WEBVTT

1
00:00.000 --> 00:02.640
So now that NSX Intelligence is enabled,

2
00:02.640 --> 00:05.360
let's go ahead and generate some traffic that it can go ahead

3
00:05.360 --> 00:07.520
and give us a visual representation of.

4
00:07.520 --> 00:11.000
So let's click on the networking tab here in the NSX Manager.

5
00:11.000 --> 00:14.760
Let's go to Network Topology and let's take a look at the topologies.

6
00:14.760 --> 00:19.100
This is the NSX topology that I put together last night after I rebuilt this

7
00:19.100 --> 00:19.440
lab.

8
00:19.440 --> 00:24.110
I've got a tier zero gateway with a couple of interfaces using a couple of edge

9
00:24.110 --> 00:24.600
nodes

10
00:24.600 --> 00:26.480
going out to the external world.

11
00:26.480 --> 00:28.480
Then I have down here a lab one,

12
00:28.480 --> 00:33.440
a SEG 55 and a lab one, SEGMNT 66, which are two overlay networks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.480 --> 00:33.440
a SEG 55 and a lab one, SEGMNT 66, which are two overlay networks.

13
00:33.440 --> 00:36.680
Then I have a couple of VMs on each of those segments.

14
00:36.680 --> 00:40.320
So if we take a closer look at that, let me go ahead and click here on these

15
00:40.320 --> 00:40.880
two VMs.

16
00:40.880 --> 00:44.600
So I've got a little VM called Mint on 105500

17
00:44.600 --> 00:48.280
and a little web server at 105500152.

18
00:48.280 --> 00:51.920
And over here off SEGMNT 66, if we click on that, expand that,

19
00:51.920 --> 00:55.520
I've got a little Linux Mint system here on the 106600 network.

20
00:55.520 --> 00:59.800
I also have a little web server here at 106600.151.

21
00:59.800 --> 01:02.480
I also took the liberty of creating a couple of groups
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:59.800 --> 01:02.480
I also took the liberty of creating a couple of groups

22
01:02.480 --> 01:06.080
just to logically put these two Mint VMs in a single group

23
01:06.080 --> 01:08.000
and the two web servers in a single group.

24
01:08.000 --> 01:09.200
And let me show you that as well.

25
01:09.200 --> 01:13.000
So if we click here on inventory on the left, we click here on groups.

26
01:13.000 --> 01:14.120
Here I have a group called clients.

27
01:14.120 --> 01:16.800
Let me actually rename that and put a little period in front of that.

28
01:16.800 --> 01:18.480
And that way it will always sort to the top,

29
01:18.480 --> 01:20.080
although it starts at the C.

30
01:20.080 --> 01:23.080
I'm going to make it a little more consistent and click on save.

31
01:23.080 --> 01:26.080
And then I also have a group called web servers.

32
01:26.080 --> 01:28.760
I'm going to edit that and also put a little period right in front of that.

33
01:28.760 --> 01:30.800
So it's sourced to the top of our output.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:28.760 --> 01:30.800
So it's sourced to the top of our output.

34
01:30.800 --> 01:33.520
So click on edit and for the benefit of this demonstration,

35
01:33.520 --> 01:36.000
I'll go ahead and put a little period in front of that, click on save.

36
01:36.000 --> 01:37.840
And that should sort those two to the top.

37
01:37.840 --> 01:38.800
Fantastic.

38
01:38.800 --> 01:40.280
So there's our clients group.

39
01:40.280 --> 01:41.480
There's our web servers group.

40
01:41.480 --> 01:43.880
And if we click here on view members for the clients group,

41
01:43.880 --> 01:46.240
I have the two Mint VMs there.

42
01:46.240 --> 01:47.080
Fantastic.

43
01:47.080 --> 01:50.760
And if we click on the web servers group and click on view members,

44
01:50.760 --> 01:52.680
I've got the two little web servers right there.

45
01:52.680 --> 01:53.680
Fantastic.

46
01:53.680 --> 01:56.280
And then we'll click on refresh there to make sure it's all good.

47
01:56.280 --> 01:58.880
So let me bring up remote consoles for those devices,

48
01:58.880 --> 02:02.440
the two clients and the two web servers just to verify they have connectivity
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:58.880 --> 02:02.440
the two clients and the two web servers just to verify they have connectivity

49
02:02.440 --> 02:03.880
and that we can generate some traffic.

