WEBVTT

1
00:00.000 --> 00:03.950
So the next segment profile we're going to take a look at is the MAC Discovery

2
00:03.950 --> 00:04.960
segment profile.

3
00:04.960 --> 00:08.660
And for the MAC Discovery segment profile, it does two primary things. Number

4
00:08.660 --> 00:09.920
one, if we specify

5
00:09.920 --> 00:14.620
it can be done, it allows the operator here on this VM and the guest OS to go

6
00:14.620 --> 00:15.840
ahead and change

7
00:15.840 --> 00:20.480
the MAC address. So the burned-in or logical original address, if we want to

8
00:20.480 --> 00:21.680
allow that to be changed,

9
00:21.680 --> 00:25.280
it's the MAC Discovery segment profile that's going to allow that change.

10
00:25.280 --> 00:29.130
And the second benefit of a segment profile is the ability to learn about

11
00:29.130 --> 00:30.720
additional MAC addresses
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:29.130 --> 00:30.720
additional MAC addresses

12
00:30.720 --> 00:34.680
other than the ones that were specified on the VM when it was put in place. So

13
00:34.680 --> 00:35.360
that way, if this

14
00:35.360 --> 00:39.140
VM has its own MAC address and maybe it's changed or maybe it hasn't, either

15
00:39.140 --> 00:39.840
way is great, if we

16
00:39.840 --> 00:42.630
allow it in the MAC Discovery segment profile. And if they're running

17
00:42.630 --> 00:43.760
additional services or

18
00:43.760 --> 00:47.800
anything else that needs a second or third or fourth MAC address that's going

19
00:47.800 --> 00:48.960
to be used as frames

20
00:48.960 --> 00:52.800
are being sent out into the segment by this VM, we'd want to specify in our MAC

21
00:52.800 --> 00:54.320
Discovery segment profiles

22
00:54.320 --> 00:57.680
that we want to go ahead and enable MAC learning. So again, the MAC Discovery

23
00:57.680 --> 00:58.720
segment profile

24
00:58.720 --> 01:02.090
is for allowing the guest OS to change the layer two address and also to have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:58.720 --> 01:02.090
is for allowing the guest OS to change the layer two address and also to have

25
01:02.090 --> 01:03.200
more than just one MAC

26
01:03.200 --> 01:07.270
address. So to demonstrate that, let's go ahead and move to a different segment

27
01:07.270 --> 01:08.400
. Let's go over here.

28
01:08.400 --> 01:13.100
I have a little Kali Linux box that we can put right here on segment 10. And

29
01:13.100 --> 01:13.680
then for our MAC

30
01:13.680 --> 01:17.880
Discovery segment profile, we'll be able to go ahead and control whether or not

31
01:17.880 --> 01:18.560
this VM through

32
01:18.560 --> 01:22.400
the guest OS is allowed to go ahead and change its MAC address and have it be

33
01:22.400 --> 01:23.760
used. So we might

34
01:23.760 --> 01:27.110
have a user that can change the MAC address, but it doesn't mean without the

35
01:27.110 --> 01:28.240
correct MAC Discovery

36
01:28.240 --> 01:32.420
segment profile that that traffic from that new layer two address is going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:28.240 --> 01:32.420
segment profile that that traffic from that new layer two address is going to

37
01:32.420 --> 01:33.200
be sent through the

38
01:33.200 --> 01:36.450
network. So let's begin by going to the vSphere environment and making sure

39
01:36.450 --> 01:37.360
this Kali Linux box

40
01:37.360 --> 01:41.440
is up and running and that it's on segment 10. All right, so here is Kali 10.

41
01:41.440 --> 01:42.240
Let's right click

42
01:42.240 --> 01:46.380
and click on edit settings. And we want to put this on the blue segment 10. So

43
01:46.380 --> 01:47.120
for its network

44
01:47.120 --> 01:50.880
interface card is currently on green segment 10. We'll click on browse and let

45
01:50.880 --> 01:52.240
's go to blue segment 10

46
01:52.240 --> 01:56.880
right there, select it, click on OK, click on OK again. And then we'll go ahead

47
01:56.880 --> 01:58.320
and power that up.

