WEBVTT 1 00:00.000 --> 00:03.470 In the previous video, we took a look at how NSX Intelligence could give us 2 00:03.470 --> 00:06.200 visibility into the traffic flows on our network. 3 00:06.200 --> 00:10.550 And in this video, you and I are going to have NSX Intelligence help us one 4 00:10.550 --> 00:11.400 more time, 5 00:11.400 --> 00:15.610 this time, by making recommendations about what we should have in place 6 00:15.610 --> 00:17.200 regarding firewall rules. 7 00:17.200 --> 00:19.600 And I'm curious about this unknown group right here. 8 00:19.600 --> 00:24.200 Let me go ahead and right click and take a look at IP addresses involved. 9 00:24.200 --> 00:29.400 OIC, so 10.1.2.3 is my logical D-HEP services instead of NSX. 10 00:29.400 --> 00:34.400 224 is a multicast address, and then I've got a link local address as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:29.400 --> 00:34.400 224 is a multicast address, and then I've got a link local address as well. 11 00:34.400 --> 00:35.000 All good. 12 00:35.000 --> 00:36.600 So we'll click on close there. 13 00:36.600 --> 00:40.040 And let's imagine that we want to control the traffic between our web servers 14 00:40.040 --> 00:41.000 and our clients. 15 00:41.000 --> 00:44.610 What we can do is right click on that link there that represents the flow and 16 00:44.610 --> 00:47.000 go to flow details just to confirm what they are. 17 00:47.000 --> 00:48.000 Fantastic. 18 00:48.000 --> 00:49.800 So this is the tab for completed flows. 19 00:49.800 --> 00:52.400 There's also a tab here for active flows may close that. 20 00:52.400 --> 00:55.800 So for the recommendations, let's right click here on our clients group. 21 00:55.800 --> 00:59.000 And I have some recommendations that I ran earlier, but let's go ahead and 22 00:59.000 --> 01:00.200 start some new ones by right here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 22 00:59.000 --> 01:00.200 start some new ones by right here, 23 01:00.200 --> 01:02.600 clicking on start recommendation from the dropdown. 24 01:02.600 --> 01:06.200 So I right clicked on this clients group and then from the menu system here 25 01:06.200 --> 01:07.200 under action, 26 01:07.200 --> 01:09.400 I'm going to click right here on start recommendation. 27 01:09.400 --> 01:13.080 So I'm going to name this recommendation name client group recommendation for 28 01:13.080 --> 01:13.400 demo. 29 01:13.400 --> 01:16.350 And this warning is to get take a few minutes to complete the lab environment 30 01:16.350 --> 01:17.000 isn't that big. 31 01:17.000 --> 01:18.600 So it shouldn't take that long. 32 01:18.600 --> 01:21.540 And then if we scroll down, we have the option for actually specifying the 33 01:21.540 --> 01:21.800 scope. 34 01:21.800 --> 01:25.000 And you know what? Let's do this. Let's modify the name here and let's go ahead 35 01:25.000 --> 01:29.800 and call this demo for clients and web servers group. 36 01:29.800 --> 01:33.120 And then for the actual entities in the scope, I'm going to go ahead and click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 36 01:29.800 --> 01:33.120 And then for the actual entities in the scope, I'm going to go ahead and click 37 01:33.120 --> 01:34.000 on this hyperlink right here. 38 01:34.000 --> 01:37.070 Currently, I have one group because that's where I started and I want to go 39 01:37.070 --> 01:39.200 ahead and simply add a second group. 40 01:39.200 --> 01:42.400 So instead of just the clients, let me go ahead and do web servers. 41 01:42.400 --> 01:44.990 So for the recommendations it's going to make, it's going to include the 42 01:44.990 --> 01:47.800 clients group and its members there and the web servers. 43 01:47.800 --> 01:49.200 So then we'll click on save. 44 01:49.200 --> 01:53.170 So now it says two groups. And if we scroll down, here's the time range for the 45 01:53.170 --> 01:55.200 last hour, last 12 hours, etc. 46 01:55.200 --> 01:58.420 I'm going to choose the last hour. And then just for grants, let me expand 47 01:58.420 --> 02:00.200 advanced options as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 47 01:58.420 --> 02:00.200 advanced options as well. 48 02:00.200 --> 02:03.590 And then under advanced options, we have some additional nerd knobs that we can 49 02:03.590 --> 02:04.000 dial in. 50 02:04.000 --> 02:07.000 So we can go ahead and specify the traffic to analyze. 