50
02:03.880 --> 02:07.160
So here in the vSphere client, let's go down to VMs for testing.

51
02:07.160 --> 02:10.400
And then I've got a VMs on NSX segments.

52
02:10.400 --> 02:15.280
And then I've got a folder called VMs for segment 55 with one Mint computer

53
02:15.280 --> 02:16.720
and one web server.

54
02:16.720 --> 02:21.080
Then I have a folder called VMs on segment 66 with one VM that's a client.

55
02:21.080 --> 02:23.280
And one VM that's a server here as well.

56
02:23.280 --> 02:24.240
And they're all running.

57
02:24.240 --> 02:26.040
So let's open up remote consoles to each of those.

58
02:26.040 --> 02:27.280
Let's start off with the web servers.

59
02:27.280 --> 02:30.840
So we're going to right click on the web server that's on segment 55
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:27.280 --> 02:30.840
So we're going to right click on the web server that's on segment 55

60
02:30.840 --> 02:32.880
and open a remote console there.

61
02:32.880 --> 02:36.360
And we'll also open up a remote console to our web server over on the 1066

62
02:36.360 --> 02:37.240
segment as well.

63
02:37.240 --> 02:40.950
So I'll right click on that VM, that web server, and click on open remote

64
02:40.950 --> 02:41.680
console.

65
02:41.680 --> 02:43.160
All right, and here they are.

66
02:43.160 --> 02:48.080
So this is the little teeny itty bitty VM on the 1055 network.

67
02:48.080 --> 02:49.160
And let's bring in the other one.

68
02:49.160 --> 02:52.760
This is the little VM over on the 1066 network.

69
02:52.760 --> 02:54.680
And they are both running web services.

70
02:54.680 --> 02:58.960
And just as a sanity check, if we went to a command prompt on each of those,

71
02:58.960 --> 03:00.720
let me also verify we can get out to the internet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:58.960 --> 03:00.720
let me also verify we can get out to the internet.

72
03:00.720 --> 03:05.080
We'll do a ping out to www.google.com and it says, are you root?

73
03:05.080 --> 03:05.640
Nope.

74
03:05.640 --> 03:10.240
So we'll do a pseudo and a ping out to www.google.com.

75
03:10.240 --> 03:12.040
And sure enough, that is working.

76
03:12.040 --> 03:12.720
That's great.

77
03:12.720 --> 03:16.960
I will do some more treatment over here on the web server at 1066.

78
03:16.960 --> 03:22.280
So we'll open up a command prompt and do a ping out to www.vmware.com.

79
03:22.280 --> 03:23.520
And that looks great too.

80
03:23.520 --> 03:24.880
We'll do a control C to stop that.

81
03:24.880 --> 03:28.760
I just want to verify that internet connectivity works and DNS is working.

82
03:28.760 --> 03:30.320
So that's our two little web servers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
03:28.760 --> 03:30.320
So that's our two little web servers.

83
03:30.320 --> 03:32.240
Let me go ahead and minimize those.

84
03:32.240 --> 03:35.760
Next, let's take a look at our Mint Linux VMs, which are going to be acting as

85
03:35.760 --> 03:36.560
our clients.

86
03:36.560 --> 03:40.400
So let me launch a remote console to our client here on the 1055 network.

87
03:40.400 --> 03:45.750
And I'll also launch a remote console to our Mint Linux system over on the 1066

88
03:45.750 --> 03:46.360
network.

89
03:46.360 --> 03:49.680
So here's our Linux client on the 1055 network.

90
03:49.680 --> 03:51.280
Let's verify its IP address.

91
03:51.280 --> 03:53.560
We can do that with the IP address command or I have config.

92
03:53.560 --> 03:54.720
Either way, it'll be great.

93
03:54.720 --> 03:57.520
So this is at 1055 0151.

94
03:57.520 --> 03:59.600
And we go ahead and minimize that.

95
03:59.600 --> 04:01.360
And let's open up a browser.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:59.600 --> 04:01.360
And let's open up a browser.

96
04:01.360 --> 04:04.560
So from here, we're going to do a quick check out to fast.com just to verify

97
04:04.560 --> 04:04.880
internet

98
04:04.880 --> 04:05.920
connectivity.

99
04:05.920 --> 04:08.760
And that is looking like we have internet connectivity.