48
01:58.320 --> 02:02.880
And while that's powering up, let's take a look at blue segment 10 and the MAC
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:58.320 --> 02:02.880
And while that's powering up, let's take a look at blue segment 10 and the MAC

49
02:02.880 --> 02:03.680
Discovery segment

50
02:03.680 --> 02:07.580
profile associated with it. So to do that, we're going to go back over to the

51
02:07.580 --> 02:08.400
NSX manager. We'll

52
02:08.400 --> 02:12.210
click on networking. We'll go ahead and select segments on the left. And then

53
02:12.210 --> 02:13.040
we'll take a look

54
02:13.040 --> 02:16.810
at our blue segment 10, which is right here blue segment 10. Let's just expand

55
02:16.810 --> 02:18.000
that and scroll down

56
02:18.000 --> 02:22.590
and take a look at the segment profiles there. So by default, we have this

57
02:22.590 --> 02:24.080
default MAC Discovery

58
02:24.080 --> 02:27.950
segment profile assigned. And to take a look at that, we can either go to

59
02:27.950 --> 02:29.280
profiles and take a look

60
02:29.280 --> 02:32.920
at it here or we could go back to the segment itself and click on the three
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:29.280 --> 02:32.920
at it here or we could go back to the segment itself and click on the three

61
02:32.920 --> 02:33.760
dots to edit the

62
02:33.760 --> 02:38.580
blue segment 10 and then scroll down here and expand segment profiles. And then

63
02:38.580 --> 02:39.280
here for the MAC

64
02:39.280 --> 02:43.240
Discovery profile, we can click on the three dots and then simply click on view

65
02:43.240 --> 02:44.000
right here.

66
02:44.000 --> 02:48.520
So here in the default MAC Discovery profile, they have by default MAC changes

67
02:48.520 --> 02:49.120
enabled.

68
02:49.120 --> 02:52.960
And for MAC Discovery, it's disabled, meaning that the client can't have more

69
02:52.960 --> 02:53.840
than one MAC

70
02:53.840 --> 02:57.780
address associated with that VM because the segment profile is not learning

71
02:57.780 --> 02:58.720
about any additional

72
02:58.720 --> 03:02.190
MAC addresses. So here's what I propose we do. Let's test this first and verify
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:58.720 --> 03:02.190
MAC addresses. So here's what I propose we do. Let's test this first and verify

73
03:02.190 --> 03:03.600
that the user

74
03:03.600 --> 03:07.700
and the guest OS can change their layer two address and verify that it works.

75
03:07.700 --> 03:08.240
And then what we'll do

76
03:08.240 --> 03:11.650
is we'll go in and create a new MAC Discovery segment profile that doesn't

77
03:11.650 --> 03:12.800
allow a MAC change,

78
03:12.800 --> 03:17.190
apply that, and then compare and contrast the results. So to test this, let me

79
03:17.190 --> 03:17.920
bring in that

80
03:17.920 --> 03:22.530
little Kali Linux box. This is Kali 10, I'm logged in as root. And we should be

81
03:22.530 --> 03:23.200
able to change

82
03:23.200 --> 03:27.510
the MAC address. Let's verify what our current MAC address is with an IF config

83
03:27.510 --> 03:29.120
for Ethernet 0.

84
03:29.120 --> 03:34.160
And our current MAC address is ending in F754. Let's also verify our current
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:29.120 --> 03:34.160
And our current MAC address is ending in F754. Let's also verify our current

85
03:34.160 --> 03:34.800
connectivity out to

86
03:34.800 --> 03:39.840
the internet with a ping out to www.google.com. And that seems to be working

87
03:39.840 --> 03:41.040
great DNS and

88
03:41.040 --> 03:44.730
internet connectivity. And let's use utility called MAC Changer. So I'm going

89
03:44.730 --> 03:45.360
to type in MAC

90
03:45.360 --> 03:49.720
Changer -h for help. So if we want to set up a random layer two address for