51 02:07.000 --> 02:10.400 Again, we have several options here. The ports and protocols to exclude. 52 02:10.400 --> 02:14.400 So by default, it's excluding the flows for multicast and broadcast. 53 02:14.400 --> 02:18.200 So if we wanted to include those, we can simply remove those as exclusions. 54 02:18.200 --> 02:22.350 And sometimes you may have a management system or a pen testing system out 55 02:22.350 --> 02:23.600 there that's authorized. 56 02:23.600 --> 02:27.600 You might want to exclude certain ports or protocols from the recommendations 57 02:27.600 --> 02:28.400 it's about to make. 58 02:28.400 --> 02:31.360 And then as we continue to scroll down, there's additional options regarding WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 58 02:28.400 --> 02:31.360 And then as we continue to scroll down, there's additional options regarding 59 02:31.360 --> 02:33.800 the rule recommendations and what the results are going to be. 60 02:33.800 --> 02:36.830 So as we continue to scroll down here, one of the options also is 61 02:36.830 --> 02:38.600 recommendation service type. 62 02:38.600 --> 02:43.400 So L4 services simply means recommendations based on layer three IP addresses 63 02:43.400 --> 02:45.400 and layer four protocols and ports, 64 02:45.400 --> 02:49.410 where if we said context profiles, it's actually looking at the application 65 02:49.410 --> 02:54.100 layer and making recommendations for our rules based on application layer 66 02:54.100 --> 02:54.800 information, 67 02:54.800 --> 03:00.800 such as is this really SSH or is this really SSL slash TLS versus is it just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 02:54.800 --> 03:00.800 such as is this really SSH or is this really SSL slash TLS versus is it just 68 03:00.800 --> 03:05.800 using TCP port 443 or for SSH TCP port 22. 69 03:05.800 --> 03:09.080 So for the demo, I'm going to go ahead and leave all the advanced settings at 70 03:09.080 --> 03:09.800 their defaults. 71 03:09.800 --> 03:13.880 And what we're really just looking at is a recommendation for firewall policy 72 03:13.880 --> 03:17.000 rules regarding traffic concerning these two groups. 73 03:17.000 --> 03:19.000 So we'll click right here on start discovery. 74 03:19.000 --> 03:22.600 So now it's letting us know that the recommendations discovery has started and 75 03:22.600 --> 03:24.200 that if we want to check on its status, 76 03:24.200 --> 03:26.600 we can go to the recommendations tab. 77 03:26.600 --> 03:29.600 So I'm going to click on dismiss here and that recommendations tab. 78 03:29.600 --> 03:32.600 If we didn't click on the hyperlink of that message, it is under plan and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 78 03:29.600 --> 03:32.600 If we didn't click on the hyperlink of that message, it is under plan and 79 03:32.600 --> 03:35.600 troubleshoot and on the left under discover and plan. 80 03:35.600 --> 03:38.000 It is right below discover and take action. 81 03:38.000 --> 03:41.000 So here is the recommendations section right here. 82 03:41.000 --> 03:43.000 So let's go ahead and click on recommendations. 83 03:43.000 --> 03:45.400 And here are a couple that I ran earlier. 84 03:45.400 --> 03:50.680 I did a test a little while ago and then I did yet another recommendation and I 85 03:50.680 --> 03:51.600 didn't apply it. 86 03:51.600 --> 03:54.200 And this is the entry right here that we just ran a moment ago. 87 03:54.200 --> 03:58.690 So here's the details for that recommendation that is currently processing over 88 03:58.690 --> 03:59.000 here. 89 03:59.000 --> 03:59.800 It has our two groups. 90 03:59.800 --> 04:03.200 If we click on that, it'll confirm for us what those groups are clients and web WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 90 03:59.800 --> 04:03.200 If we click on that, it'll confirm for us what those groups are clients and web 91 04:03.200 --> 04:03.800 servers. 92 04:03.800 --> 04:07.000 Great, great, great, and currently it shows us status of waiting. 