WEBVTT

1
00:00.000 --> 00:03.360
Another type of segment profile we have is the security segment.

2
00:03.360 --> 00:07.440
And we had to tweak this several skills ago as we were working with DHCP

3
00:07.440 --> 00:08.000
services,

4
00:08.000 --> 00:11.920
because by default, if we have an external DHCP server,

5
00:11.920 --> 00:16.000
that's not part of the NSX environment, and it's feeding in DHCP server

6
00:16.000 --> 00:16.640
messages,

7
00:16.640 --> 00:21.200
like offers and acknowledgments, and the client would be doing the discover and

8
00:21.200 --> 00:21.840
the request.

9
00:21.840 --> 00:25.520
So there's the door process right there, one, two, three, four.

10
00:25.520 --> 00:28.160
The default behavior with the default security segment says,

11
00:28.160 --> 00:32.250
"You know what? Any server messages which would include offers and acknowled
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:28.160 --> 00:32.250
"You know what? Any server messages which would include offers and acknowled

12
00:32.250 --> 00:32.480
gments

13
00:32.480 --> 00:35.920
based on the ports involved for DHCP servers, those are going to be blocked if

14
00:35.920 --> 00:36.320
they're trying

15
00:36.320 --> 00:40.720
to come into the network from a VM. Does that be a VM here or here or here or

16
00:40.720 --> 00:41.200
here?

17
00:41.200 --> 00:44.480
Anywhere. Because of the default security segment, security profile,

18
00:44.480 --> 00:48.480
that's denying any DHCP server-based messages. And that's a great thing to

19
00:48.480 --> 00:49.840
prevent accidentally

20
00:49.840 --> 00:54.480
or intentionally somebody from trying to inject or pretend to be a rogue DHCP

21
00:54.480 --> 00:55.040
server

22
00:55.040 --> 00:58.720
handing out incorrect information." So as we take a look at the options

23
00:58.720 --> 01:00.320
involved in a security segment,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:58.720 --> 01:00.320
involved in a security segment,

24
01:00.320 --> 01:05.110
one of them is to protect against erroneous DHCP server type messages coming in

25
01:05.110 --> 01:05.360
.

26
01:05.360 --> 01:09.920
We can also filter based on STP messages, specifically BPDU filtering,

27
01:09.920 --> 01:13.570
because at the end of the day, most of our VMs down here have absolutely no

28
01:13.570 --> 01:14.800
need to see any

29
01:14.800 --> 01:19.630
BPDUs as a result of spanning tree trying to not have a loop. We also have, as

30
01:19.630 --> 01:20.320
part of our security

31
01:20.320 --> 01:25.680
segment profiles, the options of doing RA Guard. And RA Guard is a really

32
01:25.680 --> 01:26.400
important feature because

33
01:26.400 --> 01:31.840
if we're using IP version 6 and we have some VMs down here, we don't want these
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:26.400 --> 01:31.840
if we're using IP version 6 and we have some VMs down here, we don't want these

34
01:31.840 --> 01:33.040
VMs advertising

35
01:33.040 --> 01:37.070
as a router would router advertisements. Because just like we don't want this

36
01:37.070 --> 01:37.840
VM to pretend it's

37
01:37.840 --> 01:42.920
a DHCP server and mess up our networking, we also don't want this VM to offer

38
01:42.920 --> 01:44.240
router advertisements

39
01:44.240 --> 01:48.600
to again influence our network from an IPv6 perspective regarding having a

40
01:48.600 --> 01:49.760
router available,

41
01:49.760 --> 01:53.440
especially if it's this VM, which is not the correct router for the segment.

42
01:53.440 --> 01:56.880
So for this demonstration of using a security segment segment profile,

43
01:56.880 --> 02:01.630
let's go ahead and use this segment right here. And we'll use a Kali Linux box.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:56.880 --> 02:01.630
let's go ahead and use this segment right here. And we'll use a Kali Linux box.

44
02:01.630 --> 02:02.880
We'll use Kali 10.

45
02:02.880 --> 02:06.800
Let's also use a Mint Linux box right here, and that'll be Mint 10.

46
02:06.800 --> 02:09.520
And to demonstrate the benefit of this, I'd like to first of all create a

47
02:09.520 --> 02:11.120
security segment profile

48
02:11.120 --> 02:16.710
that will allow DHCP server messages to come in from the segment and from the V

49
02:16.710 --> 02:17.920
Ms on that segment.

