WEBVTT

1
00:00.000 --> 00:03.480
So in this video, we're going to take the IDS/IPS profile

2
00:03.480 --> 00:05.400
that we just created in the previous video.

3
00:05.400 --> 00:09.320
And now we'll apply that as part of an IDS/IPS rule

4
00:09.320 --> 00:11.680
as we apply it to our distributed firewall.

5
00:11.680 --> 00:14.000
And before we create this new security policy and rule,

6
00:14.000 --> 00:16.400
let's take a current look at the distributed firewall

7
00:16.400 --> 00:18.320
over here on ESXIA.

8
00:18.320 --> 00:19.680
So here is ESXIA.

9
00:19.680 --> 00:24.360
We're at the NSX CLI and let's do a get IDS status.

10
00:24.360 --> 00:25.520
So it should say enabled,

11
00:25.520 --> 00:28.000
and that's because we enabled it for the cluster.

12
00:28.000 --> 00:29.920
So that part looks great.

13
00:29.920 --> 00:32.080
And let's do a get IDS profile.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.920 --> 00:32.080
And let's do a get IDS profile.

14
00:32.080 --> 00:34.880
So currently it shows we have no IDS profiles.

15
00:34.880 --> 00:37.160
And that's because we don't have our profile,

16
00:37.160 --> 00:40.320
we just created applied yet as part of the rules.

17
00:40.320 --> 00:44.800
So we can confirm that by doing a get IDS rules press enter,

18
00:44.800 --> 00:46.760
and currently there are no IDS rules.

19
00:46.760 --> 00:50.080
However, the moment we create a policy and rule

20
00:50.080 --> 00:51.760
and associate the profile with it,

21
00:51.760 --> 00:54.280
once we publish that out ESXIA,

22
00:54.280 --> 00:56.080
which is one of our host transport nodes,

23
00:56.080 --> 00:59.840
we'll have both a copy of that profile that's being used

24
00:59.840 --> 01:02.560
as well as the rule where that profile is being used.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:59.840 --> 01:02.560
as well as the rule where that profile is being used.

25
01:02.560 --> 01:04.000
So here at the NSX manager,

26
01:04.000 --> 01:06.320
we're gonna go to the security tab once again,

27
01:06.320 --> 01:08.240
on the left under policy management,

28
01:08.240 --> 01:11.920
we'll go down to IDS/IPS and malware prevention.

29
01:11.920 --> 01:12.920
And for our first example,

30
01:12.920 --> 01:16.120
we're gonna go ahead and use an IDS/IPS policy

31
01:16.120 --> 01:17.920
as part of our distributed firewall.

32
01:17.920 --> 01:20.840
So we're not gonna click, for example, on gateway rules,

33
01:20.840 --> 01:22.640
that'd be the policies and rules applied to individual

34
01:22.640 --> 01:24.320
gateways, we wanna go ahead and apply it

35
01:24.320 --> 01:25.360
to the distributed firewall.

36
01:25.360 --> 01:27.560
So we'll click right here on distributed rules,

37
01:27.560 --> 01:28.960
and then we have two categories.

38
01:28.960 --> 01:31.400
We have the emergency threat rules and threat rules,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.960 --> 01:31.400
We have the emergency threat rules and threat rules,

39
01:31.400 --> 01:34.000
they both have zero policies and rules in them.

40
01:34.000 --> 01:35.560
So we'll click here on threat rules

41
01:35.560 --> 01:37.240
and we'll click on add policy.

42
01:37.240 --> 01:39.120
And then we collapse the left-hand side.

43
01:39.120 --> 01:41.880
And it's just a reminder of where we're at in the interface

44
01:41.880 --> 01:44.560
under IDS/IPS and malware prevention.

45
01:44.560 --> 01:48.760
And let's name this policy our IDS-IPS policy.

46
01:48.760 --> 01:50.040
And then with it selected,

47
01:50.040 --> 01:52.120
we'll go ahead and click on add rule.

48
01:52.120 --> 01:53.200
And we'll call this first rule,

49
01:53.200 --> 01:55.680
use our profile rule 'cause that's what we're gonna do.

50
01:55.680 --> 01:58.720
So we can specify sources based on things

51
01:58.720 --> 02:00.440
we've done in the past, for example,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:58.720 --> 02:00.440
we've done in the past, for example,

52
02:00.440 --> 02:03.720
based on group membership or IP address and so forth.

53
02:03.720 --> 02:05.320
Same with destination.

54
02:05.320 --> 02:06.920
And for services, we could have this rule

55
02:06.920 --> 02:09.360
apply just to specific services we're looking for.

56
02:09.360 --> 02:11.640
I'm gonna leave this all set to any wide open.

