WEBVTT

1
00:00.000 --> 00:03.680
So in the previous video, we started generating some network traffic, some of

2
00:03.680 --> 00:04.120
that traffic

3
00:04.120 --> 00:08.160
coming from our Linux clients going to our web servers and also from our Linux

4
00:08.160 --> 00:08.740
clients

5
00:08.740 --> 00:11.800
going out to the internet and in the background, those traffic patterns are

6
00:11.800 --> 00:12.800
still happening.

7
00:12.800 --> 00:17.240
So if we go over here to my little script, it is still doing curl every five

8
00:17.240 --> 00:17.840
seconds

9
00:17.840 --> 00:19.640
to each of the web servers.

10
00:19.640 --> 00:21.600
And that's happening from both of the clients.

11
00:21.600 --> 00:24.000
So I just want to confirm we have our traffic patterns still in place.

12
00:24.000 --> 00:26.240
Let me minimize the remote consoles.

13
00:26.240 --> 00:30.120
And now let's go ahead and put the NSX intelligence feature to work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:26.240 --> 00:30.120
And now let's go ahead and put the NSX intelligence feature to work.

14
00:30.120 --> 00:33.300
So we already enabled the NSX intelligence feature.

15
00:33.300 --> 00:37.380
So if we go to system and down to the NSX application platform and then as we

16
00:37.380 --> 00:37.920
scroll

17
00:37.920 --> 00:42.760
down, here is the NSX intelligence, which has been activated successfully.

18
00:42.760 --> 00:44.840
Now it's time to leverage that information.

19
00:44.840 --> 00:48.750
So to actually see the visualization of our traffic patterns courtesy of NSX

20
00:48.750 --> 00:49.440
intelligence,

21
00:49.440 --> 00:53.200
the way we do it is go to plan and troubleshoot right here.

22
00:53.200 --> 00:55.800
And then when we click here on plan and troubleshoot, it takes us to this first

23
00:55.800 --> 00:56.640
option under discover

24
00:56.640 --> 00:59.520
and plan and that's discover and take action.

25
00:59.520 --> 01:03.320
And that is showing us a visual representation of our traffic flows.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:59.520 --> 01:03.320
And that is showing us a visual representation of our traffic flows.

26
01:03.320 --> 01:05.040
And let's focus up here on what our options are.

27
01:05.040 --> 01:08.490
So if we use the drop down here, we have the option to take a look at this and

28
01:08.490 --> 01:09.040
the traffic

29
01:09.040 --> 01:12.240
flow is based on groups or we can do it based on computes.

30
01:12.240 --> 01:15.110
So if we select computes, we can say, you know what, I want to see traffic

31
01:15.110 --> 01:15.520
based on

32
01:15.520 --> 01:19.040
this VM and I don't need the cluster services.

33
01:19.040 --> 01:22.880
So we want this VM and that web server and that web server.

34
01:22.880 --> 01:26.080
And then click here on apply and this is going to show us a representation

35
01:26.080 --> 01:26.760
based on what we

36
01:26.760 --> 01:27.760
selected.

37
01:27.760 --> 01:30.590
So if we expand this and make it a little bit bigger, here we have one of our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:27.760 --> 01:30.590
So if we expand this and make it a little bit bigger, here we have one of our

38
01:30.590 --> 01:31.640
mint computers.

39
01:31.640 --> 01:32.800
So that's our mint on 10.55.

40
01:32.800 --> 01:34.960
And you're just hovering over the name.

41
01:34.960 --> 01:39.360
And here we have our other mint VM that's our mint on 10.66.

42
01:39.360 --> 01:42.560
And here we have our web server on 10.66.

43
01:42.560 --> 01:45.720
And over here we have our web server on the 10.55 network.

44
01:45.720 --> 01:49.080
It's also showing us for the pop up here regarding how many protected or

45
01:49.080 --> 01:50.560
unprotected flows it

46
01:50.560 --> 01:51.560
currently sees.

47
01:51.560 --> 01:54.560
If it says unprotected, that means that traffic is flowing.

48
01:54.560 --> 01:58.480
However, it's not being controlled by a rule as part of a firewall policy or if

49
01:58.480 --> 01:58.800
we had

50
01:58.800 --> 02:02.200
some that showed up as blocked, that means that we have a firewall policy rule
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:58.800 --> 02:02.200
some that showed up as blocked, that means that we have a firewall policy rule

51
02:02.200 --> 02:02.600
that's

52
02:02.600 --> 02:04.360
blocking that flow of traffic.