50
02:17.920 --> 02:22.400
Then we can demonstrate how an attacker could very easily advertise and act as

51
02:22.400 --> 02:23.360
a rogue DHCP

52
02:23.360 --> 02:27.120
server for other devices on the network segment. And then once we verify that

53
02:27.120 --> 02:27.840
we'll change it up

54
02:27.840 --> 02:32.140
by applying a security segment that's denying DHCP server messages coming in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:27.840 --> 02:32.140
by applying a security segment that's denying DHCP server messages coming in

55
02:32.140 --> 02:33.440
from any VMs here.

56
02:33.440 --> 02:37.170
And at that point, with them being filtered here and not being allowed in, this

57
02:37.170 --> 02:38.240
Kali Linux box won't

58
02:38.240 --> 02:43.060
be able to pretend or influence the network or become a rogue DHCP server that

59
02:43.060 --> 02:43.440
clients are

60
02:43.440 --> 02:46.800
getting IP addresses from. So here on the vSphere client, let's make sure both

61
02:46.800 --> 02:47.680
those VMs are on the

62
02:47.680 --> 02:52.340
right segment. We'll right click on Kali 10. We'll click on edit settings and

63
02:52.340 --> 02:53.200
go down to its network

64
02:53.200 --> 02:56.440
card. And it's on segment 10, non-VRF. That's fantastic. And then we'll take a

65
02:56.440 --> 02:57.200
look at Mint 10.

66
02:57.200 --> 03:00.850
And this shows us that it's on segment 10 for green. Let's go ahead and change
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:57.200 --> 03:00.850
And this shows us that it's on segment 10 for green. Let's go ahead and change

67
03:00.850 --> 03:01.760
that by right

68
03:01.760 --> 03:05.410
clicking on Mint 10, clicking on edit settings. And we'll put that on the right

69
03:05.410 --> 03:06.320
segment along with

70
03:06.320 --> 03:10.210
the Kali Linux box. So for networked after we'll click on browse, and let's put

71
03:10.210 --> 03:10.960
on segment 10,

72
03:10.960 --> 03:15.460
non-VRF, and click on OK. All right, that looks good. We'll click on OK. And

73
03:15.460 --> 03:16.320
let me power on

74
03:16.320 --> 03:20.770
Kali 10 right now. And then we'll power on Mint 10 here in a moment. Next, let

75
03:20.770 --> 03:21.520
's head over to the

76
03:21.520 --> 03:26.730
NSX manager. And let's create a security segment profile that's permitting DHCP

77
03:26.730 --> 03:28.000
server traffic.

78
03:28.000 --> 03:32.180
So here in the NSX manager, we'll click on the networking tab. On the left, we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
03:28.000 --> 03:32.180
So here in the NSX manager, we'll click on the networking tab. On the left, we

79
03:32.180 --> 03:33.200
'll click on segments

80
03:33.200 --> 03:37.280
under connectivity. And then let's go ahead under the sub tab of profiles right

81
03:37.280 --> 03:38.240
here. And let's

82
03:38.240 --> 03:43.020
create our own security segment profile. So with profile selected here and

83
03:43.020 --> 03:44.400
segment profile selected

84
03:44.400 --> 03:49.390
down below, let's click on add segment profile. And we want a segment security

85
03:49.390 --> 03:50.080
segment profile.

86
03:50.080 --> 03:54.280
So we'll select that. And let's call it our sec, sec profile. And then in this

87
03:54.280 --> 03:55.040
profile, let's go

88
03:55.040 --> 04:01.600
ahead and not disable DHCP server messages. Let's not disable any BPDUs. And we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:55.040 --> 04:01.600
ahead and not disable DHCP server messages. Let's not disable any BPDUs. And we

89
04:01.600 --> 04:02.800
're not using IPV6.

90
04:02.800 --> 04:06.620
So our a guard being enabled won't matter at all. So effectively, for our

91
04:06.620 --> 04:07.360
purposes, I wanted to

92
04:07.360 --> 04:11.910
make sure that in our security profile, we are allowing DHCP server messages,

93
04:11.910 --> 04:13.440
which by default,

94
04:13.440 --> 04:16.890
in the default profile, that is not allowed. And again, that's a good thing in

95
04:16.890 --> 04:17.360
a production

96
04:17.360 --> 04:21.020
environment, because we don't want rogue VMs pretending to be DHCP servers. But

97
04:21.020 --> 04:22.000
for the demo,

98
04:22.000 --> 04:25.320
I'd like to make sure initially that we're not blocking that with the segment

99
04:25.320 --> 04:26.240
profile. So we'll

100
04:26.240 --> 04:30.760
click on save. And now the segment profile saved, let's apply it to our segment
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
04:26.240 --> 04:30.760
click on save. And now the segment profile saved, let's apply it to our segment

101
04:30.760 --> 04:32.080
10. So still here

102
04:32.080 --> 04:36.060
under the networking tab with segment selected, we'll click on the sub tab of

103
04:36.060 --> 04:38.000
NSX under segments.

