WEBVTT

1
00:00.000 --> 00:04.000
And as a quick reminder of all the many wonderful things that the NAP can bring

2
00:04.000 --> 00:04.680
to the table

3
00:04.680 --> 00:09.090
to include NSX intelligence, which we've looked at in a previous skill, the

4
00:09.090 --> 00:09.680
ability to do

5
00:09.680 --> 00:14.690
network detection and response, which can give us a big picture correlated view

6
00:14.690 --> 00:15.000
of our

7
00:15.000 --> 00:16.960
network activity and what's going on.

8
00:16.960 --> 00:19.240
Metrics is also included in the list.

9
00:19.240 --> 00:23.960
And what I want to focus on in this set of videos is NSX malware prevention.

10
00:23.960 --> 00:28.370
And here's the overall process of implementing this feature of the malware

11
00:28.370 --> 00:29.320
prevention.

12
00:29.320 --> 00:33.520
Number one is we need to have the NSX application platform deployed.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.320 --> 00:33.520
Number one is we need to have the NSX application platform deployed.

13
00:33.520 --> 00:35.360
So we did that a couple of skills ago.

14
00:35.360 --> 00:39.100
And then secondly, we need to activate the feature of the NSX malware

15
00:39.100 --> 00:40.040
prevention, very

16
00:40.040 --> 00:43.640
much like how we enable the feature of NSX intelligence.

17
00:43.640 --> 00:47.770
We go down under the NSX application platform and we click on the tile to

18
00:47.770 --> 00:49.600
activate that feature.

19
00:49.600 --> 00:51.720
It does some pre checks and away we go.

20
00:51.720 --> 00:54.080
So that's step number one, step number two.

21
00:54.080 --> 00:56.940
And then once we've been able to feature, we then want to go in and enable it

22
00:56.940 --> 00:57.120
on our

23
00:57.120 --> 01:01.220
gateways, specifically the gateways where we want to implement the malware
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:57.120 --> 01:01.220
gateways, specifically the gateways where we want to implement the malware

24
01:01.220 --> 01:01.600
prevention.

25
01:01.600 --> 01:03.240
So that'd be step number three.

26
01:03.240 --> 01:06.700
And then once it's enabled, we then go ahead to step number four and create a

27
01:06.700 --> 01:07.200
profile.

28
01:07.200 --> 01:10.810
And in that profile, it's going to specify what it is we're willing to accept

29
01:10.810 --> 01:11.200
or not

30
01:11.200 --> 01:13.840
accept or look for as part of the malware.

31
01:13.840 --> 01:18.020
So we create a profile and the fifth step is to take that profile and include

32
01:18.020 --> 01:18.400
it in

33
01:18.400 --> 01:22.280
a rule as part of a anti-malware policy.

34
01:22.280 --> 01:25.120
That's then applied to the firewall and away we go.

35
01:25.120 --> 01:29.180
So between now and the previous skill when we looked at NSX intelligence, I

36
01:29.180 --> 01:29.920
removed the

37
01:29.920 --> 01:34.550
existing NSX topology and I redeployed the edge notes because I needed the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.920 --> 01:34.550
existing NSX topology and I redeployed the edge notes because I needed the

38
01:34.550 --> 01:35.520
extra large

39
01:35.520 --> 01:40.030
edge notes to be able to support the anti-malware or malware prevention

40
01:40.030 --> 01:41.840
features at the gateways.

41
01:41.840 --> 01:45.030
So just to share with you what I currently have, let me give you a peek at the

42
01:45.030 --> 01:45.800
topology.

43
01:45.800 --> 01:50.420
If we go down to network topology and take a look, I currently have a tier zero

44
01:50.420 --> 01:51.040
gateway

45
01:51.040 --> 01:54.550
that we zoom in a little bit so that tier zero gateway is connected to an

46
01:54.550 --> 01:55.520
external router

47
01:55.520 --> 02:00.960
with two edge interfaces, and I'm also supporting DHCP and that here as well
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:55.520 --> 02:00.960
with two edge interfaces, and I'm also supporting DHCP and that here as well

48
02:00.960 --> 02:01.520
for the ability

49
02:01.520 --> 02:03.840
for customers to get up to the real internet.

50
02:03.840 --> 02:08.720
Then if we scroll down, I have a tier one gateway and here the tier one gateway

51
02:08.720 --> 02:08.880
I have

52
02:08.880 --> 02:09.840
two services.

53
02:09.840 --> 02:11.160
I've got a gateway firewall rules.

54
02:11.160 --> 02:13.840
The default ones are in place and DHCP services.