93 04:07.000 --> 04:11.620 Let's click on refresh and in a moment or two or three that will change from 94 04:11.620 --> 04:14.400 waiting and it will show us that it's now processing. 95 04:14.400 --> 04:17.680 And then after processing, you'll eventually get to ready to publish where we 96 04:17.680 --> 04:21.600 can go ahead and review its recommendations and then decide to either edit and 97 04:21.600 --> 04:23.800 or push out those firewall rules. 98 04:23.800 --> 04:27.400 So let me click on refresh and sure enough discovery and progress. 99 04:27.400 --> 04:28.400 Okay, that looks good. 100 04:28.400 --> 04:32.460 And again, that may take anywhere between five and 30 minutes depending on your WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 100 04:28.400 --> 04:32.460 And again, that may take anywhere between five and 30 minutes depending on your 101 04:32.460 --> 04:33.000 topology. 102 04:33.000 --> 04:36.400 So we'll go ahead and give that a few minutes to complete right now. 103 04:36.400 --> 04:39.800 Actually, while it does, here are a couple of previous recommendations. 104 04:39.800 --> 04:43.450 And so as a sneak peek of what's about to happen, if we click on the three dots 105 04:43.450 --> 04:46.800 here, we have some options, including delete it, meaning I don't want this. 106 04:46.800 --> 04:50.700 Let's go ahead and not do it or let's go ahead and review the recommendations 107 04:50.700 --> 04:55.090 and then push them out or review the recommendations and then have it rerun the 108 04:55.090 --> 04:56.000 discovery. 109 04:56.000 --> 04:58.600 There's also options for exporting it as well. 110 04:58.600 --> 05:02.540 So while we're waiting for the one we just ran to finish, let's go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 110 04:58.600 --> 05:02.540 So while we're waiting for the one we just ran to finish, let's go ahead and 111 05:02.540 --> 05:05.800 click on three dots here and click on review and publish. 112 05:05.800 --> 05:08.600 So we can also expand and shrink this as well. 113 05:08.600 --> 05:11.970 So the green lines represent in its recommendations, the fact that we're going 114 05:11.970 --> 05:15.200 to be controlling the traffic and agreeing represents that we're permitting it. 115 05:15.200 --> 05:16.400 So we're going to the recommendations here. 116 05:16.400 --> 05:19.400 Let me give us a little bit more room by bringing that up here. 117 05:19.400 --> 05:23.140 The recommendations it has for us so we can rename the policies and the 118 05:23.140 --> 05:26.400 individual rules and modify them as we desire. 119 05:26.400 --> 05:29.600 And then once we're done, we could go ahead and push them out. 120 05:29.600 --> 05:32.000 So this is on a little example I did earlier. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 120 05:29.600 --> 05:32.000 So this is on a little example I did earlier. 121 05:32.000 --> 05:35.610 Let me go ahead and click on cancel and let's take a look at our status for the 122 05:35.610 --> 05:36.600 one we just ran. 123 05:36.600 --> 05:38.000 So let me go ahead and refresh this. 124 05:38.000 --> 05:40.400 And again, that may take a few minutes to complete. 125 05:40.400 --> 05:44.800 So we'll come back to this point right here once the discovery is completed. 126 05:44.800 --> 05:48.400 All right, and it is done ready to publish. 127 05:48.400 --> 05:50.800 So let's take a look at the results. 128 05:50.800 --> 05:54.470 So we'll click on the three dots and we'll click right here on review and 129 05:54.470 --> 05:55.200 publish. 130 05:55.200 --> 05:58.400 So here in the recommended policy, it involves four rules. 131 05:58.400 --> 05:59.400 So here's our policy. 132 05:59.400 --> 06:00.600 We could actually rename this right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 132 05:59.400 --> 06:00.600 We could actually rename this right here. 133 06:00.600 --> 06:01.600 Let me go ahead and do that. 134 06:01.600 --> 06:04.600 So I'll call this from recommendation press enter there. 135 06:04.600 --> 06:07.400 And then for this first rule, I just call this rule one. 136 06:07.400 --> 06:10.200 So for the first rule, here's the source and destination. 