104
04:38.000 --> 04:42.080
And let's go to our segment 10 non VRF. We'll edit it by clicking on the three

105
04:42.080 --> 04:43.280
dots clicking on edit.

106
04:43.440 --> 04:47.530
And then scrolling down and then expanding segment profiles. And then here for

107
04:47.530 --> 04:48.880
our security segment,

108
04:48.880 --> 04:52.520
we'll use the drop down. And we'll choose the security segment profile we just

109
04:52.520 --> 04:53.440
created and click

110
04:53.440 --> 04:57.020
on safe. And then we'll go ahead and click on close editing. And just to

111
04:57.020 --> 04:58.400
confirm here for segment

112
04:58.400 --> 05:02.990
10, if we click on the link for port slash interfaces, here it's showing us our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:58.400 --> 05:02.990
10, if we click on the link for port slash interfaces, here it's showing us our

113
05:02.990 --> 05:04.400
Kali Linux box. And if

114
05:04.400 --> 05:08.540
we expand that and then expand the segment port profiles, effectively, it's

115
05:08.540 --> 05:09.920
inheriting our segment

116
05:09.920 --> 05:14.080
security profile from the segment, which is allowing DHCP server messages to

117
05:14.080 --> 05:14.960
come in. So we'll click

118
05:14.960 --> 05:18.960
on close. Let's go back to the topology view. So here on segment 10, let's go

119
05:18.960 --> 05:19.760
ahead and go to

120
05:19.760 --> 05:25.130
this Kali Linux box. And let's create a rogue DHCP server. So here is that Kali

121
05:25.130 --> 05:26.080
Linux box that's

122
05:26.080 --> 05:30.060
Kali 10. And let's hope put up a command prompt. And from here, they launched a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
05:26.080 --> 05:30.060
Kali 10. And let's hope put up a command prompt. And from here, they launched a

123
05:30.060 --> 05:30.640
tool called

124
05:30.640 --> 05:34.510
your cinea, which could be a fantastic tool in the wrong hands. Let me go ahead

125
05:34.510 --> 05:35.760
and do a dash g

126
05:35.760 --> 05:39.280
for the graphical version. Open is not installed on this distribution of Linux.

127
05:39.280 --> 05:39.920
Let me go ahead

128
05:39.920 --> 05:44.720
and take a peek at another VM. Let me see if I have it here on mint 10. And if

129
05:44.720 --> 05:45.120
I don't have an

130
05:45.120 --> 05:47.960
install of mint 10, I'll just go ahead and deploy it. And we'll just make mint

131
05:47.960 --> 05:49.280
10 or attack our

132
05:49.280 --> 05:52.960
machine here for a moment. And because they're both on the same segment, and

133
05:52.960 --> 05:54.080
the security segment

134
05:54.080 --> 05:58.420
profile is permitting DHCP messages. Effectively, we can have either one of

135
05:58.420 --> 05:59.760
these machines pretend

136
05:59.760 --> 06:04.200
to be a rogue DHCP server. So here is that mint Linux device. Let's go to a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:59.760 --> 06:04.200
to be a rogue DHCP server. So here is that mint Linux device. Let's go to a

137
06:04.200 --> 06:05.440
command prompt.

138
06:05.440 --> 06:09.920
And from here, let's type in your cinea press center. And it's not installed.

139
06:09.920 --> 06:10.080
All right,

140
06:10.080 --> 06:14.480
let's go ahead and install it real quick. The pseudo apt install your cinea

141
06:14.480 --> 06:16.320
will say yes to continue.