100
04:08.760 --> 04:09.480
Great, great, great.

101
04:09.480 --> 04:10.920
Let me open up another tab.

102
04:10.920 --> 04:12.280
And let's go over to our little web servers.

103
04:12.280 --> 04:16.760
So let's go to 10.55.0.152.

104
04:16.760 --> 04:18.080
That's one of our web servers.

105
04:18.080 --> 04:19.080
That looks great.

106
04:19.080 --> 04:21.400
And I will go ahead and add that also to the bookmarks.

107
04:21.400 --> 04:29.640
And let's also go over in another tab to 10.66.0.151 press enter.

108
04:29.640 --> 04:30.760
And that also looks good.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:29.640 --> 04:30.760
And that also looks good.

109
04:30.760 --> 04:34.590
So both of those servers have the same page that says welcome to the web server

110
04:34.590 --> 04:34.640
.

111
04:34.640 --> 04:38.080
So I'm going to add that as a bookmark as well and click on save.

112
04:38.080 --> 04:42.600
And then we can go ahead and do an F5 or a refresh on each of those a few times

113
04:42.600 --> 04:42.960
to generate

114
04:42.960 --> 04:43.960
some traffic.

115
04:43.960 --> 04:46.960
I also have a little script that's going to generate some traffic for us.

116
04:46.960 --> 04:49.400
And let me go ahead and do a LS here.

117
04:49.400 --> 04:51.120
And it's called traffic.sh.

118
04:51.120 --> 04:57.190
If we do a more traffic.sh, it simply does a curl to the IP addresses of each

119
04:57.190 --> 04:57.920
of those

120
04:57.920 --> 04:58.920
servers.

121
04:58.920 --> 05:05.280
1055 0.152 and 1066 0151 to generate some HTTP traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:58.920 --> 05:05.280
1055 0.152 and 1066 0151 to generate some HTTP traffic.

122
05:05.280 --> 05:07.400
So it does a pause for five seconds after each one.

123
05:07.400 --> 05:09.440
This will be repeats that batch file.

124
05:09.440 --> 05:12.160
So I'm going to go ahead and launch that to generate some traffic.

125
05:12.160 --> 05:13.320
So that is on its way.

126
05:13.320 --> 05:15.640
So I make sure we get one more fantastic.

127
05:15.640 --> 05:19.080
So I'll minimize that and let's take a look at the other Linux client over on

128
05:19.080 --> 05:20.040
the 1066

129
05:20.040 --> 05:21.040
network.

130
05:21.040 --> 05:24.440
So that one's right here and let's verify its IP address with the command IP

131
05:24.440 --> 05:24.840
address

132
05:24.840 --> 05:26.200
or we can use I have config.

133
05:26.200 --> 05:27.560
Either way, it would be great.

134
05:27.560 --> 05:31.800
And this is at the IP address of 1066 0152.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
05:27.560 --> 05:31.800
And this is at the IP address of 1066 0152.

135
05:31.800 --> 05:35.440
And if we opened up a browser, let's verify internet connectivity in general

136
05:35.440 --> 05:36.000
with a real

137
05:36.000 --> 05:37.600
quick speed test.

138
05:37.600 --> 05:39.360
And that is looking good.

139
05:39.360 --> 05:44.120
And let's also open up a couple of tabs to each of our internal servers, one at

140
05:44.120 --> 05:44.960
.152

141
05:44.960 --> 05:46.600
on the 1055 network.

142
05:46.600 --> 05:49.000
And the other one at 151 on the 1066 network.

143
05:49.000 --> 05:52.440
And if you're asking, why do they have those kind of weird hosted addresses?

144
05:52.440 --> 05:55.570
And the answer is there's just D HTTP clients and whatever IP address they got,

145
05:55.570 --> 05:56.040
that's what

146
05:56.040 --> 05:57.040
I'm using.

147
05:57.040 --> 06:01.400
So the first one is at 10.55.0.152.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
05:57.040 --> 06:01.400
So the first one is at 10.55.0.152.

148
06:01.400 --> 06:02.400
That looks good.

149
06:02.400 --> 06:05.200
We'll create a bookmark for that and click on save.

150
06:05.200 --> 06:11.320
And then in another tab, we'll go to the other server and that's at 10.66.0.151

151
06:11.320 --> 06:11.480
.

