WEBVTT

1
00:00.000 --> 00:04.450
So it's now time to go ahead and start preventing or at least being aware of

2
00:04.450 --> 00:05.500
those types of attacks.

3
00:05.500 --> 00:09.600
We're going to do that by first of all, creating an IDS/IPS profile.

4
00:09.600 --> 00:11.200
And to do that, we're going to do a few things.

5
00:11.200 --> 00:15.780
Number one, we're going to enable on our distributed firewall the ability to go

6
00:15.780 --> 00:17.600
ahead and do IDS/IPS.

7
00:17.600 --> 00:21.400
And then as part of that, we're going to create an IDS/IPS policy.

8
00:21.400 --> 00:25.600
And then the IDS/IPS rule will go ahead and refer to the profile.

9
00:25.600 --> 00:29.730
And once we publish those changes, our distributed firewall that's now

10
00:29.730 --> 00:31.200
leveraging the IDS/IPS
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.730 --> 00:31.200
leveraging the IDS/IPS

11
00:31.200 --> 00:35.400
should be now aware of and have visibility into those types of attacks,

12
00:35.400 --> 00:39.260
or at least that traffic behavior that looks like it might be compromising to

13
00:39.260 --> 00:40.000
our system.

14
00:40.000 --> 00:44.400
So as far as the implementation of IDS/IPS, that's what we get to do right now.

15
00:44.400 --> 00:49.160
So here in the NSX Manager, if we clicked on the Security tab up on top, on the

16
00:49.160 --> 00:49.500
left,

17
00:49.500 --> 00:52.600
if we have security overview selected, and then over here in the main pane,

18
00:52.600 --> 00:56.600
if we click on IDS/IPS, which is right under threat event monitoring,

19
00:56.600 --> 01:00.000
notice that it says, "Hey, the data center is not prepared for IDS/IPS
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
01:00.000 --> 01:04.200
because it has not yet been enabled." Furthermore, if we went under security,

21
01:04.200 --> 01:08.400
and then on the left under threat event monitoring, and clicked here on IDS/IPS

22
01:08.400 --> 01:08.400
,

23
01:08.400 --> 01:10.400
notice once again, it says, "Hey, it's not set up."

24
01:10.400 --> 01:14.400
So to set up and enable the IDS/IPS functionality,

25
01:14.400 --> 01:17.830
what we're going to do is the security tab up on the top selected on the left

26
01:17.830 --> 01:19.000
under policy management,

27
01:19.000 --> 01:22.600
we're going to click right here on IDS/IPS and malware prevention,

28
01:22.600 --> 01:25.200
and that leads us to this opportunity to go ahead and set up.

29
01:25.200 --> 01:30.600
Now, we don't have to use the wizard to enable the IDS/IPS functionality,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:25.200 --> 01:30.600
Now, we don't have to use the wizard to enable the IDS/IPS functionality,

30
01:30.600 --> 01:34.090
but it's super convenient. So if we click on Skip Setup, we could just do it

31
01:34.090 --> 01:34.600
all manually,

32
01:34.600 --> 01:38.000
but since we're right here in the wizard, let's click right here on Start Setup

33
01:38.000 --> 01:38.000
.

34
01:38.000 --> 01:41.600
So here in these two tiles, on the left, it's asking us how we want to set up

35
01:41.600 --> 01:43.200
and enable IDS/IPS

36
01:43.200 --> 01:46.980
and over on the right, it's asking us, do we want to set up and enable the

37
01:46.980 --> 01:48.200
malware protection?

38
01:48.200 --> 01:53.000
So the IDS/IPS looking for malicious activity and the malware protection is

39
01:53.000 --> 01:54.400
actually looking at the payloads

40
01:54.400 --> 01:58.710
and the content in an attempt to determine if it's malicious software, like

41
01:58.710 --> 02:00.400
viruses and malware and so forth.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:58.710 --> 02:00.400
viruses and malware and so forth.

42
02:00.400 --> 02:04.990
So on this set of videos, we want to implement the IDS/IPS and we want to go

43
02:04.990 --> 02:05.800
ahead and implement it,

44
02:05.800 --> 02:10.620
let's start off with the distributive firewall for EastWest traffic and because

45
02:10.620 --> 02:11.800
I don't have the additional VMs

46
02:11.800 --> 02:15.740
deployed yet to support malware prevention, I'm going to say we don't want to

47
02:15.740 --> 02:17.600
do any of that in this set of videos.

48
02:17.600 --> 02:20.390
And then later, we can come back and we can enable North-South traffic

49
02:20.390 --> 02:23.400
effectively enabling the IDS/IPS

50
02:23.400 --> 02:26.570
for the gateway firewall as opposed to the distributive firewall and then we

51
02:26.570 --> 02:27.800
can compare and contrast it to.

52
02:27.800 --> 02:32.460
So for now, I just want to do EastWest traffic with IDS/IPS, which will be part
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
02:27.800 --> 02:32.460
So for now, I just want to do EastWest traffic with IDS/IPS, which will be part

53
02:32.460 --> 02:33.800
of our distributive firewall.

