WEBVTT

1
00:00.000 --> 00:03.700
So for this last piece, it's going to look very similar to the distributed

2
00:03.700 --> 00:04.320
firewall with

3
00:04.320 --> 00:08.610
ID/IPS, but instead of going to the tab for distributed, we're going to go to

4
00:08.610 --> 00:09.240
the tab for

5
00:09.240 --> 00:10.240
gateway.

6
00:10.240 --> 00:13.740
And we'll specify that we want the ID/IPS policy in the specified rule as part

7
00:13.740 --> 00:14.160
of that

8
00:14.160 --> 00:17.000
policy applied just here to gateway.

9
00:17.000 --> 00:22.150
So here in the NSX manager, we'll once again go to security and we'll go to our

10
00:22.150 --> 00:22.760
policy

11
00:22.760 --> 00:24.320
management with ID/IPS.

12
00:24.320 --> 00:28.700
And I'm going to take this policy that we just created and let's go ahead and

13
00:28.700 --> 00:29.320
disable

14
00:29.320 --> 00:30.320
all rules.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.320 --> 00:30.320
all rules.

15
00:30.320 --> 00:33.400
Once we publish this, there's no rules that are currently enabled on the

16
00:33.400 --> 00:34.800
distributed firewall

17
00:34.800 --> 00:36.880
regarding ID/IPS.

18
00:36.880 --> 00:40.880
So still here with security on the top selected, on the left ID/IPS over here

19
00:40.880 --> 00:42.000
selected, we're

20
00:42.000 --> 00:45.970
going to click on profiles just to confirm we still have our profile here

21
00:45.970 --> 00:48.200
called our ID/IPS.

22
00:48.200 --> 00:50.630
And now we're going to use that, but instead of using it as part of our

23
00:50.630 --> 00:51.800
distributed firewall,

24
00:51.800 --> 00:54.520
we'll apply it specifically just to gateway A.

25
00:54.520 --> 00:57.250
So to do that, we're going to click here on gateway rules as opposed to

26
00:57.250 --> 00:57.880
distributed

27
00:57.880 --> 00:58.880
rules.

28
00:58.880 --> 01:00.880
And here it's warning us that we don't have it enabled.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.880 --> 01:00.880
And here it's warning us that we don't have it enabled.

29
01:00.880 --> 01:05.180
So if we click here on settings, so on the left, we have ID/IPS selected on the

30
01:05.180 --> 01:05.680
sub tab

31
01:05.680 --> 01:09.000
here under ID/IPS, we are clicking on settings.

32
01:09.000 --> 01:12.190
And then as we scroll down, here's where we now have the opportunity to go

33
01:12.190 --> 01:12.720
ahead and

34
01:12.720 --> 01:17.160
specify for the distributed ID/IPS to enable it, which we did earlier.

35
01:17.160 --> 01:19.880
And now we can also enable it for our gateways.

36
01:19.880 --> 01:24.550
That's the key word there to enable the ID/IPS functionality on a specific

37
01:24.550 --> 01:25.320
gateway.

38
01:25.320 --> 01:30.110
So based on our plan, if we want to enable the ID/IPS policy on gateway A, we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:25.320 --> 01:30.110
So based on our plan, if we want to enable the ID/IPS policy on gateway A, we

39
01:30.110 --> 01:30.480
need to

40
01:30.480 --> 01:33.160
at least enable it here for gateway A.

41
01:33.160 --> 01:34.320
So I'll click that slider there.

42
01:34.320 --> 01:35.480
We'll click on yes.

43
01:35.480 --> 01:39.200
And also while we're at it, I'll also go ahead and enable it for gateway B in

44
01:39.200 --> 01:39.760
the event

45
01:39.760 --> 01:44.440
that we want to do the ID/IPS on gateway B at some point as well.

46
01:44.440 --> 01:46.840
So now here we have the gateways enabled.

47
01:46.840 --> 01:50.810
And up here, we also have this cluster for distributed firewall services for ID

48
01:50.810 --> 01:52.280
/IPS enabled.

49
01:52.280 --> 01:53.800
So we click on refresh.

50
01:53.800 --> 01:56.560
Just to confirm our settings, those all look good.

51
01:56.560 --> 01:59.680
So now we can go back to our gateway rules right here.

52
01:59.680 --> 02:02.210
And for our gateway rules, we'll go ahead and choose the tier one gateway that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.680 --> 02:02.210
And for our gateway rules, we'll go ahead and choose the tier one gateway that

53
02:02.210 --> 02:02.520
we want

54
02:02.520 --> 02:03.520
to apply this to.