152
06:11.480 --> 06:12.640
And that looks good too.

153
06:12.640 --> 06:14.320
And we'll create a bookmark for that as well.

154
06:14.320 --> 06:15.760
So we'll click on save.

155
06:15.760 --> 06:17.880
And then for each of these sites, we can do a refresh a few times.

156
06:17.880 --> 06:21.170
And then we can refresh that with either using a refresh here or we can do a

157
06:21.170 --> 06:21.640
control

158
06:21.640 --> 06:24.520
shift R and Windows computer or an F5.

159
06:24.520 --> 06:27.200
I also have a batch file we can run here as well.

160
06:27.200 --> 06:30.930
So if we go to the command prompt and do an LS, I've got this little batch file
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

160
06:27.200 --> 06:30.930
So if we go to the command prompt and do an LS, I've got this little batch file

161
06:30.930 --> 06:31.320
called

162
06:31.320 --> 06:32.320
traffic.sh.

163
06:32.320 --> 06:35.560
It does a very similar thing as the other VM did.

164
06:35.560 --> 06:38.000
And that is it simply does curl multiple times.

165
06:38.000 --> 06:40.480
So we type in more traffic.sh.

166
06:40.480 --> 06:44.520
There is the script and let's go ahead and launch it and away it goes.

167
06:44.520 --> 06:47.400
I just want to make sure it's going to succeed a couple times here.

168
06:47.400 --> 06:50.430
And once we confirm that, we can go ahead and let these batch files simply run

169
06:50.430 --> 06:50.760
in the

170
06:50.760 --> 06:51.760
background.

171
06:51.760 --> 06:52.760
All right, that's looking good.

172
06:52.760 --> 06:53.760
It's updating.

173
06:53.760 --> 06:57.900
Also, let's open up another tab in our browser and let's just verify YouTube

174
06:57.900 --> 06:58.600
and that seems

175
06:58.600 --> 06:59.600
to be working.

176
06:59.600 --> 07:03.320
Go ahead and launch a video to generate some content being downloaded from
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
06:59.600 --> 07:03.320
Go ahead and launch a video to generate some content being downloaded from

177
07:03.320 --> 07:03.980
YouTube.

178
07:03.980 --> 07:05.800
So this one will do we'll click on that.

179
07:05.800 --> 07:09.400
And because I'm not logged in as myself, I have a nice little commercial here.

180
07:09.400 --> 07:12.040
So I'll go ahead and skip that so it can get right to the video.

181
07:12.040 --> 07:17.040
Also, let me go ahead and open up a new command prompt to verify my IP address

182
07:17.040 --> 07:18.040
one more time.

183
07:18.040 --> 07:23.640
And let me generate some ping traffic over to 10660152 from the VM that's over

184
07:23.640 --> 07:24.040
on the

185
07:24.040 --> 07:25.560
1055 segment.

186
07:25.560 --> 07:28.000
So here is the remote console for the other side.

187
07:28.000 --> 07:29.800
Let me open up another window there.

188
07:29.800 --> 07:32.320
And from here, let's do an I have config just to verify our address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

188
07:29.800 --> 07:32.320
And from here, let's do an I have config just to verify our address.

189
07:32.320 --> 07:35.640
So sure enough, we're at 10550151.

190
07:35.640 --> 07:41.160
And let's do a continuous ping over to 10.66.0.152 press enter.

191
07:41.160 --> 07:42.160
So fantastic.

192
07:42.160 --> 07:46.000
So I've got a lot of traffic being generated in the background on these two VMs

193
07:46.000 --> 07:46.560
with some

194
07:46.560 --> 07:48.930
of that traffic going out to the internet and some of the traffic going

195
07:48.930 --> 07:49.480
internal.

196
07:49.480 --> 07:53.080
And if we go back to the NSX manager and click on networking and look at the

197
07:53.080 --> 07:53.560
network

198
07:53.560 --> 07:57.560
topology, so for traffic flows, we could expect some traffic between here and

199
07:57.560 --> 07:58.040
here.

200
07:58.040 --> 08:02.390
We expect some traffic between here and here because of the pings and from and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

200
07:58.040 --> 08:02.390
We expect some traffic between here and here because of the pings and from and

201
08:02.390 --> 08:03.000
between

202
08:03.000 --> 08:07.880
here and here and also between here and here and also between this VM and this

203
08:07.880 --> 08:08.920
web server.

