WEBVTT 1 00:00.000 --> 00:01.400 And welcome back. 2 00:01.400 --> 00:05.700 So for the NSX application platform, it is currently up and running. 3 00:05.700 --> 00:10.700 The feature for NSX malware prevention is enabled on the security tab on the 4 00:10.700 --> 00:11.200 left with 5 00:11.200 --> 00:13.600 IDS/IPSM malware prevention selected. 6 00:13.600 --> 00:18.400 If you go to settings, we have enabled the ability for our gateway to use 7 00:18.400 --> 00:19.400 malware prevention. 8 00:19.400 --> 00:22.300 And then furthermore, we went to our gateway rules. 9 00:22.300 --> 00:27.200 We created a policy with one rule looking for malware with detect only. 10 00:27.200 --> 00:29.400 And that's being applied to our tier one gateway. 11 00:29.400 --> 00:34.690 So now to test this, let's go ahead and go to a VM that has access to the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:29.400 --> 00:34.690 So now to test this, let's go ahead and go to a VM that has access to the 12 00:34.690 --> 00:35.400 Internet. 13 00:35.400 --> 00:40.410 So if we go to our topology view for the network down here off segment 1055, I 14 00:40.410 --> 00:40.700 've got 15 00:40.700 --> 00:47.500 three VMs and let's go ahead and let's use this one right here mint on 105500. 16 00:47.500 --> 00:51.800 And just to confirm that VM's traffic is going to go through this tier one 17 00:51.800 --> 00:52.400 gateway as it 18 00:52.400 --> 00:53.700 goes out to the Internet. 19 00:53.700 --> 00:56.000 So let's go to the remote console for that VM. 20 00:56.000 --> 01:01.600 So here is that VM and let's verify its IP address with an IF config. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 20 00:56.000 --> 01:01.600 So here is that VM and let's verify its IP address with an IF config. 21 01:01.600 --> 01:04.800 And that's at 105500.151. 22 01:04.800 --> 01:09.610 We'll do a route to take a look at a steeple gateway 105501, which is the 23 01:09.610 --> 01:10.600 logical interface 24 01:10.600 --> 01:12.400 on our tier one gateway. 25 01:12.400 --> 01:16.230 And just verify we go all the way up to the Internet will do a ping to www.vm 26 01:16.230 --> 01:17.900 ware.com. 27 01:17.900 --> 01:21.570 And that is looking good name resolution works, Internet access work, we're in 28 01:21.570 --> 01:22.000 good shape. 29 01:22.000 --> 01:23.900 So let's go ahead and test our malware policy. 30 01:23.900 --> 01:28.730 Now, I really don't want to bring live malware down to this little VM, even 31 01:28.730 --> 01:29.900 though it'd be 32 01:29.900 --> 01:31.500 pretty easy to recreate it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 32 01:29.900 --> 01:31.500 pretty easy to recreate it. 33 01:31.500 --> 01:34.240 If we have malware that's bad enough, it could start spreading and that would 34 01:34.240 --> 01:34.900 not be good. 35 01:34.900 --> 01:38.940 So let's use a test file to test the malware. 36 01:38.940 --> 01:42.920 So we'll open up a browser and one of the very popular test files out there is 37 01:42.920 --> 01:43.280 from 38 01:43.280 --> 01:44.280 I car. 39 01:44.280 --> 01:48.540 So we could go directly to the source to icar.org using a test file like that. 40 01:48.540 --> 01:52.290 That's not malicious, but it should trigger is a great way of doing testing 41 01:52.290 --> 01:52.980 because that 42 01:52.980 --> 01:57.180 way we're not accidentally bringing in malware just because we're testing our 43 01:57.180 --> 01:58.700 security appliances. 44 01:58.700 --> 02:01.780 Also, there's something super important that I just realized that we should WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 44 01:58.700 --> 02:01.780 Also, there's something super important that I just realized that we should 45 02:01.780 --> 02:02.900 chat about. 