WEBVTT

1
00:00.000 --> 00:02.680
So back at the NSX manager, if we go to the system tab,

2
00:02.680 --> 00:05.040
I just want to verify by clicking on the left here

3
00:05.040 --> 00:07.200
on the NSX application platform.

4
00:07.200 --> 00:09.360
I just want to verify that the malware prevention

5
00:09.360 --> 00:10.720
is fully activated.

6
00:10.720 --> 00:12.240
So if we scroll down the features,

7
00:12.240 --> 00:14.080
it shows activation was successful

8
00:14.080 --> 00:16.720
and that is currently fantastic.

9
00:16.720 --> 00:20.400
So if we click right here, go to NSX malware prevention,

10
00:20.400 --> 00:22.400
that's going to take us to the security tab,

11
00:22.400 --> 00:23.360
which is right here.

12
00:23.360 --> 00:25.440
And then under the threat event monitoring,

13
00:25.440 --> 00:27.760
it'll take us to the malware prevention.

14
00:27.760 --> 00:29.920
Now currently it's not showing us any events

15
00:29.920 --> 00:33.120
because we don't have malware prevention included
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.920 --> 00:33.120
because we don't have malware prevention included

16
00:33.120 --> 00:35.360
as part of any of our firewall policies.

17
00:35.360 --> 00:37.360
So to fix that, what we're going to do is we're going to down

18
00:37.360 --> 00:40.320
under policy management to the IDS/IPS

19
00:40.320 --> 00:42.640
and malware prevention section once again.

20
00:42.640 --> 00:43.680
And then here in the main pane,

21
00:43.680 --> 00:45.600
we're going to click on profiles.

22
00:45.600 --> 00:48.640
So there are profiles for IDS/IPS

23
00:48.640 --> 00:50.560
and there are profiles for malware prevention.

24
00:50.560 --> 00:53.120
So we've done the IDS/IPS previously.

25
00:53.120 --> 00:54.880
So we'll click here under profiles.

26
00:54.880 --> 00:57.520
We'll click on the sub tab for malware prevention.

27
00:57.520 --> 00:59.120
Here is the default.

28
00:59.120 --> 01:00.480
And what we're going to do is we're going to go ahead
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.120 --> 01:00.480
And what we're going to do is we're going to go ahead

29
01:00.480 --> 01:01.520
and create our own.

30
01:01.520 --> 01:04.400
So to create a profile, we'll click right here on add profile.

31
01:04.400 --> 01:07.040
Let's call this our malware profile.

32
01:07.040 --> 01:08.720
And then for the submission criteria,

33
01:08.720 --> 01:11.360
we can specify the type of files that we want to check for

34
01:11.360 --> 01:12.640
regarding malware.

35
01:12.640 --> 01:14.720
And then we have a checkbox here that allows us,

36
01:14.720 --> 01:18.480
if it's checked to send the files to VMware's NSX ATP,

37
01:18.480 --> 01:21.440
that's the advanced threat protection services in the cloud.

38
01:21.440 --> 01:23.760
So I'm going to leave checks in all those checkboxes

39
01:23.760 --> 01:25.200
and we'll click on save.

40
01:25.200 --> 01:29.120
So now we have a malware profile called our malware profile.

41
01:29.120 --> 01:30.560
We'll click on refresh there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.120 --> 01:30.560
We'll click on refresh there.

42
01:30.560 --> 01:31.200
That looks great.

43
01:31.200 --> 01:34.640
Now the second thing we want to do to make sure we can use this

44
01:34.640 --> 01:38.160
is we want to include it as part of a policy rule.

45
01:38.160 --> 01:40.640
So to do that, we're going to go to our gateway rules.

46
01:40.640 --> 01:42.800
So once again, we're on the security tab here

47
01:42.800 --> 01:46.800
and over here on the left, we're under IPS/IDS and malware prevention.

48
01:46.800 --> 01:48.960
Then we're going to click right here on gateway rules

49
01:48.960 --> 01:50.800
and then we're going to go to gateway specific rules.

50
01:50.800 --> 01:54.960
So right now it's warning me that IDS/IPS is deactivated

51
01:54.960 --> 01:56.560
for this tier one gateway.

52
01:56.560 --> 01:58.960
And that's okay because we're not going to use IDS/IPS.

53
01:58.960 --> 02:00.640
We're just going to focus here on anti-malware.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:58.960 --> 02:00.640
We're just going to focus here on anti-malware.