91
03:49.720 --> 03:51.200
Ethernet 0, we use the

92
03:51.200 --> 03:56.690
up arrow key and change that h to an r for random MAC address. And then type in

93
03:56.690 --> 03:57.840
eth 0 referring to

94
03:57.840 --> 04:02.100
the ether interface and press enter. So that was the previous address ending in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:57.840 --> 04:02.100
the ether interface and press enter. So that was the previous address ending in

95
04:02.100 --> 04:03.200
F754. And now we

96
04:03.200 --> 04:06.610
have a new one ending in 8288. So now if we had the up arrow key a few times

97
04:06.610 --> 04:07.600
and tried it at ping

98
04:07.600 --> 04:12.220
Google.com, no problem at all. We changed our layer two to us. And the MAC

99
04:12.220 --> 04:13.280
discovery profile is

100
04:13.280 --> 04:17.090
allowing that no problem whatsoever. So I'll do a control C there. Let's go

101
04:17.090 --> 04:18.160
back to the NSX

102
04:18.160 --> 04:22.120
manager. We'll close that. And we're still in edit mode for the blue segment 10

103
04:22.120 --> 04:22.880
right here. So let's

104
04:22.880 --> 04:27.460
go down to the segment profiles. And then for the MAC discovery, let's go ahead

105
04:27.460 --> 04:29.120
and choose a non-default

106
04:29.120 --> 04:32.620
one. So to do that, we're going to go ahead and create a new MAC discovery
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
04:29.120 --> 04:32.620
one. So to do that, we're going to go ahead and create a new MAC discovery

107
04:32.620 --> 04:33.600
profile by clicking

108
04:33.600 --> 04:36.810
and create new. Let's call this our MAC discovery profile. And we're going to

109
04:36.810 --> 04:37.680
specify that MAC

110
04:37.680 --> 04:42.620
changes are not enabled. So we'll click on save and then click on save again,

111
04:42.620 --> 04:43.600
then go ahead and

112
04:43.600 --> 04:46.900
click on close editing. Then I'm going to open up that segment detail one more

113
04:46.900 --> 04:47.920
time, just to verify

114
04:47.920 --> 04:51.610
that it took so MAC discovery, we're using our MAC discovery profile. Fantastic

115
04:51.610 --> 04:52.400
. And for that

116
04:52.400 --> 04:55.640
segment, if we collapse this and we scroll to the right a little bit, if we

117
04:55.640 --> 04:56.880
click here on the port

118
04:56.880 --> 05:00.060
slash interfaces, that gives us an opportunity to confirm the VMs that are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
04:56.880 --> 05:00.060
slash interfaces, that gives us an opportunity to confirm the VMs that are

119
05:00.060 --> 05:01.040
connected and also if

120
05:01.040 --> 05:05.410
we scroll down details regarding which segment port profiles are using. And

121
05:05.410 --> 05:06.320
this VM is inheriting

122
05:06.320 --> 05:09.790
them from the segment profile on the segment itself, including our MAC

123
05:09.790 --> 05:11.120
discovery profile. All

124
05:11.120 --> 05:14.640
right, sounds great. So we'll close that and let's bring back our VM. So as a

125
05:14.640 --> 05:15.680
fair test for this VM,

126
05:15.680 --> 05:19.130
I'm going to set the MAC address back to its original one. So let me go ahead

127
05:19.130 --> 05:20.160
and do a MAC

128
05:20.160 --> 05:23.730
changer dash H. And I'm going to use the dash P option to set it back to its

129
05:23.730 --> 05:24.960
original MAC address.

130
05:24.960 --> 05:28.270
So we'll hit the up here key a few times. And instead of dash R, we'll do a

131
05:28.270 --> 05:30.240
dash P, press enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
05:28.270 --> 05:30.240
dash P, press enter.