142
06:16.320 --> 06:19.600
And I'll just take a moment. All right, so let's go ahead and launch it with

143
06:19.600 --> 06:24.730
pseudo your cinea. And I'll do dash g for the graphical option. And there it is

144
06:24.730 --> 06:25.360
. Also,

145
06:25.360 --> 06:29.960
before we set up this device to pretend to be a DHCP server, I'd like to take a

146
06:29.960 --> 06:30.880
moment and just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
06:29.960 --> 06:30.880
moment and just

147
06:30.880 --> 06:37.130
disable the native NSX DHCP services so we can see and verify that this rogue

148
06:37.130 --> 06:38.000
DHCP server does

149
06:38.000 --> 06:41.620
indeed work without any competition from the NSX environment. So we'll go back

150
06:41.620 --> 06:42.160
to the NSX

151
06:42.160 --> 06:46.880
manager, and we'll go to our segments. And then for the segment 10 here, we'll

152
06:46.880 --> 06:47.280
click on the three

153
06:47.280 --> 06:51.020
dots, click on edit. And then over here on the right, we'll say please delete

154
06:51.020 --> 06:51.680
DHCP config,

155
06:51.680 --> 06:56.160
click on delete, and then click on save. And we are no longer offering DHCP

156
06:56.160 --> 06:56.800
services

157
06:56.800 --> 07:01.190
from NSX on that segment. We'll close editing. And let's head back to this mint
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
06:56.800 --> 07:01.190
from NSX on that segment. We'll close editing. And let's head back to this mint

158
07:01.190 --> 07:02.000
10 VM where we

159
07:02.000 --> 07:05.700
just installed your cinea. And we'll make it a DHCP server. So let me make that

160
07:05.700 --> 07:06.400
a little bit

161
07:06.400 --> 07:10.190
bigger. So if you click here on DHCP and then click launch attack, we can

162
07:10.190 --> 07:11.280
specify here, we want

163
07:11.280 --> 07:15.770
to create a DHCP rogue server, we'll click on OK, and we'll put the information

164
07:15.770 --> 07:16.640
regarding it.

165
07:16.640 --> 07:20.050
So for the server ID, I'm going to pick something on the 10 subnet, like 10 dot

166
07:20.050 --> 07:21.120
10 dot zero dot.

167
07:21.120 --> 07:25.440
Let's imagine that this VM is at 254 that that's its IP address. So we'll make

168
07:25.440 --> 07:26.080
that the server

169
07:26.080 --> 07:30.430
ID and then we'll hand out the IP addresses in the range 10 dot 10 dot zero dot
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
07:26.080 --> 07:30.430
ID and then we'll hand out the IP addresses in the range 10 dot 10 dot zero dot

170
07:30.430 --> 07:31.200
201 all the way

171
07:31.200 --> 07:36.320
through 10 dot 10 dot zero dot 205. And that way we see those IP addresses come

172
07:36.320 --> 07:36.960
up on a client,

173
07:36.960 --> 07:41.070
we'll know where they came from. And then we'll set the lease for, I say 1000

174
07:41.070 --> 07:41.760
seconds and that

175
07:41.760 --> 07:45.730
they need to renew in 500 seconds and then the mask is a 24 bit mask. So we'll

176
07:45.730 --> 07:47.040
put that in as well.

177
07:47.040 --> 07:49.990
And then for the default gateway. So let's imagine this hacker machine is

178
07:49.990 --> 07:52.400
really at 10 10 zero 254.

179
07:52.400 --> 07:56.260
We can hand that out as the default gateway for the clients to use 10 dot 10

180
07:56.260 --> 07:57.120
dot zero dot

181
07:57.120 --> 08:00.240
D54. And that way when they try to use their default gateway, they're going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
07:57.120 --> 08:00.240
D54. And that way when they try to use their default gateway, they're going to

182
08:00.240 --> 08:00.800
be handing that

183
08:00.800 --> 08:05.080
data directly to the attacker machine at which point they could analyze it and

184
08:05.080 --> 08:05.920
then forward it

185
08:05.920 --> 08:10.060
along its way. And then for the DNS server, let's also put 10 dot 10 dot zero

186
08:10.060 --> 08:10.880
dot 254,

187
08:10.880 --> 08:14.700
which once again is the attacker machines, we could lie about DNS information.

188
08:14.700 --> 08:14.880
And then for

189
08:14.880 --> 08:19.090
the domain, we could call this OGIT dot com or whatever domain we want to

190
08:19.090 --> 08:20.000
specify and then

191
08:20.000 --> 08:24.150
click on OK. Now before I click on OK here, in the background, I have some

192
08:24.150 --> 08:25.360
requests for

193
08:25.360 --> 08:29.200
DHCP renewals that I'm seeing. And that's coming from whoever got the IP

194
08:29.200 --> 08:31.680
address previously of 183.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

194
08:29.200 --> 08:31.680
address previously of 183.