46 02:02.900 --> 02:04.540 And that is encryption. 47 02:04.540 --> 02:09.000 Now encryption is a fantastic option to protect data to make sure that 48 02:09.000 --> 02:10.800 unauthorized individuals 49 02:10.800 --> 02:12.500 can't see what's going on. 50 02:12.500 --> 02:16.000 So if we have a client computer down here, for example, that is going out to 51 02:16.000 --> 02:16.700 the Internet 52 02:16.700 --> 02:22.200 to a server on the Internet, we're very likely going to be using HTTPS with TLS 53 02:22.200 --> 02:23.060 , transport 54 02:23.060 --> 02:24.060 layer security. 55 02:24.060 --> 02:26.140 In the old days that was referred to as SSL. 56 02:26.140 --> 02:28.060 That was the original technology for that. 57 02:28.060 --> 02:31.260 But at the end of the day, we have an encrypted session leveraging HTTPS so WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 57 02:28.060 --> 02:31.260 But at the end of the day, we have an encrypted session leveraging HTTPS so 58 02:31.260 --> 02:32.220 that if an eavesdropper 59 02:32.220 --> 02:36.110 is looking at that traffic, it won't be able to tell what's really going on at 60 02:36.110 --> 02:36.740 the payload 61 02:36.740 --> 02:43.810 because that payload is all encrypted, including if we download a test file via 62 02:43.810 --> 02:44.740 HTTPS. 63 02:44.740 --> 02:48.350 And that's because the device who's sitting here in the middle, which is our NS 64 02:48.350 --> 02:49.140 X environment, 65 02:49.140 --> 02:52.700 it doesn't have the keys to unlock that data that's being encrypted and den 66 02:52.700 --> 02:53.460 encrypted by 67 02:53.460 --> 02:56.260 the server at this end and the client over here. 68 02:56.260 --> 02:59.560 So let me share with you the option that many companies implement to get around 69 02:59.560 --> 03:00.020 that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 69 02:59.560 --> 03:00.020 that. 70 03:00.020 --> 03:03.740 What they're going to do is to use something called a TLS proxy. 71 03:03.740 --> 03:08.180 And this feature is implemented by anybody who really wants to see that data. 72 03:08.180 --> 03:12.380 And the way it works is the client, as it goes out, they're actually being prox 73 03:12.380 --> 03:12.540 ied at 74 03:12.540 --> 03:15.610 this device, which is normally a firewall, but in this case, it also could be 75 03:15.610 --> 03:16.900 our NSX environment. 76 03:16.900 --> 03:19.420 So there's actually two HTTPS sessions. 77 03:19.420 --> 03:21.900 There's a session here from the client to this proxy. 78 03:21.900 --> 03:25.100 And then there's a session from that device out to the server. 79 03:25.100 --> 03:29.180 And here in the mind of that device, just for a moment, is that data un 80 03:29.180 --> 03:30.140 encrypted. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 80 03:29.180 --> 03:30.140 encrypted. 81 03:30.140 --> 03:34.080 And the reason I pointed out right now is that if we went out and we downloaded 82 03:34.080 --> 03:34.940 a virus 83 03:34.940 --> 03:39.420 and we were using HTTPS and NSX because we haven't yet implemented TLS 84 03:39.420 --> 03:40.420 inspection and 85 03:40.420 --> 03:46.300 TLS proxy and NSX would not be able to decode the content of that file. 86 03:46.300 --> 03:50.300 And as a result, it wouldn't be able to identify that it was malware. 87 03:50.300 --> 03:55.480 Another gotcha is that if we have a zip file and a zip file has a password and 88 03:55.480 --> 03:55.820 because 89 03:55.820 --> 03:59.980 the device in the middle, even if it's enabled for TLS proxy and decryption, if 90 03:59.980 --> 04:00.700 it doesn't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 90 03:59.980 --> 04:00.700 it doesn't 91 04:00.700 --> 04:04.850 have the password for the zip file, it then can't actually take a look at the 92 04:04.850 --> 04:05.940 real contents. 