55
02:13.840 --> 02:19.960
As we scroll down, I have two segments 1055 and 1066 and I've got some VMs that

56
02:19.960 --> 02:20.400
are connected

57
02:20.400 --> 02:24.810
to each of those including a Linux Mint machine and also an intentionally

58
02:24.810 --> 02:26.240
vulnerable Metasplatable

59
02:26.240 --> 02:27.600
system should we need it.

60
02:27.600 --> 02:32.360
So those are all on the 1066 network and then over here on the 1055 network, I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:27.600 --> 02:32.360
So those are all on the 1066 network and then over here on the 1055 network, I

61
02:32.360 --> 02:32.600
've got a

62
02:32.600 --> 02:34.520
Kali Linux box that we can use for attacks.

63
02:34.520 --> 02:37.720
I've got a little web server and I also have a little Linux Mint computer right

64
02:37.720 --> 02:38.080
here as

65
02:38.080 --> 02:40.880
well all on the 1055 network.

66
02:40.880 --> 02:44.150
And if we click here on the system tab and on the left, if we click on the NSX

67
02:44.150 --> 02:44.840
application

68
02:44.840 --> 02:47.760
platform, currently the platform shows as stable.

69
02:47.760 --> 02:48.760
That's a good sign.

70
02:48.760 --> 02:53.260
And if we scroll down to the feature section, I have the metrics which is

71
02:53.260 --> 02:54.160
enabled and I

72
02:54.160 --> 02:56.840
have NSX intelligence which we could enable.

73
02:56.840 --> 03:01.740
I have the NSX network detection and response which can be used for correlation
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:56.840 --> 03:01.740
I have the NSX network detection and response which can be used for correlation

74
03:01.740 --> 03:03.000
and visualization

75
03:03.000 --> 03:04.440
of our network traffic and events.

76
03:04.440 --> 03:07.960
And then we have this tile right here for the NSX malware prevention.

77
03:07.960 --> 03:12.070
So because this process takes about 10 to 15 minutes to enable, let me go ahead

78
03:12.070 --> 03:12.480
and click

79
03:12.480 --> 03:13.480
on activate.

80
03:13.480 --> 03:16.510
I'm going to go ahead and choose the region of the United States and then we'll

81
03:16.510 --> 03:17.080
go ahead

82
03:17.080 --> 03:19.640
and click right here to run the Pre-checks.

83
03:19.640 --> 03:21.200
So for the Pre-checks it's validating.

84
03:21.200 --> 03:22.840
I have a license.

85
03:22.840 --> 03:26.560
It's also going to validate that it can reach the cloud services.

86
03:26.560 --> 03:29.940
It's also going to verify that the license I have entitles me to use those

87
03:29.940 --> 03:30.600
services.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:29.940 --> 03:30.600
services.

88
03:30.600 --> 03:32.520
So I'm using for all of these labs.

89
03:32.520 --> 03:36.500
The licensing I'm using are the ones I got through V-MUG Advantage which

90
03:36.500 --> 03:37.800
includes a one-year

91
03:37.800 --> 03:42.960
e-val license for many of the products from VMware including NSX, Tanzu and

92
03:42.960 --> 03:43.640
more.

93
03:43.640 --> 03:47.730
So in the United States that runs for about 200 bucks a year for the V-MUG

94
03:47.730 --> 03:49.080
Advantage membership

95
03:49.080 --> 03:51.560
and those are the licenses that I'm currently using.

96
03:51.560 --> 03:55.060
So the Pre-checks all pass, that's great news and so we'll go ahead and click

97
03:55.060 --> 03:55.880
on activate.

98
03:55.880 --> 03:59.970
And again this process right here will take about 10 minutes to go ahead and

99
03:59.970 --> 04:00.720
activate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
03:59.970 --> 04:00.720
activate.

100
04:00.720 --> 04:02.520
And that is not the only activation we need to do.

101
04:02.520 --> 04:05.750
We also need to go into the gateways where we want to use the anti-malware and

102
04:05.750 --> 04:06.120
actually

103
04:06.120 --> 04:09.240
enable those gateways so they can use those policies.

104
04:09.240 --> 04:12.190
And then once we've told the gateways that we want them to be able to use those

105
04:12.190 --> 04:12.840
policies,

106
04:12.840 --> 04:16.040
we then need to create the profiles and the actual policies themselves and

107
04:16.040 --> 04:16.720
associate them

108
04:16.720 --> 04:17.880
with the gateways.

109
04:17.880 --> 04:22.290
So we'll continue this process of enabling the function of the anti-malware in

110
04:22.290 --> 04:22.640
the very

111
04:22.640 --> 04:23.640
next video.

112
04:23.640 --> 04:25.000
So I'll see you there in just a moment.