WEBVTT 1 00:00.000 --> 00:04.000 So now that you have the opportunity to take a look at a few of the screenshots 2 00:04.000 --> 00:06.000 regarding the customer's environment, 3 00:06.000 --> 00:11.010 let's together validate, first of all, that the client can actually download 4 00:11.010 --> 00:12.500 these test malware files. 5 00:12.500 --> 00:17.030 And then secondly, we'll take a look at why that's still being allowed, even 6 00:17.030 --> 00:21.000 though the customer believes they've implemented the policies to prevent that. 7 00:21.000 --> 00:26.300 So let's start with our test VM. And so here is our little Mint Linux VM here 8 00:26.300 --> 00:27.000 in the vSphere clients. 9 00:27.000 --> 00:31.000 We'll right click and from the menu, we'll click on open remote console. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 9 00:27.000 --> 00:31.000 We'll right click and from the menu, we'll click on open remote console. 10 00:31.000 --> 00:34.840 So here is the remote console for that little VM. Let's just do a couple of 11 00:34.840 --> 00:36.000 quick verification checks. 12 00:36.000 --> 00:40.000 So at the command line, let's just verify that we can get out to the internet. 13 00:40.000 --> 00:44.000 We'll do a ping out to www.vmware.com. 14 00:44.000 --> 00:47.890 So we have internet access. Great. We have name resolution. That's great. So 15 00:47.890 --> 00:49.000 let's open up a browser. 16 00:49.000 --> 00:52.500 And from the browser, it'd make a lot of sense to go ahead and validate what 17 00:52.500 --> 00:55.000 the customer tried to download as far as a test file. 18 00:55.000 --> 00:58.170 And then we want to replicate that so we can see it. So it looked to me based 19 00:58.170 --> 01:02.340 on the screenshots that they were downloading some sample malware files from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 19 00:58.170 --> 01:02.340 on the screenshots that they were downloading some sample malware files from 20 01:02.340 --> 01:04.000 Palo Alto networks. 21 01:04.000 --> 01:10.000 So we'll type in Palo Alto networks, and then we'll say sample malware files. 22 01:10.000 --> 01:15.720 And then here is wildfire test a sample malware file. Fantastic. And then we'll 23 01:15.720 --> 01:17.000 scroll down a little bit. 24 01:17.000 --> 01:21.470 And here it's saying that we have some files we can use for testing. And that's 25 01:21.470 --> 01:23.000 if we have our SL decryption in place. 26 01:23.000 --> 01:27.040 And in an environment where you just want to verify the actual malware piece 27 01:27.040 --> 01:30.000 without worrying about the SL decryption being in place, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 28 01:30.000 --> 01:35.230 let's go down to this set of files right here, which are all via HTTP. So I'm 29 01:35.230 --> 01:37.000 going to go ahead and click on this first one. 30 01:37.000 --> 01:40.690 And then my browser is saying, hey, danger will Robinson. So I'm going to say 31 01:40.690 --> 01:43.000 go ahead and continue because it's a test file. 32 01:43.000 --> 01:46.620 So I'll allow that download. And let's do this one. Once again, the browser is 33 01:46.620 --> 01:49.000 warning me. I'll go ahead and say, yep, we're going to do that too. 34 01:49.000 --> 01:53.000 And then this one, and then we'll say yes to the browser for that one as well. 35 01:53.000 --> 01:57.000 And this one as well. And again, yes to the browser warning. 36 01:57.000 --> 02:00.250 So those were all browser warnings, but it wasn't the actual network or any of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 36 01:57.000 --> 02:00.250 So those were all browser warnings, but it wasn't the actual network or any of 37 02:00.250 --> 02:04.570 the gateways. So now if we go to the downloads folder here on this local 38 02:04.570 --> 02:05.000 computer, 39 02:05.000 --> 02:08.630 and I'll make that a little bit bigger. Here we have the list of the files that 40 02:08.630 --> 02:10.000 the customer tested earlier. 41 02:10.000 --> 02:14.350 And here are the four additional ones that I just did right now. So we've 42 02:14.350 --> 02:18.610 validated that these sample malware files are coming down and they're not being 43 02:18.610 --> 02:19.000 stopped. 44 02:19.000 --> 02:23.600 So the next thing to ask ourselves is what could be preventing that? Well, one 45 02:23.600 --> 02:28.160 thing that could be preventing that is maybe the malware prevention feature as 46 02:28.160 --> 02:31.000 part of the NSX application platform. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 46 02:28.160 --> 02:31.000 part of the NSX application platform. 47 02:31.000 --> 02:36.170 Maybe that's not enabled or activated. So let me minimize remote console. And 48 02:36.170 --> 02:38.000 let's head over to the NSX manager. 49 02:38.000 --> 02:42.860 So here at the NSX manager, we'll go to the system tab. And with system 50 02:42.860 --> 02:47.060 selected on the left, we'll click right here on the NSX application platform 51 02:47.060 --> 02:48.000 right there. 52 02:48.000 --> 02:52.370 All right, so this looks pretty good. So the NSX application platform is in 53 02:52.370 --> 02:57.000 place. And if we scroll down to features, NSX intelligence is not enabled. 