --> 00:12.880 And that'll be important because I did add a couple new VMs. 6 00:12.880 --> 00:16.200 I added a Kali Linux VM right here on segment 10. 7 00:16.200 --> 00:18.840 That's ready to go with a whole bunch of pen testing tools. 8 00:18.840 --> 00:22.720 And I also have a little VM down here called Metasploidable. 9 00:22.720 --> 00:24.840 And I'm currently using Metasploidable version two. 10 00:24.840 --> 00:28.480 Now, one of the questions might be, well, what exactly is Metasploidable? 11 00:28.480 --> 00:33.760 That is an intentionally vulnerable system with tons of weaknesses. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:28.480 --> 00:33.760 That is an intentionally vulnerable system with tons of weaknesses. 12 00:33.760 --> 00:37.780 And with that intentionally vulnerable machine to test environment, we can test 13 00:37.780 --> 00:38.560 our scanners 14 00:38.560 --> 00:42.300 and vulnerability testing tools and penetration testing tools and get that 15 00:42.300 --> 00:43.080 practice of what 16 00:43.080 --> 00:46.560 it looks and feels like to have a system that is compromised and also how to 17 00:46.560 --> 00:47.240 use the tools 18 00:47.240 --> 00:49.400 that do it, which leads me to our next step. 19 00:49.400 --> 00:53.800 Once we verify our topology, let's also verify a few of our attack tools. 20 00:53.800 --> 00:58.370 From here are Kali Linux box going down to our intentionally vulnerable Metaspl 21 00:58.370 --> 00:58.640 oidable 22 00:58.640 --> 01:00.720 version two VM right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 22 00:58.640 --> 01:00.720 version two VM right here. 23 01:00.720 --> 01:04.550 So I'm just gonna say test intrusion tools from here to there just to verify 24 01:04.550 --> 01:05.120 that they're 25 01:05.120 --> 01:06.720 working and available. 26 01:06.720 --> 01:10.420 Also just to remind ourselves about what a vulnerable system looks like and how 27 01:10.420 --> 01:11.000 dangerous 28 01:11.000 --> 01:14.680 it is to have a vulnerable system or an unpatched system on our network. 29 01:14.680 --> 01:19.000 So our next step is then to go ahead and enable the IDS/IPS functionality 30 01:19.000 --> 01:20.640 inside of NSX. 31 01:20.640 --> 01:25.590 And to do that, we're gonna create an IDS/IPS profile that specifies what we 32 01:25.590 --> 01:26.280 want to look 33 01:26.280 --> 01:27.800 for based on signatures. 34 01:27.800 --> 01:33.150 And then secondly, we're also gonna go ahead and apply that profile inside of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 34 01:27.800 --> 01:33.150 And then secondly, we're also gonna go ahead and apply that profile inside of 35 01:33.150 --> 01:34.080 our IDS/IPS 36 01:34.080 --> 01:35.600 rule that will apply. 37 01:35.600 --> 01:39.960 And initially, we'll include the IDS/IPS as part of our distributed firewall. 38 01:39.960 --> 01:44.660 And then once we have that in place, we'll go ahead and then test to verify 39 01:44.660 --> 01:45.600 that works. 40 01:45.600 --> 01:48.470 And then just for grands, I think we should also take a moment and see what it 41 01:48.470 --> 01:49.160 looks like 42 01:49.160 --> 01:52.080 instead of implementing it as a DFW policy. 43 01:52.080 --> 01:55.920 Let's implement our IDS/IPS as a gateway policy. 44 01:55.920 --> 01:59.160 And let's also implement it right here on our tier one gateway A. 45 01:59.160 --> 02:02.900 And again, the distributed firewall would be an example of controlling East- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 45 01:59.160 --> 02:02.900 And again, the distributed firewall would be an example of controlling East- 46 02:02.900 --> 02:03.600 West traffic 47 02:03.600 --> 02:06.830 as the distributed firewall is hovering, if you will, over our entire 48 02:06.830 --> 02:07.800 architecture where 49 02:07.800 --> 02:09.200 all the VMs are. 50 02:09.200 --> 02:12.680 And the IDS/IPS implemented the gateway would only control traffic going 51 02:12.680 --> 02:13.720 through the gateway 52 02:13.720 --> 02:14.720 we applied on. 53 02:14.720 --> 02:18.910 So for example, if we only had IDS/IPS implemented on this gateway, traffic, 54 02:18.910 --> 02:20.000 for example, here 55 02:20.000 --> 02:24.050 from this VM going to this VM, they would not be going through this logical 56 02:24.050 --> 02:24.600 gateway. 57 02:24.600 --> 02:27.900 And as a result, that traffic wouldn't be inspected or looked at for the 58 02:27.900 --> 02:28.520 benefits of 59 02:28.520 --> 02:30.020 IDS/IPS. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 59 02:28.520 --> 02:30.020 IDS/IPS. 60 02:30.020 --> 02:32.980 And for some of the tools that we could use for the testing here, let's go 61 02:32.980 --> 02:33.760 ahead and use 62 02:33.760 --> 02:37.200 N-Map or as graphical based cousin, Z-Map. 63 02:37.200 --> 02:41.050 And we can also use the MSF, the Metasplodible Framework, which is already part 64 02:41.050 --> 02:41.680 of the Kali 65 02:41.680 --> 02:45.740 Linux distribution, to go ahead and test and interact between our Kali Linux 66 02:45.740 --> 02:46.320 box and this 67 02:46.320 --> 02:47.080 vulnerable server.