54
02:33.800 --> 02:35.000
And we'll click on Next.

55
02:35.000 --> 02:38.800
If we have a proxy server between us and the internet, we'd want to go ahead

56
02:38.800 --> 02:41.600
and specify the details of that proxy server.

57
02:41.600 --> 02:44.540
And the reason that this is important is because we want to get updates

58
02:44.540 --> 02:46.400
regarding updated signatures

59
02:46.400 --> 02:48.000
and that's going to be done online.

60
02:48.000 --> 02:51.600
So if you have a proxy server, you specify here in my lab environment, I'm not

61
02:51.600 --> 02:52.600
using a proxy server,

62
02:52.600 --> 02:54.000
so I'm not going to configure one there.

63
02:54.000 --> 02:55.800
We'll click on Next to continue.

64
02:55.800 --> 02:59.400
And now it's asking us, do you want to go ahead and automatically update that?

65
02:59.400 --> 03:03.470
Now with my evaluation license, if I click here on Auto Update, it's going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:59.400 --> 03:03.470
Now with my evaluation license, if I click here on Auto Update, it's going to

66
03:03.470 --> 03:04.800
give me an error, it doesn't like to do it.

67
03:04.800 --> 03:09.800
So I'm going to be using the signature version from April 9, 2023.

68
03:09.800 --> 03:12.000
That's what I got with this evaluation license.

69
03:12.000 --> 03:13.400
That's what's currently here.

70
03:13.400 --> 03:16.050
And I'm not going to bother trying to do auto update because with the

71
03:16.050 --> 03:18.800
evaluation license, it won't get the latest and greatest information.

72
03:18.800 --> 03:22.680
However, what we can do is go down here to the Intrusion Signature Set and we

73
03:22.680 --> 03:24.200
can view and manage that set.

74
03:24.200 --> 03:29.600
So currently, there's over 11,000 Intrusion Signatures that come with NSX.

75
03:29.600 --> 03:33.000
So if we click right here on View and Manage Signature Set, here they are.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:29.600 --> 03:33.000
So if we click right here on View and Manage Signature Set, here they are.

76
03:33.000 --> 03:34.800
There's 225 pages worth.

77
03:34.800 --> 03:38.160
And here are all the details or if we want to filter on one, for example, let's

78
03:38.160 --> 03:39.800
type in FTP and press Enter.

79
03:39.800 --> 03:44.220
That would filter and show us just those signatures that have the text FTP in

80
03:44.220 --> 03:44.600
them.

81
03:44.600 --> 03:47.600
And then we can expand one of those, for example, and take a look.

82
03:47.600 --> 03:51.510
So for our demo, I'm going to go ahead and not tweak or customize any of these

83
03:51.510 --> 03:52.200
signatures.

84
03:52.200 --> 03:53.200
I'll use the default set.

85
03:53.200 --> 03:54.400
We'll click on Cancel.

86
03:54.400 --> 03:56.800
And then as part of the wizard, we'll click on Next.

87
03:56.800 --> 04:00.820
So now the wizard is next asking us, OK, where do you want to enable this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:56.800 --> 04:00.820
So now the wizard is next asking us, OK, where do you want to enable this

88
04:00.820 --> 04:05.000
distributed firewall functionality for IDS IPS for your East West traffic?

89
04:05.000 --> 04:08.800
And so if we expand that, it's now giving us an opportunity here to specify

90
04:08.800 --> 04:09.800
where we want that enabled.

91
04:09.800 --> 04:13.200
So I don't have any standalone hosts, so I'll leave that off.

92
04:13.200 --> 04:14.800
I do, however, have two hosts.

93
04:14.800 --> 04:19.600
That's ESXIA and B in my cluster called Host Transport Nodes.

94
04:19.600 --> 04:21.400
In fact, let's just verify that for a moment here.

95
04:21.400 --> 04:24.000
So here in the vSphere client, we'll go to Host and Clusters.

96
04:24.000 --> 04:28.600
Here's our Host Transport Nodes cluster and there's ESXIA and B. Fantastic.

97
04:28.600 --> 04:32.740
So back in the NSX Manager, I'm going to go ahead and enable it just for that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
04:28.600 --> 04:32.740
So back in the NSX Manager, I'm going to go ahead and enable it just for that

98
04:32.740 --> 04:33.600
cluster.

99
04:33.600 --> 04:34.800
So we'll click on Yes.

100
04:34.800 --> 04:38.270
And then my management cluster, I don't have any transport nodes there, so I'm

101
04:38.270 --> 04:39.600
not going to bother enabling it there.

102
04:39.600 --> 04:44.520
So for our two hosts, Host A and B, which are both in that cluster, the ability

103
04:44.520 --> 04:48.350
to do IDS/IPS policies with the distributed firewall once we're done with the

104
04:48.350 --> 04:49.600
wizard should be in place.

105
04:49.600 --> 04:50.800
So we'll click on Done.