204
08:08.920 --> 08:11.440
And we also have some traffic that we're expecting to go out to the internet.

205
08:11.440 --> 08:15.500
And of these web servers, we're also using DNS and need to do DNS queries or

206
08:15.500 --> 08:16.080
doing updates

207
08:16.080 --> 08:17.080
or anything else.

208
08:17.080 --> 08:19.910
If they're going out to the internet, there'd be flows out to the internet for

209
08:19.910 --> 08:20.200
them as

210
08:20.200 --> 08:21.200
well.

211
08:21.200 --> 08:24.370
And the concern is that if we want to lock this down and only have permitted

212
08:24.370 --> 08:24.640
traffic

213
08:24.640 --> 08:28.920
flows, we have so much traffic going on, it's really hard from an estimation

214
08:28.920 --> 08:29.760
perspective

215
08:29.760 --> 08:33.780
to correctly predict all of the protocols and ports involved because when these
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

215
08:29.760 --> 08:33.780
to correctly predict all of the protocols and ports involved because when these

216
08:33.780 --> 08:34.040
mint

217
08:34.040 --> 08:38.410
clients are going out to YouTube, for example, it's not just HTTP as they're

218
08:38.410 --> 08:39.080
using.

219
08:39.080 --> 08:42.610
They're also very likely going to be using quick, which is going to be using

220
08:42.610 --> 08:43.080
UDP.

221
08:43.080 --> 08:46.660
So with the NSX intelligence feature, it can very specifically show us the

222
08:46.660 --> 08:47.360
traffic flows

223
08:47.360 --> 08:51.960
involved and then secondly, which is amazing, make recommendations for firewall

224
08:51.960 --> 08:52.400
policy

225
08:52.400 --> 08:56.590
rules on how to permit the traffic that we want as we get closer and closer to

226
08:56.590 --> 08:57.480
implementing

227
08:57.480 --> 09:01.050
firewall policy rules that are allowing traffic that we want to allow through
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

227
08:57.480 --> 09:01.050
firewall policy rules that are allowing traffic that we want to allow through

228
09:01.050 --> 09:01.760
and at the same

229
09:01.760 --> 09:05.080
time denying other traffic that we don't want to allow.

230
09:05.080 --> 09:09.400
Also here as part of this topology, if we go to security and on the left, if we

231
09:09.400 --> 09:09.840
go down

232
09:09.840 --> 09:13.760
to distribute a firewall, I just want to point out that by default, I don't

233
09:13.760 --> 09:15.280
have any specific

234
09:15.280 --> 09:17.160
firewall rules in place.

235
09:17.160 --> 09:20.740
So nothing at the distributed firewall other than the defaults and also nothing

236
09:20.740 --> 09:21.040
at the

237
09:21.040 --> 09:24.360
gateway firewall, again, other than the defaults, which are permitting

238
09:24.360 --> 09:25.120
everything.

239
09:25.120 --> 09:29.370
So if we went to plan and troubleshoot here and we went to traffic analysis and

240
09:29.370 --> 09:29.720
went to

241
09:29.720 --> 09:33.390
trace flow, if we wanted to trace traffic, for example, from one of our VMs,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

241
09:29.720 --> 09:33.390
trace flow, if we wanted to trace traffic, for example, from one of our VMs,

242
09:33.390 --> 09:33.880
let's go

243
09:33.880 --> 09:39.970
ahead and choose our mint on 1055, which is trying to go over to our web server

244
09:39.970 --> 09:40.120
over

245
09:40.120 --> 09:41.120
on the 1066.

246
09:41.120 --> 09:44.640
Let's go ahead and grab that one as the target and let's say for traffic, we

247
09:44.640 --> 09:45.520
want to go ahead

248
09:45.520 --> 09:51.260
and match on TCP, that's going to port 80, which is the well known port for

249
09:51.260 --> 09:52.040
HTTP and for

250
09:52.040 --> 09:55.440
the source port, we six, seven, eight, three, so some high numbered port.

251
09:55.440 --> 09:57.560
And then we'll go ahead and scroll down and click on trace.

252
09:57.560 --> 10:01.900
And that's just going to confirm for us the flow of traffic and also show us
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

252
09:57.560 --> 10:01.900
And that's just going to confirm for us the flow of traffic and also show us

253
10:01.900 --> 10:02.840
any firewall

254
10:02.840 --> 10:05.080
rules that might be preventing that traffic.