137 06:10.200 --> 06:14.640 There's a services, AKA the ports and protocols involved and the action is 138 06:14.640 --> 06:15.200 allow. 139 06:15.200 --> 06:18.130 And if we go down to rule two, let me go ahead and rename that so it's a little 140 06:18.130 --> 06:19.200 bit easier to read. 141 06:19.200 --> 06:22.830 And in a production environment, we want to go ahead and name these rules 142 06:22.830 --> 06:23.800 something meaningful. 143 06:23.800 --> 06:25.200 So when we see them, we'll know what they do. 144 06:25.200 --> 06:28.600 So for the source, we have our groups going anywhere looks like DNS. 145 06:28.600 --> 06:31.200 Again, we can click on the pencil and go in and edit that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 145 06:28.600 --> 06:31.200 Again, we can click on the pencil and go in and edit that. 146 06:31.200 --> 06:34.030 And this rule is going to be applied to those two groups and that's allowing 147 06:34.030 --> 06:35.000 that traffic. 148 06:35.000 --> 06:37.400 And then we have rule three, which also be called rule three. 149 06:37.400 --> 06:40.400 And that's from the clients group going to anywhere. 150 06:40.400 --> 06:45.910 If those services are HTTP, NTP or HTTPS and that's being applied to the groups 151 06:45.910 --> 06:46.800 and if we scroll down, 152 06:46.800 --> 06:49.200 here's rule four, I'll call that rule four. 153 06:49.200 --> 06:52.340 And then for rule four, we have the source and destination again, you can go in 154 06:52.340 --> 06:53.600 , verify what those details are. 155 06:53.600 --> 06:55.000 And then edit as needed. 156 06:55.000 --> 06:57.750 Or if you don't want to rule, for example, you just go ahead and say, you know 157 06:57.750 --> 06:58.600 what, click on that one 158 06:58.600 --> 07:01.000 and delete that rule and not include it at all. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 158 06:58.600 --> 07:01.000 and delete that rule and not include it at all. 159 07:01.000 --> 07:04.800 So let's assume that we want to take all those as they are with the only change 160 07:04.800 --> 07:06.600 we made was renaming the rules 161 07:06.600 --> 07:08.600 and we'll click right here on proceed. 162 07:08.600 --> 07:12.260 So here it's recommending that we put this new policy that's coming from the 163 07:12.260 --> 07:15.000 recommendation above our existing rules 164 07:15.000 --> 07:17.800 because we have existing rules that are denying certain types of traffic. 165 07:17.800 --> 07:20.800 We want to make sure any permits here are going to be placed above. 166 07:20.800 --> 07:23.200 So we can reorder and we sequences if we want. 167 07:23.200 --> 07:26.200 We'll go ahead and take them as they are and click on publish. 168 07:26.200 --> 07:29.200 It's asking us if for sure we'll go ahead and click on yes. 169 07:29.200 --> 07:33.340 And it gives us a message that it's done is now pushed out those firewall rules WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 169 07:29.200 --> 07:33.340 And it gives us a message that it's done is now pushed out those firewall rules 170 07:33.340 --> 07:35.200 and we can see them under the security tab. 171 07:35.200 --> 07:37.200 So we'll go ahead and click on dismiss here. 172 07:37.200 --> 07:40.540 So next if we go to the security tab right here and on the left under policy 173 07:40.540 --> 07:43.200 management, let's go down to the distributed firewall. 174 07:43.200 --> 07:46.620 And here in the distributed firewall, you'll notice we have our policy and 175 07:46.620 --> 07:48.200 there's the four rules. 176 07:48.200 --> 07:51.870 So in the background, I still have our traffic flows being generated from our 177 07:51.870 --> 07:53.600 two mint Linux clients. 178 07:53.600 --> 07:56.920 Some traffic is going out to the internet still and some traffic is going 179 07:56.920 --> 07:58.200 between our web servers. 