195
08:31.680 --> 08:35.610
So here's what I propose we do. Let's go ahead and click on OK here to enable

196
08:35.610 --> 08:36.000
this

197
08:36.000 --> 08:39.990
service. Let's go back to full screen. And let's go back to the vSphere client

198
08:39.990 --> 08:40.560
and let's bring up

199
08:40.560 --> 08:44.820
another client that we can bring up on that same subnet. So here's a VM and it

200
08:44.820 --> 08:45.680
is not on the right

201
08:45.680 --> 08:50.000
subnet. So maybe right click and click on edit settings. And let's put it also

202
08:50.000 --> 08:51.280
on that same segment,

203
08:51.280 --> 08:56.560
which is the seg 10 non VRF. Click on OK, click on OK, and then we'll go ahead

204
08:56.560 --> 08:57.440
and power it up.

205
08:57.440 --> 09:01.280
So we'll click on power power on. And as it powers up, let's head back over to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

205
08:57.440 --> 09:01.280
So we'll click on power power on. And as it powers up, let's head back over to

206
09:01.280 --> 09:02.240
our mint Linux and

207
09:02.240 --> 09:06.040
take a look. So now with this rogue DHCP server in place, let's verify whether

208
09:06.040 --> 09:07.040
or not the client

209
09:07.040 --> 09:11.450
got an IP address from the range that was being handed out by our little rogue

210
09:11.450 --> 09:12.480
DHCP server here.

211
09:12.480 --> 09:16.480
So to do that, let's go to our VM, even a machine right here will launch remote

212
09:16.480 --> 09:18.240
console. And that

213
09:18.240 --> 09:21.820
did not get an IP address. Oh, I see it timed out on me. I didn't get there

214
09:21.820 --> 09:23.440
quite fast. Let's do it

215
09:23.440 --> 09:28.130
one more time. I'll click on launch attack DHCP, create a rogue DHCP server.

216
09:28.130 --> 09:28.640
And I'll go ahead and

217
09:28.640 --> 09:31.300
fill in the details again. All right, so I've supplied all that information
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

217
09:28.640 --> 09:31.300
fill in the details again. All right, so I've supplied all that information

218
09:31.300 --> 09:31.920
again. Let me

219
09:31.920 --> 09:36.330
also bring in our client and I'll go ahead and have it reboot. And while it reb

220
09:36.330 --> 09:37.200
oots, let me go

221
09:37.200 --> 09:41.840
ahead and launch this attack to become the rogue DHCP server. And then we can

222
09:41.840 --> 09:42.800
verify whether or

223
09:42.800 --> 09:47.190
not that client actually gets an IP address from this rogue DHCP server. So

224
09:47.190 --> 09:48.320
there we go. So there's

225
09:48.320 --> 09:52.320
the discover that came from the client. There's the offer that we sent. And

226
09:52.320 --> 09:53.360
then the client did a

227
09:53.360 --> 09:56.190
request and there's the acknowledgement. So we go back to that client. And here

228
09:56.190 --> 09:56.960
if we do an IF

229
09:56.960 --> 10:00.580
config and press enter, we can confirm the IP address it got which is 10 10
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

229
09:56.960 --> 10:00.580
config and press enter, we can confirm the IP address it got which is 10 10

230
10:00.580 --> 10:01.920
zero two zero one.

231
10:01.920 --> 10:06.400
And if we do a route and press enter, it's also showing the default gateway

232
10:06.400 --> 10:07.440
that is being used.

233
10:07.440 --> 10:12.080
So this information about the IP address, the default gateway, the DNS server

234
10:12.080 --> 10:12.880
was all handed out

235
10:12.880 --> 10:16.450
from our rogue DHCP server. Now we don't want that to be able to happen on our

236
10:16.450 --> 10:17.440
network. So that's

237
10:17.440 --> 10:23.570
why as part of the default security segment profile, it is blocking DHCP server

238
10:23.570 --> 10:24.400
messages

239
10:24.400 --> 10:28.810
from VMs connected to that segment by default. And that way only authorized

240
10:28.810 --> 10:29.840
DHCP servers can

241
10:29.840 --> 10:33.670
actually hand out IP addressing information to the VMs. So back in the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

241
10:29.840 --> 10:33.670
actually hand out IP addressing information to the VMs. So back in the

242
10:33.670 --> 10:34.720
configuration for our

243
10:34.720 --> 10:38.400
segment, again, this is segment seg 10 non VRF, I'm going to go ahead and set