255
10:05.080 --> 10:08.460
Now since we already verified from the actual clients that those traffic flows

256
10:08.460 --> 10:09.000
work, I would

257
10:09.000 --> 10:11.000
expect this also to confirm that.

258
10:11.000 --> 10:13.690
So if we scroll up and look at the play by play here, here showing us going

259
10:13.690 --> 10:14.200
through the

260
10:14.200 --> 10:17.920
distributive firewall and not being blocked there and it's going over the

261
10:17.920 --> 10:18.840
physical network

262
10:18.840 --> 10:21.630
through our tunnel endpoints, then once again, it's being checked against the

263
10:21.630 --> 10:22.200
distributive

264
10:22.200 --> 10:24.640
firewall and then finally being delivered.

265
10:24.640 --> 10:27.270
So notice here that there's no edge nodes that were needed because all that

266
10:27.270 --> 10:28.200
traffic was

267
10:28.200 --> 10:29.520
East West traffic.

268
10:29.520 --> 10:32.390
So if we do a new trace, let me go ahead and give us a little more real estate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

268
10:29.520 --> 10:32.390
So if we do a new trace, let me go ahead and give us a little more real estate

269
10:32.390 --> 10:32.840
here and

270
10:32.840 --> 10:34.960
click on new trace and click on proceed.

271
10:34.960 --> 10:38.890
And this time, let's do a trace from one of our Linux Mint computers going out

272
10:38.890 --> 10:39.280
to an

273
10:39.280 --> 10:40.280
Internet resource.

274
10:40.280 --> 10:44.000
So for the destination, instead of virtual machine, I'll go ahead and say IP

275
10:44.000 --> 10:45.160
address and

276
10:45.160 --> 10:48.830
let's go ahead and say layer three and let's go out to eight dot eight dot

277
10:48.830 --> 10:49.760
eight dot eight

278
10:49.760 --> 10:52.160
and let's imagine we're trying to make a DNS request.

279
10:52.160 --> 10:55.480
So we'll say UDP and the well known port.

280
10:55.480 --> 10:59.760
There is UDP port 53 and for the source port, some high numbered port.

281
10:59.760 --> 11:01.880
All you six seven eight three just for fun.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

281
10:59.760 --> 11:01.880
All you six seven eight three just for fun.

282
11:01.880 --> 11:04.200
And then we'll go ahead and scroll down and click on trace.

283
11:04.200 --> 11:10.750
So this is simulating a UDP request using traditional UDP port 53 trying to go

284
11:10.750 --> 11:11.240
out to

285
11:11.240 --> 11:14.480
a DNS server at eight eight eight eight and sure enough, that's working.

286
11:14.480 --> 11:17.230
So it's going through the extrude of firewall and because it's going out to the

287
11:17.230 --> 11:17.720
external

288
11:17.720 --> 11:22.030
network, it gets handed over via the tunnel endpoints from the host blue one

289
11:22.030 --> 11:22.920
over to an

290
11:22.920 --> 11:26.360
edge node who is the active edge node in my topology.

291
11:26.360 --> 11:29.220
And then it makes the forwarding decision, including using that before it

292
11:29.220 --> 11:29.720
forwards it

293
11:29.720 --> 11:30.720
out.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

293
11:29.720 --> 11:30.720
out.

294
11:30.720 --> 11:31.720
All right.

295
11:31.720 --> 11:35.740
So we have network traffic at this very moment that is being generated.

296
11:35.740 --> 11:36.760
We have two groups.

297
11:36.760 --> 11:40.880
We have a group for our web servers, which is right here.

298
11:40.880 --> 11:43.560
And we have a group for our clients, which is right here.

299
11:43.560 --> 11:46.760
So our next logical step now that we have traffic flowing through our network

300
11:46.760 --> 11:47.040
is to

301
11:47.040 --> 11:51.190
use NSX intelligence to give us a really concise view of what really is

302
11:51.190 --> 11:52.120
happening on

303
11:52.120 --> 11:53.120
that network.

304
11:53.120 --> 11:55.400
And that's what we get to do in the very next video.

305
11:55.400 --> 11:57.000
So I'll see you there in just a moment.

306
11:57.000 --> 12:07.000
[BLANK_AUDIO]