180 07:58.200 --> 08:01.050 So back here at Discover and Take Action, I also want to just give you a heads WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 180 07:58.200 --> 08:01.050 So back here at Discover and Take Action, I also want to just give you a heads 181 08:01.050 --> 08:03.200 up that I spent about 15 minutes 182 08:03.200 --> 08:07.200 continuing to generate traffic before I brought this graphic up. 183 08:07.200 --> 08:11.080 So if we go here to groups and we go to compute and we choose our mint 184 08:11.080 --> 08:13.400 computers and also our web servers, 185 08:13.400 --> 08:16.400 it's going to be one way of looking at that traffic flow will click and apply. 186 08:16.400 --> 08:21.290 So notice here the traffic from the mint computer going over to the web server 187 08:21.290 --> 08:24.800 at 1066 and also to the web server here at 1055. 188 08:24.800 --> 08:29.040 That traffic flow shows up as green, which if we hover over indicates that it's 189 08:29.040 --> 08:30.000 allowed traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 190 08:30.000 --> 08:33.000 Also from those two mint computers is to go out to the internet. 191 08:33.000 --> 08:36.170 That traffic is being allowed as well based on the rules from the 192 08:36.170 --> 08:37.800 recommendation that we applied. 193 08:37.800 --> 08:40.910 And if we right click on that flow and then from the drop down choose flow 194 08:40.910 --> 08:41.400 details. 195 08:41.400 --> 08:45.570 It would give us details on what those flows are. So there's UDP traffic. There 196 08:45.570 --> 08:47.200 's some HTTP and HTTPS. 197 08:47.200 --> 08:50.200 And we can expand any of those sections to see more about that detail. 198 08:50.200 --> 08:54.000 So close that. Another way of looking that would be based on the groups. 199 08:54.000 --> 08:57.100 Now as part of the recommendations, it also made some new groups. 200 08:57.100 --> 09:01.070 So if we go back to inventory here and we go to groups, here's the two groups WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 200 08:57.100 --> 09:01.070 So if we go back to inventory here and we go to groups, here's the two groups 201 09:01.070 --> 09:03.200 that we created clients and web servers. 202 09:03.200 --> 09:06.710 And as part of the implementation of the recommendations, it created these 203 09:06.710 --> 09:09.500 groups for us, the group one and group two. 204 09:09.500 --> 09:13.170 And it use those groups as part of the rules. So if we go back to plan and 205 09:13.170 --> 09:16.200 troubleshoot and then left to discover and take action, 206 09:16.200 --> 09:19.770 we could go ahead and sort based on those groups as well. So from the drop down 207 09:19.770 --> 09:23.200 , we can say groups and then we could go ahead and choose those two groups. 208 09:23.200 --> 09:27.560 So I'll select both of those, click on apply. So this is right here between the 209 09:27.560 --> 09:30.900 clients group and we can right click on that just to verify the members there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 209 09:27.560 --> 09:30.900 clients group and we can right click on that just to verify the members there. 210 09:30.900 --> 09:34.800 So that should be still the two mint VMs. That's great. And then here on this 211 09:34.800 --> 09:37.700 group right here, we'll right click and click on members. 212 09:37.700 --> 09:43.100 Who the heck is that? Oh, that's our DNS server inside of NSX at 10.1.2.3. 213 09:43.100 --> 09:46.220 And just to confirm that let's go to networking and on the left, go down to 214 09:46.220 --> 09:49.100 networking profiles and DHCP. 215 09:49.100 --> 09:53.500 And sure enough, 10.1.2.3 is the IP address I'm using for my DHCP services. 216 09:53.500 --> 09:56.350 Again, we get a visualization regarding what's being allowed, meaning 217 09:56.350 --> 10:00.900 explicitly permitted as part of a firewall rule or what's being blocked. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 217 09:56.350 --> 10:00.900 explicitly permitted as part of a firewall rule or what's being blocked. 218 10:00.900 --> 10:03.910 Or currently, is this floor right here showing we have one that is currently 219 10:03.910 --> 10:04.900 still unprotected. 220 10:04.900 --> 10:08.560 So in this flow, it has one that's allowed and the one that's unprotected is 221 10:08.560 --> 10:10.700 our traffic going to the DHCP services. 