53
02:04.360 --> 02:07.420
And if we have a firewall policy rule that says permit a certain flow of

54
02:07.420 --> 02:08.040
traffic that

55
02:08.040 --> 02:11.440
would show up as allowed now because they don't have any specific firewall

56
02:11.440 --> 02:12.120
policy rules

57
02:12.120 --> 02:16.000
in place that I created, everything is going to show up as unprotected.

58
02:16.000 --> 02:22.360
So these are our four VMs and this 10.1.2.3 that is my DHCP service.

59
02:22.360 --> 02:25.280
So if we expand this big enough, it'll show us the actual ports involved.

60
02:25.280 --> 02:30.630
We can also right click on that flow and then click here on flow details and it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:25.280 --> 02:30.630
We can also right click on that flow and then click here on flow details and it

61
02:30.630 --> 02:30.960
'll give

62
02:30.960 --> 02:33.400
us a nice nitty gritty detail on what that is.

63
02:33.400 --> 02:36.200
So if we expand that, that is UDP traffic.

64
02:36.200 --> 02:40.680
And if click here on services is DHCP using UDP port 67.

65
02:40.680 --> 02:45.940
So a DHCP services port 67 is used on the server side and port 68 is used on

66
02:45.940 --> 02:46.760
the client

67
02:46.760 --> 02:47.760
side.

68
02:47.760 --> 02:52.240
So when a DHCP client is talking to a DHCP server, it'd be coming from UDP port

69
02:52.240 --> 02:53.040
68 going

70
02:53.040 --> 02:56.720
to the server well known port of UDP port 67.

71
02:56.720 --> 03:00.360
So this is showing us about that flow courtesy of NSX intelligent.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:56.720 --> 03:00.360
So this is showing us about that flow courtesy of NSX intelligent.

72
03:00.360 --> 03:03.530
Let me go ahead and close that or another option would be to go ahead and right

73
03:03.530 --> 03:03.880
click

74
03:03.880 --> 03:05.360
on our VM here.

75
03:05.360 --> 03:08.560
And from here, we could say, please show me the flow details like that.

76
03:08.560 --> 03:12.920
And that's showing us all the flow details from the perspective of this VM.

77
03:12.920 --> 03:15.200
So here's our web traffic internally.

78
03:15.200 --> 03:17.080
There is our DHCP traffic.

79
03:17.080 --> 03:18.440
Here's traffic to the other web server.

80
03:18.440 --> 03:21.160
And we also have traffic going out to public IPs.

81
03:21.160 --> 03:25.280
So if we expand that, there's a DNS request going out to 8888.

82
03:25.280 --> 03:28.570
And if we collapse that and open up the next one and expand that, this is

83
03:28.570 --> 03:29.360
traffic going

84
03:29.360 --> 03:31.640
out to a whole bunch of different IP addresses.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:29.360 --> 03:31.640
out to a whole bunch of different IP addresses.

85
03:31.640 --> 03:32.640
So there's the list.

86
03:32.640 --> 03:35.610
And if we click here on services, it'll give us better insight as to what was

87
03:35.610 --> 03:36.520
being sent.

88
03:36.520 --> 03:38.680
All right, so let me go ahead and close that.

89
03:38.680 --> 03:41.880
Now another way of looking at the detail would be to look at it based on groups

90
03:41.880 --> 03:41.960
.

91
03:41.960 --> 03:44.960
So up here on the top, we'll use the dropdown.

92
03:44.960 --> 03:47.430
And if we say, we want to see it based on groups, we can then go ahead and

93
03:47.430 --> 03:47.920
choose our

94
03:47.920 --> 03:48.920
groups.

95
03:48.920 --> 03:51.480
So we only have two groups that I created, web servers and clients.

96
03:51.480 --> 03:55.130
We can select one or both of them, click on apply, and that's going to change

97
03:55.130 --> 03:55.600
the way

98
03:55.600 --> 03:56.920
it's reflected here.

99
03:56.920 --> 03:59.160
So now we can focus on our group membership.

100
03:59.160 --> 04:02.000
So we right click here on the web servers group.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:59.160 --> 04:02.000
So we right click here on the web servers group.

101
04:02.000 --> 04:04.400
And then we go to members, it'll show us who the members are.

102
04:04.400 --> 04:05.400
There's our two web servers.

103
04:05.400 --> 04:09.070
And if we go down here to our clients and right click there and click on

104
04:09.070 --> 04:10.120
members, it'll show

105
04:10.120 --> 04:11.400
us who the members are there.