57
02:11.640 --> 02:13.400
And then here under security profiles,

58
02:13.400 --> 02:14.680
we'll click on the pencil.

59
02:14.680 --> 02:17.320
And then here we'll specify the actual security profile

60
02:17.320 --> 02:18.160
we wanna use.

61
02:18.160 --> 02:21.400
So there's a tab for IDS/IPS profiles,

62
02:21.400 --> 02:22.880
one for malware prevention.

63
02:22.880 --> 02:25.600
We wanna use the IDS/IPS profile we just created.

64
02:25.600 --> 02:28.080
So we'll select that as a reminder of what it's doing.

65
02:28.080 --> 02:29.920
We can expand it and take a look

66
02:29.920 --> 02:31.560
at which signatures it's gonna be using,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.920 --> 02:31.560
at which signatures it's gonna be using,

67
02:31.560 --> 02:32.960
it's gonna be using all of them.

68
02:32.960 --> 02:34.400
So we'll click on apply.

69
02:34.400 --> 02:35.680
And then for the mode, we can go ahead

70
02:35.680 --> 02:38.520
and specify detect only or detect and prevent.

71
02:38.520 --> 02:41.280
And then to push this out, we'll click right here on publish.

72
02:41.280 --> 02:44.040
So this new rule as part of this new policy

73
02:44.040 --> 02:48.320
is part of our distributed firewall for IDS/IPS functionality.

74
02:48.320 --> 02:49.980
So that looks like it's all good to go.

75
02:49.980 --> 02:51.520
And we can also go to the CLI

76
02:51.520 --> 02:53.920
on one of our transport nodes just to verify

77
02:53.920 --> 02:57.280
that it now sees a profile and it also sees a rule.

78
02:57.280 --> 03:00.920
And that rule should show as rule number 8168
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:57.280 --> 03:00.920
And that rule should show as rule number 8168

79
03:00.920 --> 03:02.160
as reflected right here.

80
03:02.160 --> 03:05.520
So a moment ago, when we did this get IDS profile,

81
03:05.520 --> 03:06.360
it didn't have any.

82
03:06.360 --> 03:08.600
And now there is the profile that it's using.

83
03:08.600 --> 03:10.760
And the reason it has it is because it's using it

84
03:10.760 --> 03:15.900
as part of this rule 8168, which has the action of prevent.

85
03:15.900 --> 03:17.920
Also we went back and we changed this from detect

86
03:17.920 --> 03:20.960
and prevent to just detect only and published it out.

87
03:20.960 --> 03:24.240
And then went back to the CLI and then hit the up arrow key.

88
03:24.240 --> 03:25.760
It's now gonna show as detect.

89
03:25.760 --> 03:28.360
So either way, whether it's prevent or detect,

90
03:28.360 --> 03:30.920
we're gonna have the event show up inside
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:28.360 --> 03:30.920
we're gonna have the event show up inside

91
03:30.920 --> 03:33.640
of our monitoring for IDS/IPS traffic.

92
03:33.640 --> 03:35.080
So as we take a look at our checklist,

93
03:35.080 --> 03:36.680
we verified our depology,

94
03:36.680 --> 03:40.120
we verified our intrusion tools with N-Map and Metasploit.

95
03:40.120 --> 03:42.320
We created the profile, we use the profile

96
03:42.320 --> 03:43.920
as part of our distributed firewall.

97
03:43.920 --> 03:47.240
And for our next step, we get to test just to verify

98
03:47.240 --> 03:51.280
that the NSX IDS/IPS functionality is picking up

99
03:51.280 --> 03:53.280
and identifying on some of that traffic

100
03:53.280 --> 03:56.080
that looks a little bit suspicious from this VM

101
03:56.080 --> 03:58.200
that's going over to this VM right here.

102
03:58.200 --> 04:00.800
Now the cool thing also about the distributed firewall
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:58.200 --> 04:00.800
Now the cool thing also about the distributed firewall

103
04:00.800 --> 04:03.600
with IDS/IPS is that we don't have to be going

104
04:03.600 --> 04:05.560
through a gateway to get there.

105
04:05.560 --> 04:07.600
We could also be talking about traffic

106
04:07.600 --> 04:10.520
between one VM here on segment 10 and another one.

107
04:10.520 --> 04:12.960
And that's one of the beauties of a distributed firewall

108
04:12.960 --> 04:16.320
is the micro control we have between VMs.

109
04:16.320 --> 04:18.160
Whether or not they're actually going

110
04:18.160 --> 04:20.720
through a layer three router to communicate

111
04:20.720 --> 04:21.860
with the other device.

112
04:21.860 --> 04:31.860
[BLANK_AUDIO]