106
04:50.800 --> 04:55.280
It's also giving us a reminder here for the IDS/IPS and malware prevention that

107
04:55.280 --> 04:58.810
for the malware part of it, we need some additional VMs to be deployed to

108
04:58.810 --> 04:59.600
support that.

109
04:59.600 --> 05:02.600
So just be aware that for the malware, it takes an additional component.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:59.600 --> 05:02.600
So just be aware that for the malware, it takes an additional component.

110
05:02.600 --> 05:05.600
However, for the IDS/IPS, we are good to go.

111
05:05.600 --> 05:08.930
So with the security tab up here on the top selected on the left, if we click

112
05:08.930 --> 05:13.220
on Security Overview, now if we go to the tab here for IDS/IPS under Threat

113
05:13.220 --> 05:16.600
Event Monitoring, it's now giving us a nice dashboard.

114
05:16.600 --> 05:18.600
So here's the IDS/IPS summary.

115
05:18.600 --> 05:22.160
Currently it's showing us all traffic, but we could also take a look at rules

116
05:22.160 --> 05:26.120
regarding distributed only, or if we had Gateway, IDS/IPS, we could choose

117
05:26.120 --> 05:26.600
Gateway here.

118
05:26.600 --> 05:30.760
To refine that down, if we scroll down further, then we have a distributed IDS/
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
05:26.600 --> 05:30.760
To refine that down, if we scroll down further, then we have a distributed IDS/

119
05:30.760 --> 05:34.600
IPS summary and then further down a gateway-based IDS/IPS summary.

120
05:34.600 --> 05:39.340
And at the moment, there is no activity because we just enabled it a moment ago

121
05:39.340 --> 05:39.600
.

122
05:39.600 --> 05:43.320
So on the left under Security Under Threat Event Monitoring, if we click here

123
05:43.320 --> 05:45.600
on IDS/IPS, we have nothing to report yet.

124
05:45.600 --> 05:50.280
Also, back under Security Overview, if we go to Threat Event Monitoring, IDS/IP

125
05:50.280 --> 05:55.600
S, once we do have events here and we click on them, it will take us over to the

126
05:55.600 --> 05:55.600
IDS/IPS.

127
05:55.600 --> 06:02.240
So now that we have enabled IDS/IPS for our cluster, does that mean it's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:55.600 --> 06:02.240
So now that we have enabled IDS/IPS for our cluster, does that mean it's

128
06:02.240 --> 06:04.600
currently being used?

129
06:04.600 --> 06:09.630
And the answer is no, because we also need to have at least one security policy

130
06:09.630 --> 06:12.600
with one rule regarding IDS/IPS if we want it to work.

131
06:12.600 --> 06:16.470
So if security is still selected on the left under Policy Management, we're

132
06:16.470 --> 06:19.600
going to click right here on IDS/IPS and Malware Prevention.

133
06:19.600 --> 06:23.400
And this is where we went originally, and because it hadn't been set up, it

134
06:23.400 --> 06:27.010
gave us the wizard. But now that it's set up, we can go ahead and create a

135
06:27.010 --> 06:27.600
policy.

136
06:27.600 --> 06:31.350
So for a distributed firewall policy rule for IDS/IPS, we're going to click on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
06:27.600 --> 06:31.350
So for a distributed firewall policy rule for IDS/IPS, we're going to click on

137
06:31.350 --> 06:36.110
distributed rules. If we want to do gateway-based IDS/IPS, we click here on

138
06:36.110 --> 06:36.600
gateway rules.

139
06:36.600 --> 06:40.440
And in either case, we are also going to need an IDS/IPS profile, then we can

140
06:40.440 --> 06:41.600
go ahead and assign.

141
06:41.600 --> 06:45.600
So there's one here by default, it's called default IDS profile.

142
06:45.600 --> 06:49.120
And it's only matching on signatures in the critical category, and there's over

143
06:49.120 --> 06:51.600
5,000 of them out of 11,000.

144
06:51.600 --> 06:55.600
So for the demo, let's create our own. So we'll click here on Add Profile.

145
06:55.600 --> 07:00.260
And let's call this our IDS/IPS. And then for the IDS signatures, I'm going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
06:55.600 --> 07:00.260
And let's call this our IDS/IPS. And then for the IDS signatures, I'm going to

146
07:00.260 --> 07:01.600
include all of them.

147
07:01.600 --> 07:05.930
So critical, high, medium, low, suspicious. We could also further refine this

148
07:05.930 --> 07:09.530
based on attack types and attack targets and CVSS information, as well as

149
07:09.530 --> 07:10.600
products affected.

150
07:10.600 --> 07:13.220
So I'm going to leave those all out there, default for the demo, and click on

151
07:13.220 --> 07:13.600
Save.

152
07:13.600 --> 07:17.890
So now if we expand our IDS/IPS profile, it's going to show us which IDS

153
07:17.890 --> 07:21.600
signatures it's going to be using, which is effectively all of them,

154
07:21.600 --> 07:25.090
with no additional filtering based on the attack types or attack targets and so

155
07:25.090 --> 07:25.600
forth.

156
07:25.600 --> 07:35.600
[BLANK_AUDIO]