93 04:05.940 --> 04:08.550 Because once again, that device in the middle doesn't have full access to see 94 04:08.550 --> 04:09.060 what really 95 04:09.060 --> 04:10.060 is in the payload. 96 04:10.060 --> 04:14.710 So for this demonstration to bypass all that and just to test the anti malware 97 04:14.710 --> 04:16.140 capabilities, 98 04:16.140 --> 04:22.180 I'm going to go ahead and download the I-Car test file using HTTP instead of 99 04:22.180 --> 04:23.100 HTTPS. 100 04:23.100 --> 04:26.770 And that way we can do a fair test to verify whether or not the NSX can 101 04:26.770 --> 04:27.860 actually detect 102 04:27.860 --> 04:28.860 the malware. 103 04:28.860 --> 04:33.280 And in a production environment, we want to enable the full TLS inspection and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 04:28.860 --> 04:33.280 And in a production environment, we want to enable the full TLS inspection and 104 04:33.280 --> 04:33.820 proxy, 105 04:33.820 --> 04:36.700 which involves setting up certificates that our clients trust. 106 04:36.700 --> 04:40.350 And that way, after that's in place, then the NSX environment can do its own 107 04:40.350 --> 04:41.100 decryption 108 04:41.100 --> 04:45.720 of the content, then run its own policy for the malware prevention to identify 109 04:45.720 --> 04:46.380 malicious 110 04:46.380 --> 04:47.380 traffic. 111 04:47.380 --> 04:49.460 All right, so let me go ahead and clean that up. 112 04:49.460 --> 04:50.460 That looks better. 113 04:50.460 --> 04:54.380 And let's go ahead and grab a copy of that file, which is not encrypted. 114 04:54.380 --> 04:56.340 So let's go out to Kapursky. 115 04:56.340 --> 04:57.340 So they've got a copy. 116 04:57.340 --> 04:59.720 I know because I tested it a little bit earlier today, they've got a copy of 117 04:59.720 --> 05:00.500 that file with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 117 04:59.720 --> 05:00.500 that file with 118 05:00.500 --> 05:02.500 HTTP only. 119 05:02.500 --> 05:06.210 And I think if we go to the I-Car, the official site, they've just got 120 05:06.210 --> 05:07.620 encrypted HTTPS versions 121 05:07.620 --> 05:08.620 of it. 122 05:08.620 --> 05:10.620 So let me scroll down here. 123 05:10.620 --> 05:16.620 And here is a link right there, the icar.zip archive via HTTP. 124 05:16.620 --> 05:18.220 So we'll click on that. 125 05:18.220 --> 05:19.740 And okay, so I have a warning here. 126 05:19.740 --> 05:22.220 Now this is my browser warning me about that. 127 05:22.220 --> 05:25.260 So I'll go ahead and say, please allow the download. 128 05:25.260 --> 05:30.060 And because the policy on NSX is just to detect that download should work just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 128 05:25.260 --> 05:30.060 And because the policy on NSX is just to detect that download should work just 129 05:30.060 --> 05:30.620 fine. 130 05:30.620 --> 05:34.190 But again, the goal of doing that download of that test file was to verify 131 05:34.190 --> 05:34.780 whether or 132 05:34.780 --> 05:37.820 not the policy that we have in place is currently working. 133 05:37.820 --> 05:43.080 So once again, that policy is under security under policy management, IDS/IPS 134 05:43.080 --> 05:44.020 and malware 135 05:44.020 --> 05:48.100 prevention, gateway rules, and there's our policy right there. 136 05:48.100 --> 05:51.420 So here is a little stats window over on the right, right there. 137 05:51.420 --> 05:55.010 And so sometimes there's a little lag between like five and 10 minutes before 138 05:55.010 --> 05:55.300 hits will 139 05:55.300 --> 05:56.300 show up. 140 05:56.300 --> 05:58.260 So let me go ahead and click on the stats window. 141 05:58.260 --> 06:00.140 And sure enough, hits count too. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 141 05:58.260 --> 06:00.140 And sure enough, hits count too. 142 06:00.140 --> 06:03.820 And here's the little reminder in blue saying that the statistics may be stale 143 06:03.820 --> 06:04.740 as the aggregated 144 06:04.740 --> 06:07.900 states are computed every 15 minutes. 145 06:07.900 --> 06:11.900 So now that our malware prevention policy has identified that malware was 146 06:11.900 --> 06:12.620 attempting 147 06:12.620 --> 06:15.630 to come into our network or because of the detect only it did come into our 148 06:15.630 --> 06:16.180 network, 149 06:16.180 --> 06:19.630 we can monitor that and see the details of that by once again clicking here on 150 06:19.630 --> 06:20.140 security 151 06:20.140 --> 06:23.980 and the security tab on the left under threat event monitoring, we'll click 152 06:23.980 --> 06:24.700 right here on 153 06:24.700 --> 06:26.220 malware prevention. 154 06:26.220 --> 06:30.160 And currently it's showing us for the last hour and then we can set the last 12 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 154 06:26.220 --> 06:30.160 And currently it's showing us for the last hour and then we can set the last 12 155 06:30.160 --> 06:30.620 hours 156 06:30.620 --> 06:32.380 or 24 hours, et cetera, et cetera. 157 06:32.380 --> 06:35.960 So I'm going to have it show us just for the last hour and there is our event 158 06:35.960 --> 06:36.740 right there. 159 06:36.740 --> 06:40.300 So if we hover over that in the pop up, it's showing the file hash associated 160 06:40.300 --> 06:40.860 with that 161 06:40.860 --> 06:41.860 malicious content. 162 06:41.860 --> 06:46.670 And if we go down here below and scroll down and expand this event and let me 163 06:46.670 --> 06:47.460 collapse the 164 06:47.460 --> 06:51.100 left hand side gives a little bit more room here showing the verdict. 165 06:51.100 --> 06:54.950 So malicious files are going to have a verdict between 70 and 100 suspicious 166 06:54.950 --> 06:55.740 will be between 167 06:55.740 --> 06:57.340 30 and 69. 168 06:57.340 --> 07:01.000 And in the event that there's a file that NSX isn't sure about, it can send WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 168 06:57.340 --> 07:01.000 And in the event that there's a file that NSX isn't sure about, it can send 169 07:01.000 --> 07:01.540 that up to 170 07:01.540 --> 07:05.220 the cloud for near real time analysis. 171 07:05.220 --> 07:08.940 So here's the malware family, the malware class last inspected. 172 07:08.940 --> 07:11.100 There's the shock to do six file hash. 173 07:11.100 --> 07:14.420 And as we continue to scroll down, there's the server where we downloaded it 174 07:14.420 --> 07:14.940 from that 175 07:14.940 --> 07:20.610 came down to our client at 1055 0151 and also has details about the file type 176 07:20.610 --> 07:21.300 and the details 177 07:21.300 --> 07:24.820 for that file and the protocol and total inspection. 178 07:24.820 --> 07:27.760 So if we click here on the four, it's showing me the number of times I tried to 179 07:27.760 --> 07:28.260 download 180 07:28.260 --> 07:29.260 that file. 181 07:29.260 --> 07:32.100 So these are the two that I did during the initial demo. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 181 07:29.260 --> 07:32.100 So these are the two that I did during the initial demo. 182 07:32.100 --> 07:35.700 And then when I went back to get a little more hit counts, I tried two more 183 07:35.700 --> 07:36.340 times right 184 07:36.340 --> 07:37.340 here. 185 07:37.340 --> 07:38.900 So we'll go ahead and click on close for that. 186 07:38.900 --> 07:42.470 And for some malware, there will also be a separate link for a reports option 187 07:42.470 --> 07:42.700 for more 188 07:42.700 --> 07:44.860 details about that malicious software.