132
05:30.240 --> 05:34.480
And let's go ahead and try to ping out to Google.com. And that's working no

133
05:34.480 --> 05:35.200
problems. We'll do a

134
05:35.200 --> 05:38.620
control C. However, now if we try to change the MAC address, so I'll go ahead

135
05:38.620 --> 05:39.680
and use the dash R

136
05:39.680 --> 05:43.480
option again to change the MAC address for Ethernet zero. So there was the

137
05:43.480 --> 05:44.800
original MAC address. Now

138
05:44.800 --> 05:48.320
it's the one ending in D 025. However, now because we have a MAC discovery

139
05:48.320 --> 05:49.440
segment profile that says

140
05:49.440 --> 05:53.430
nope, not allowed changing layer two addresses at the client. Any traffic that

141
05:53.430 --> 05:54.720
we now try to send in

142
05:54.720 --> 05:59.120
from this new layer to source MAC address should not be allowed at the segment.

143
05:59.120 --> 05:59.520
And we can also

144
05:59.520 --> 06:03.800
confirm with I have config that indeed we have that layer to address. So now if
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:59.520 --> 06:03.800
confirm with I have config that indeed we have that layer to address. So now if

145
06:03.800 --> 06:05.040
we try to do a ping

146
06:05.040 --> 06:09.520
or any other traffic for that matter out to the rest of the world, we are being

147
06:09.520 --> 06:10.400
dropped right at

148
06:10.400 --> 06:14.080
the segment because we are not allowed to change our layer to address. So hit

149
06:14.080 --> 06:14.720
the up here key a

150
06:14.720 --> 06:18.790
few times. And we did the dash P, which is to restore it back to its original

151
06:18.790 --> 06:19.920
address. So now it's

152
06:19.920 --> 06:23.040
back to its original address. And then we try to ping now, no problem

153
06:23.040 --> 06:24.560
whatsoever. So I'll stop that

154
06:24.560 --> 06:28.330
ping. And as part of that profile is attached right here, if we needed our VMs

155
06:28.330 --> 06:29.600
to be able to use more

156
06:29.600 --> 06:33.310
than just one or two MAC addresses, we could edit the profile so we could click
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
06:29.600 --> 06:33.310
than just one or two MAC addresses, we could edit the profile so we could click

157
06:33.310 --> 06:34.800
here on profiles or

158
06:34.800 --> 06:38.480
just go to where that profile is applied. So here for blue segment 10, if we

159
06:38.480 --> 06:39.520
edit the segment and

160
06:39.520 --> 06:43.530
click on edit here and then go down and expand the segment profiles. And then

161
06:43.530 --> 06:44.560
for MAC discovery,

162
06:44.560 --> 06:47.320
we can go ahead and edit this one right here by clicking on the three dots and

163
06:47.320 --> 06:48.320
clicking on edit.

164
06:48.320 --> 06:51.980
So here if we want to allow MAC changes, we'll go ahead and choose that option

165
06:51.980 --> 06:52.720
there. If we want

166
06:52.720 --> 06:55.670
to have multiple MAC addresses allowed, we can go ahead and use the MAC

167
06:55.670 --> 06:56.480
learning and then we can

168
06:56.480 --> 06:59.910
set up our limit. So I'm going to leave it in this state where we're allowing a

169
06:59.910 --> 07:00.640
change and we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
06:59.910 --> 07:00.640
change and we're

170
07:00.640 --> 07:04.120
allowing more than just one MAC address to be used by a VM. And that'll be

171
07:04.120 --> 07:05.200
allowed by using this

172
07:05.200 --> 07:09.100
option right here of MAC learning. And we'll click on save and save and we'll

173
07:09.100 --> 07:10.640
click on close editing

174
07:10.640 --> 07:14.510
and just to confirm, let's bring back our client. So a moment ago, when we

175
07:14.510 --> 07:15.680
changed the MAC address,

176
07:15.680 --> 07:19.070
I'll go ahead and do a change with the dash R. Now we have a different MAC

177
07:19.070 --> 07:20.160
address. Now we're

178
07:20.160 --> 07:23.440
still able to go out to the internet and forward traffic because we're allowing

179
07:23.440 --> 07:24.640
changes. And if

180
07:24.640 --> 07:29.360
this VM had more than just a single MAC address, that would be allowed as well.