WEBVTT

1
00:00.000 --> 00:03.720
So for our next segment profile, we're going to take a look at spoof guard and

2
00:03.720 --> 00:07.550
spoof guard is all about preventing the guest OS for example on a VM right here

3
00:07.550 --> 00:11.180
from changing the IP address to some other IP address and having that IP

4
00:11.180 --> 00:14.000
address being able to used by this VM.

5
00:14.000 --> 00:18.200
So if this client was given the IP address ending in dot 185 through D HCP

6
00:18.200 --> 00:19.000
services.

7
00:19.000 --> 00:23.240
And later the user on this VM with the guest OS tries to change that to like

8
00:23.240 --> 00:28.260
186 or some other IP address that wasn't discovered and associate with this VM

9
00:28.260 --> 00:33.000
spoof guard is not going to permit any traffic without source IP address coming
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:28.260 --> 00:33.000
spoof guard is not going to permit any traffic without source IP address coming

10
00:33.000 --> 00:33.000
in from this VM,

11
00:33.000 --> 00:36.000
because it's not the one that that VM should be using.

12
00:36.000 --> 00:40.100
So the goal of spoof guard is to prevent VMS from lying about their source IP

13
00:40.100 --> 00:43.000
address as they send traffic into the network.

14
00:43.000 --> 00:47.000
So in this video, I'd like to go ahead and create our own customized spoof

15
00:47.000 --> 00:51.430
guard segment profile, apply it to the segment and then verify the results on

16
00:51.430 --> 00:52.000
this VM.

17
00:52.000 --> 00:56.690
So currently I've got Kelly 10, this little VM right here, and I just moved it

18
00:56.690 --> 00:59.000
over to this segment right here segment 10 non VRF.

19
00:59.000 --> 01:02.000
So let's bring in that little VM and just verify basic connectivity.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:59.000 --> 01:02.000
So let's bring in that little VM and just verify basic connectivity.

20
01:02.000 --> 01:05.000
So we'll bring in that little client will go to command prompt.

21
01:05.000 --> 01:11.000
And from here, let's do a ping out to www.google.com that works great.

22
01:11.000 --> 01:14.000
Fantastic that verifies DNS verifies internet connectivity.

23
01:14.000 --> 01:18.060
And let's also do an IF config for ethernet zero just to verify its IP address

24
01:18.060 --> 01:20.000
as 10 10 0 184.

25
01:20.000 --> 01:25.000
So here in the NSX manager, if we go to that segment segment 10 right there,

26
01:25.000 --> 01:27.900
and we scroll to the right a little bit if we click on this link here under

27
01:27.900 --> 01:31.510
port slash interfaces, it'll show us the details for that Kali Linux box if we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:27.900 --> 01:31.510
port slash interfaces, it'll show us the details for that Kali Linux box if we

28
01:31.510 --> 01:33.000
expand it and scroll down.

29
01:33.000 --> 01:36.580
It's also going to confirm for us the segment profiles that are currently in

30
01:36.580 --> 01:37.000
use.

31
01:37.000 --> 01:41.000
Now this segment is using all the defaults, including the spoof guard default.

32
01:41.000 --> 01:44.000
So let's go ahead and create a new profile click on close here.

33
01:44.000 --> 01:48.090
So still here in networking and with segment selected, let's click on the sub

34
01:48.090 --> 01:52.000
tab for profiles and let's create a new spoof guard profile.

35
01:52.000 --> 01:55.880
So we'll click right here and add segment profile from the drop down will

36
01:55.880 --> 01:57.000
choose spoof guard.

37
01:57.000 --> 02:01.190
And then for the spoof guard profile will go ahead and enable port bindings and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:57.000 --> 02:01.190
And then for the spoof guard profile will go ahead and enable port bindings and

38
02:01.190 --> 02:02.000
click on save.

39
02:02.000 --> 02:06.170
And then the last step will lead to apply this spoof guard profile to our

40
02:06.170 --> 02:07.000
segment.

41
02:07.000 --> 02:11.030
So under segments, we'll click here here in NSX, we'll go down to our seg 10

42
02:11.030 --> 02:14.690
non VRF will click on the three dots will click on edit and then scroll down

43
02:14.690 --> 02:17.000
and here will expand segment profiles.

44
02:17.000 --> 02:20.770
And for the spoof guard will use the drop down and simply choose our spoof

45
02:20.770 --> 02:24.000
guard and click on save and we'll click on close editing.

46
02:24.000 --> 02:27.000
And now that we've applied that profile, let's bring back our client.

47
02:27.000 --> 02:30.500
So here's our client and the social verify internet connectivity that still
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:27.000 --> 02:30.500
So here's our client and the social verify internet connectivity that still

48
02:30.500 --> 02:31.000
works.

49
02:31.000 --> 02:36.700
But if we were to change the IP address, for example, to 185 or 186 because

50
02:36.700 --> 02:38.000
spoof guard is in place, that traffic won't be allowed.

51
02:38.000 --> 02:43.440
So let's change the IP address with pseudo I have config for ethernet zero and

52
02:43.440 --> 02:49.000
let's specify 10 dot 10 dot 0 dot 185 with a 24 bit mask and press enter.

53
02:49.000 --> 02:52.000
I'll go ahead and authenticate and we are good to go.

54
02:52.000 --> 02:55.560
So now if we do an I have config for ethernet zero, there's our new IP address

55
02:55.560 --> 02:57.000
ending in dot 185.

56
02:57.000 --> 03:00.000
And then we tried internet connectivity again. That's not going to fly.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
03:00.000 --> 03:04.000
We could also try to ping an IP address like 888 and that's not going to fly.

58
03:04.000 --> 03:08.780
We could try to ping our default gateway of 10 dot 10 dot 0 dot 1 and that's

59
03:08.780 --> 03:10.000
not going to fly.

60
03:10.000 --> 03:13.480
However, if we put the IP address back to where it was, so do the I have config

61
03:13.480 --> 03:14.000
again.

62
03:14.000 --> 03:19.000
And let's set it to 184. Now we try to ping our default gateway no problem.

63
03:19.000 --> 03:22.250
If we try to ping the internet, no problem, and we can do that with her without

64
03:22.250 --> 03:26.300
name resolution because we now have internet connectivity out to our DNS server

65
03:26.300 --> 03:27.000
as well.

66
03:27.000 --> 03:31.380
So now that we have the IP address that's expected for us from this VM, it's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:27.000 --> 03:31.380
So now that we have the IP address that's expected for us from this VM, it's

67
03:31.380 --> 03:34.000
once again allowing that traffic to flow over the network.