222 10:10.700 --> 10:14.770 And then once again, we could leverage NSX to create recommendations for us and 223 10:14.770 --> 10:16.700 help us modify our firewall policies. 224 10:16.700 --> 10:19.780 So back in groups, if I wanted to just take a look at my clients and web 225 10:19.780 --> 10:23.100 servers groups, the ones I created and click on apply, once again, it can 226 10:23.100 --> 10:24.900 reflect that traffic and those flows. 227 10:24.900 --> 10:28.080 And if we go up and select computes, then we just choose the VMs that we're 228 10:28.080 --> 10:29.100 concerned about. 229 10:29.100 --> 10:32.700 We'll go ahead and use mint and mint and web and web. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 229 10:29.100 --> 10:32.700 We'll go ahead and use mint and mint and web and web. 230 10:32.700 --> 10:34.700 Again, let's just confirm the traffic flows there. 231 10:34.700 --> 10:38.010 So it looks like this right here, if I right click on it and click on flow 232 10:38.010 --> 10:38.700 details. 233 10:38.700 --> 10:41.620 So based on the flow information here, we have some traffic that is being 234 10:41.620 --> 10:42.700 explicitly permitted. 235 10:42.700 --> 10:44.300 That's this part right here. 236 10:44.300 --> 10:48.060 And then we have other traffic flows here in the red representing that traffic 237 10:48.060 --> 10:51.700 is not being permitted or denied explicitly by a firewall rule. 238 10:51.700 --> 10:54.960 So if we wanted to go in and either have NSX intelligence, make additional 239 10:54.960 --> 10:59.500 recommendations or go in manually and modify our firewall policies, we could. 240 10:59.500 --> 11:00.700 So we'll close that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 240 10:59.500 --> 11:00.700 So we'll close that. 241 11:00.700 --> 11:04.420 And again, all these green lines that show up here now are due to the policy 242 11:04.420 --> 11:08.700 changes that we implemented based on the recommendations from NSX intelligence. 243 11:08.700 --> 11:12.430 And for all of the red dotted lines here, that represents at least one 244 11:12.430 --> 11:13.700 unprotected flow. 245 11:13.700 --> 11:17.870 So for example, this right here between our mint computer, which is the mint on 246 11:17.870 --> 11:22.700 1055 and going up here to this web server on 1066. 247 11:22.700 --> 11:24.700 We have two flows that are allowed and one that's unprotected. 248 11:24.700 --> 11:28.700 And if we right click, it can show us the details on what's not being protected 249 11:28.700 --> 11:28.700 . 250 11:28.700 --> 11:31.700 And if click on the services here, it can show us what's being unprotected. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 250 11:28.700 --> 11:31.700 And if click on the services here, it can show us what's being unprotected. 251 11:31.700 --> 11:35.990 So it's the HGP services, which are not being blocked, but they simply are not 252 11:35.990 --> 11:39.700 being permitted or denied explicitly as part of a firewall rule. 253 11:39.700 --> 11:40.700 So we go ahead and close that. 254 11:40.700 --> 11:44.700 So up to this point, we've used NSX intelligence for three basic things. 255 11:44.700 --> 11:48.660 Number one, to go ahead and get a visualization regarding our traffic flows in 256 11:48.660 --> 11:49.700 our environment. 257 11:49.700 --> 11:53.170 And then secondly, we had to make recommendations for us regarding firewall 258 11:53.170 --> 11:53.700 rules. 259 11:53.700 --> 11:57.520 And then third, we actually published and pushed out those rules as part of a 260 11:57.520 --> 11:58.700 distributed firewall. 261 11:58.700 --> 12:02.940 And there is one additional really cool feature that NSX intelligence brings to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 261 11:58.700 --> 12:02.940 And there is one additional really cool feature that NSX intelligence brings to 262 12:02.940 --> 12:03.700 the table. 263 12:03.700 --> 12:08.700 And that is the ability to detect suspicious traffic on our networks. 264 12:08.700 --> 12:11.700 And you and I get to take a look at that feature next. 265 12:11.700 --> 12:13.700 So I'll see you in the next video for exactly that. 266 12:13.700 --> 12:14.560 exactly that.