55
02:03.520 --> 02:06.680
So we'll go ahead to our gateway A and we'll click add policy.

56
02:06.680 --> 02:10.280
Let me collapse the left hand side to give us a little bit more room.

57
02:10.280 --> 02:15.240
And for this policy, let's call it IDS on gateway -a.

58
02:15.240 --> 02:17.880
And then in this policy, we'll create one rule.

59
02:17.880 --> 02:21.760
And for this rule, we'll say use our profile.

60
02:21.760 --> 02:25.190
And that's going to refer to our ID/IPS profile, which we will select right

61
02:25.190 --> 02:25.680
here.

62
02:25.680 --> 02:28.400
So we'll click on the pencil and the column for security profiles.

63
02:28.400 --> 02:33.040
And we'll select once again our IDS-IPS profile we created earlier, click on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:28.400 --> 02:33.040
And we'll select once again our IDS-IPS profile we created earlier, click on

64
02:33.040 --> 02:33.680
apply.

65
02:33.680 --> 02:37.000
And then specify here under mode, which mode we want.

66
02:37.000 --> 02:41.190
Do we want IDS only, which is detect only, or do we want IPS, which is detect

67
02:41.190 --> 02:42.080
and prevent?

68
02:42.080 --> 02:45.840
And again, initially, we probably want to do detection only, see what actually

69
02:45.840 --> 02:46.400
gets hit

70
02:46.400 --> 02:50.810
and matched on, and then tune our profiles and then move into a mode where we

71
02:50.810 --> 02:51.400
can start

72
02:51.400 --> 02:52.760
doing prevention as well.

73
02:52.760 --> 02:54.960
So I'm going to leave this as detect only for here.

74
02:54.960 --> 02:58.360
We'll click on publish, we'll make sure it is completely pushed out.

75
02:58.360 --> 03:00.520
We'll click here on refresh, that looks good.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:58.360 --> 03:00.520
We'll click here on refresh, that looks good.

76
03:00.520 --> 03:03.880
So now that we have the IDS/IPS implemented at a gateway.

77
03:03.880 --> 03:06.280
And I've also sent some more traffic through the network.

78
03:06.280 --> 03:10.560
We can view that by going here under security and security overview.

79
03:10.560 --> 03:14.060
And then here under threat event monitoring, click here on IDS/IPS and our

80
03:14.060 --> 03:15.240
counts have increased.

81
03:15.240 --> 03:18.720
So if we want to see the ones that were just from the distributed only, which

82
03:18.720 --> 03:19.640
were earlier,

83
03:19.640 --> 03:22.590
we click on here, if we want to see the ones that were related to just the

84
03:22.590 --> 03:23.200
gateway based

85
03:23.200 --> 03:25.360
IDS/IPS, we click here.

86
03:25.360 --> 03:28.300
And then furthermore, we could go ahead and click here and now take us down

87
03:28.300 --> 03:29.000
under threat

88
03:29.000 --> 03:34.420
event monitoring, IPS/IDS with the gateway only option selected right here as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:29.000 --> 03:34.420
event monitoring, IPS/IDS with the gateway only option selected right here as

89
03:34.420 --> 03:35.080
well.

90
03:35.080 --> 03:38.060
Or if we wanted to switch that back, we could just use the dropdown, say look

91
03:38.060 --> 03:38.800
at all traffic.

92
03:38.800 --> 03:43.600
And that would include the IDS/IPS on the distributed firewall, as well as the

93
03:43.600 --> 03:44.240
IDS/IPS

94
03:44.240 --> 03:45.760
applied to the gateway.

95
03:45.760 --> 03:48.470
So once again, if we want to see the gateway based traffic only, we see it

96
03:48.470 --> 03:49.080
right here.

97
03:49.080 --> 03:52.680
Then we can hover over here, see more details and also down below it has more

98
03:52.680 --> 03:53.280
details as

99
03:53.280 --> 03:54.280
well.

100
03:54.280 --> 03:58.970
So now as part of our plan, we've also walked through the process of using IDS/

101
03:58.970 --> 03:59.720
IPS, but instead

102
03:59.720 --> 04:02.930
of applying it as part of a distributed firewall function, we're now applying
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:59.720 --> 04:02.930
of applying it as part of a distributed firewall function, we're now applying

103
04:02.930 --> 04:03.760
it here to gateway

104
04:03.760 --> 04:03.920
A.

105
04:03.920 --> 04:13.920
[BLANK_AUDIO]