244
10:38.400 --> 10:39.280
these segment security

245
10:39.280 --> 10:42.960
profile back to the default. And if we click on the three dots, we can confirm

246
10:42.960 --> 10:43.840
the settings by

247
10:43.840 --> 10:48.190
clicking on view. So in the default, we're filtering BP to use from going to

248
10:48.190 --> 10:48.720
our VMs,

249
10:48.720 --> 10:53.270
we're blocking DHCP server messages. And as a result, once we click on save

250
10:53.270 --> 10:53.600
here,

251
10:53.600 --> 10:58.000
that same attack that was trying to be initiated by that VM on segment 10,

252
10:58.000 --> 11:01.120
that would no longer be successful. Because based on the segment security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

252
10:58.000 --> 11:01.120
that would no longer be successful. Because based on the segment security

253
11:01.120 --> 11:01.920
profile,

254
11:01.920 --> 11:07.060
it is not allowing the DHCP messages coming in from servers into the network.

255
11:07.060 --> 11:08.160
So the DHCP server

256
11:08.160 --> 11:12.810
side protocol would be UDP port number 67. And on the client, the client would

257
11:12.810 --> 11:14.320
be using UDP port

258
11:14.320 --> 11:18.700
68. So based on the default segment security profile, not allowing DHCP server

259
11:18.700 --> 11:19.360
messages,

260
11:19.360 --> 11:22.590
that's one of the methods it's using to identify that that's DHCP server

261
11:22.590 --> 11:23.680
traffic. And as result

262
11:23.680 --> 11:27.490
of the segment security profile, it's dropping it and not allowing that attack

263
11:27.490 --> 11:28.080
to succeed.

264
11:28.080 --> 11:32.070
Also before I forget, I want to modify my DHCP services for the segment. So we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

264
11:28.080 --> 11:32.070
Also before I forget, I want to modify my DHCP services for the segment. So we

265
11:32.070 --> 11:32.560
really are

266
11:32.560 --> 11:36.780
handing out IP addresses from NSX once again. So I'll click on the three dots

267
11:36.780 --> 11:37.520
click on edit,

268
11:37.520 --> 11:42.820
and then click on set DHCP config. We'll use gateway based DHCP services. And

269
11:42.820 --> 11:43.360
then the range,

270
11:43.360 --> 11:50.880
I'm going to use 10.10.0.151 through 10.10.0.200 with a lease. Let's put 1,000

271
11:50.880 --> 11:51.920
seconds there.

272
11:51.920 --> 11:56.320
And a DNS server of eight, eight, eight, eight, eight, click on apply, and then

273
11:56.320 --> 11:57.520
click on save.

274
11:57.520 --> 12:00.480
And now that we have DHCP services set up for that segment, once again, I'll
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

274
11:57.520 --> 12:00.480
And now that we have DHCP services set up for that segment, once again, I'll

275
12:00.480 --> 12:00.880
click here on

276
12:00.880 --> 12:04.800
close editing. Let's bring back our little client. So here's our little client.

277
12:04.800 --> 12:05.200
And currently,

278
12:05.200 --> 12:08.800
we have an IP address and default route that we learned via the rogue DHCP

279
12:08.800 --> 12:09.680
server. So I'm going

280
12:09.680 --> 12:14.040
to go ahead and reboot this little VM. And so it'll go back to the Dora process

281
12:14.040 --> 12:14.800
once more. But

282
12:14.800 --> 12:19.940
this time it'll get correct information from the real NSX DHCP services. And

283
12:19.940 --> 12:20.560
for that VM that was

284
12:20.560 --> 12:24.600
doing the rogue DHCP services function, if it tried it again, it would be

285
12:24.600 --> 12:25.520
blocked based on our

286
12:25.520 --> 12:29.260
security segment profile. So now if we type in I have config and press enter,

287
12:29.260 --> 12:29.920
now we're showing

288
12:29.920 --> 12:34.670
an IP address of 10.10.0151. If we type in route, it'll show us our default
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

288
12:29.920 --> 12:34.670
an IP address of 10.10.0151. If we type in route, it'll show us our default

289
12:34.670 --> 12:36.560
gateway is 10.10.01.

290
12:36.560 --> 12:39.980
And if we tried to ping something on the internet based on name and press enter

291
12:39.980 --> 12:40.240
,

292
12:40.240 --> 12:41.760
that should also work once again.

293
12:41.760 --> 12:51.300
[BLANK_AUDIO]