106
04:11.400 --> 04:14.610
So we've got traffic is showing between the clients and the web servers as

107
04:14.610 --> 04:15.400
shown by this

108
04:15.400 --> 04:16.400
red line right here.

109
04:16.400 --> 04:19.580
And because it's red, it means it's unprotected, meaning there's no firewall

110
04:19.580 --> 04:20.840
rules either permitting

111
04:20.840 --> 04:22.480
or denying that traffic.

112
04:22.480 --> 04:25.660
And between our clients and the internet, if we hover here, we have eight

113
04:25.660 --> 04:26.340
unprotected

114
04:26.340 --> 04:27.920
flows for traffic that's going out.

115
04:27.920 --> 04:31.960
And we could right click there and click on flow details to see what those are.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:27.920 --> 04:31.960
And we could right click there and click on flow details to see what those are.

116
04:31.960 --> 04:33.200
So there's some DNS.

117
04:33.200 --> 04:34.200
There's some HTTP.

118
04:34.200 --> 04:35.200
There's some NTP.

119
04:35.200 --> 04:37.000
There's more DNS.

120
04:37.000 --> 04:40.000
There's some HTTPS and there's some unknown.

121
04:40.000 --> 04:45.230
What does that so expand that and take a look and for the unknown, it's UDP

122
04:45.230 --> 04:46.480
port 443.

123
04:46.480 --> 04:51.200
So that would be quick, which oftentimes is used by Google and YouTube services

124
04:51.200 --> 04:51.720
for faster

125
04:51.720 --> 04:53.800
delivery of their content.

126
04:53.800 --> 04:58.510
So here for the application, if we expand this, it's showing us it's YouTube

127
04:58.510 --> 04:59.480
and SSL and quick.

128
04:59.480 --> 05:00.480
There it is right there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
04:59.480 --> 05:00.480
There it is right there.

129
05:00.480 --> 05:01.480
Fantastic.

130
05:01.480 --> 05:05.690
So for the destinations over here, if we click here on the destination, here

131
05:05.690 --> 05:06.160
are the

132
05:06.160 --> 05:08.800
list of IP addresses that we were reaching out to.

133
05:08.800 --> 05:12.200
And when I say we're here, I'm talking about this mint client on the 1066

134
05:12.200 --> 05:12.800
network.

135
05:12.800 --> 05:14.360
So we go ahead and close that.

136
05:14.360 --> 05:18.470
And if we double click, for example, on one of these groups, again, it zooms in

137
05:18.470 --> 05:18.760
on the

138
05:18.760 --> 05:19.920
detail there.

139
05:19.920 --> 05:24.510
And then here we have our web server at 10550122, just by hovering over it, it

140
05:24.510 --> 05:25.440
gives the details

141
05:25.440 --> 05:29.310
regarding the name of that web server, as well as the allowed or blocked or

142
05:29.310 --> 05:30.120
unprotected
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:29.310 --> 05:30.120
unprotected

143
05:30.120 --> 05:31.120
flows.

144
05:31.120 --> 05:34.200
And if we go to the other web server right here, again, a similar result.

145
05:34.200 --> 05:37.000
And then to go back, you simply click on back right here.

146
05:37.000 --> 05:41.620
So the fact that we have all red blows means that we don't have any security

147
05:41.620 --> 05:42.440
policies in

148
05:42.440 --> 05:46.000
place, any firewall rules that are explicitly permitting that traffic.

149
05:46.000 --> 05:49.510
And ideally, if traffic is going to flow over our network, we want to have

150
05:49.510 --> 05:50.360
explicit rules

151
05:50.360 --> 05:54.240
that say this traffic should be allowed, for example, from clients going to the

152
05:54.240 --> 05:55.040
web server

153
05:55.040 --> 05:59.340
or from web servers out to the internet or between various application servers

154
05:59.340 --> 05:59.720
in our

155
05:59.720 --> 06:02.800
environment that need to communicate with each other, for example, like front
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
05:59.720 --> 06:02.800
environment that need to communicate with each other, for example, like front

156
06:02.800 --> 06:03.320
end servers

157
06:03.320 --> 06:05.440
and database servers and so forth.

158
06:05.440 --> 06:09.550
So to solve the problem of us not having any rules in place here, we can have

159
06:09.550 --> 06:10.360
NSX intelligence

160
06:10.360 --> 06:13.080
help us with that as far as recommendations.

161
06:13.080 --> 06:16.840
And that my friend is exactly what you and I get to do in the next video.

162
06:16.840 --> 06:18.600
So I'll see you there in just a moment.

163
06:18.600 --> 06:27.600
[BLANK_AUDIO]