54
02:00.640 --> 02:03.600
So I'll close that message and then we'll create a new policy.

55
02:03.600 --> 02:05.600
So we'll click right here on add policy.

56
02:05.600 --> 02:07.120
And then we collapse the left hand side,

57
02:07.120 --> 02:08.640
it gives a little bit more room.

58
02:08.640 --> 02:13.440
And let's go ahead and call this our anti-policy.

59
02:13.440 --> 02:14.880
So there's the name of our policy.

60
02:14.880 --> 02:17.680
It's also warning us that, hey, unless you add at least one rule

61
02:17.680 --> 02:19.520
to this policy, it's not doing a whole lot.

62
02:19.520 --> 02:21.360
So we'll go ahead and click on the three dots

63
02:21.360 --> 02:24.720
and we'll add a rule by clicking on add rule.

64
02:24.720 --> 02:26.480
And we'll call this rule no malware.

65
02:26.480 --> 02:27.920
And so for the source and destination,

66
02:27.920 --> 02:30.320
we'll leave that as any and the service as any.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:27.920 --> 02:30.320
we'll leave that as any and the service as any.

67
02:30.320 --> 02:31.680
And then for the security profile,

68
02:31.680 --> 02:33.440
we'll click on the pencil right here.

69
02:33.440 --> 02:34.960
And then we'll click on the tab here

70
02:34.960 --> 02:37.280
for malware prevention profile.

71
02:37.280 --> 02:39.920
And then we'll select our malware prevention profile

72
02:39.920 --> 02:40.960
that we just made.

73
02:40.960 --> 02:43.440
So with that selected, we'll then apply it.

74
02:43.440 --> 02:45.520
So this rule, as part of our policy,

75
02:45.520 --> 02:47.520
which is applied to our tier one gateway,

76
02:47.520 --> 02:49.920
is going to be looking for malware.

77
02:49.920 --> 02:51.040
And here in the applied two column,

78
02:51.040 --> 02:52.160
it's showing that it's going to be applied

79
02:52.160 --> 02:53.680
just to the tier one gateway.

80
02:53.680 --> 02:55.440
And then for the mode, we have two options,

81
02:55.440 --> 02:57.760
detect only or detect and prevent.

82
02:57.760 --> 03:00.800
So initially, if you're just setting a new environment up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
02:57.760 --> 03:00.800
So initially, if you're just setting a new environment up

83
03:00.800 --> 03:03.280
and you don't want to accidentally have false positives

84
03:03.280 --> 03:05.360
or maybe drop some traffic that shouldn't be dropped,

85
03:05.360 --> 03:08.640
you can do detect only, then take a look at the results

86
03:08.640 --> 03:11.680
and then move it over after time, over to detect and prevent

87
03:11.680 --> 03:13.800
once you're sure you're not going to have false positives.

88
03:13.800 --> 03:16.560
So I'm going to go ahead and click on publish

89
03:16.560 --> 03:18.000
and that's going to push that out.

90
03:18.000 --> 03:19.520
And we'll click on a refresh there

91
03:19.520 --> 03:22.040
just to make sure it pushed out successfully.

92
03:22.040 --> 03:22.880
Awesome.

93
03:22.880 --> 03:25.040
So now if we went back to networking

94
03:25.040 --> 03:27.400
and we went down to network topology

95
03:27.400 --> 03:29.200
and we look at our tier one gateway,

96
03:29.200 --> 03:30.960
it currently has DHCP services.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:29.200 --> 03:30.960
it currently has DHCP services.

97
03:30.960 --> 03:32.960
It also has the gateway firewall rules

98
03:32.960 --> 03:36.720
that include the rule looking for malware

99
03:36.720 --> 03:39.800
and if it sees it, it should go ahead and create an alert.

100
03:39.800 --> 03:41.300
Now we have a couple of options here.

101
03:41.300 --> 03:42.840
Now that we've implemented our policy

102
03:42.840 --> 03:44.760
for malware prevention and that is,

103
03:44.760 --> 03:47.720
we could just hope it works or we could do some testing

104
03:47.720 --> 03:49.200
to verify that it works.

105
03:49.200 --> 03:51.240
And that's the option I'd like to do with you

106
03:51.240 --> 03:52.080
in the next video.

107
03:52.080 --> 03:54.320
Is to test and verify whether or not

108
03:54.320 --> 03:58.360
our malware prevention policy correctly identifies malware.