54 02:57.000 --> 03:01.120 But what is enabled is NSX malware prevention. And that's the one that we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 54 02:57.000 --> 03:01.120 But what is enabled is NSX malware prevention. And that's the one that we're 55 03:01.120 --> 03:04.000 after right here. So that is enabled. 56 03:04.000 --> 03:07.410 So what else could be the problem? Let's go take a look at the network topology 57 03:07.410 --> 03:11.570 that the customer is working in. So we'll click here on the networking tab up 58 03:11.570 --> 03:12.000 on top. 59 03:12.000 --> 03:15.820 And on the left, we'll click right here on network topology. So if we expand 60 03:15.820 --> 03:19.650 this and make it a little bit bigger, we've got a tier zero gateway connected 61 03:19.650 --> 03:21.000 out to the external network. 62 03:21.000 --> 03:26.180 And then we've got a gateway A and a gateway C. I don't see a gateway B, but 63 03:26.180 --> 03:30.210 maybe there was one at one point. And if we scroll down off of gateway A, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 63 03:26.180 --> 03:30.210 maybe there was one at one point. And if we scroll down off of gateway A, we 64 03:30.210 --> 03:32.000 have a 1066 segment. 65 03:32.000 --> 03:38.000 And here is a VM, which is a web server. And there's no VMs on segment 1055. 66 03:38.000 --> 03:43.000 And over here, we have network segment 106783. 67 03:43.000 --> 03:48.370 And we have one VM here. And that's the actual VM, the Mint Linux VM, where we 68 03:48.370 --> 03:52.000 did the testing from that was able to go ahead and download the sample malware. 69 03:52.000 --> 03:56.630 So just to validate that, if we brought that VM back in, here it is, Mint Linux 70 03:56.630 --> 04:00.990 VM that is indeed the name of that VM. And we sure did download those sample WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 70 03:56.630 --> 04:00.990 VM that is indeed the name of that VM. And we sure did download those sample 71 04:00.990 --> 04:02.000 malware files. 72 04:02.000 --> 04:07.580 So if we look at the topology here, that should be blocked right here at the 73 04:07.580 --> 04:13.000 tier one gateway C, which is in the path between this VM and the outside world. 74 04:13.000 --> 04:17.220 So now that we know that the NSX application platform is in place, we also know 75 04:17.220 --> 04:21.350 that the malware prevention has been enabled. Let's go ahead and click on the 76 04:21.350 --> 04:22.000 security tab. 77 04:22.000 --> 04:25.500 And then on the top left with security overview selected, let's click right 78 04:25.500 --> 04:30.150 here on malware prevention. And that's saying, yep, zero across the board. No WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 78 04:25.500 --> 04:30.150 here on malware prevention. And that's saying, yep, zero across the board. No 79 04:30.150 --> 04:33.000 files blocked, no malicious file events. 80 04:33.000 --> 04:36.450 So sure enough, it didn't catch anything. So still here on the security tab on 81 04:36.450 --> 04:41.010 the left, let's go down to under policy management. Let's go down to IDS/IPS 82 04:41.010 --> 04:46.000 and malware prevention right here, just to verify that it's enabled. 83 04:46.000 --> 04:49.400 So our concern here is malware prevention. Let's go ahead and click here on 84 04:49.400 --> 04:53.000 settings, the sub tab of settings under IDS/IPS and malware prevention. 85 04:53.000 --> 04:57.040 And let's see if we have the feature enabled. So we're going to scroll down and 86 04:57.040 --> 05:01.870 keep going down to our gateways. And there's tier one gateway A, which we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 86 04:57.040 --> 05:01.870 keep going down to our gateways. And there's tier one gateway A, which we have 87 05:01.870 --> 05:05.000 the IDS/IPS and malware prevention enabled. 88 05:05.000 --> 05:11.900 And then we have gateway C and it's not enabled. So let's go ahead and enable 89 05:11.900 --> 05:17.320 that feature here on the tier one gateway C because that's the tier one gateway 90 05:17.320 --> 05:21.000 in the path between our VM and the outside world. 91 05:21.000 --> 05:25.000 So now that that is activated, let me go ahead and bounce off to another page. 92 05:25.000 --> 05:30.040 Let's go to the overview and go back down here to IDS/IPS and malware WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 92 05:25.000 --> 05:30.040 Let's go to the overview and go back down here to IDS/IPS and malware 93 05:30.040 --> 05:35.510 prevention and go to settings once again, just to verify that it is now indeed 94 05:35.510 --> 05:36.000 on. 95 05:36.000 --> 05:39.920 So if that was the only problem, that should now be able to identify when 96 05:39.920 --> 05:43.480 malware is trying to be downloaded, or at least it's one step closer to the 97 05:43.480 --> 05:44.000 solution. 98 05:44.000 --> 05:48.070 So let's go back to our client, which just a moment ago was able to download 99 05:48.070 --> 05:52.530 the sample malware files from the Palo Alto site. And let's try again. So we'll 100 05:52.530 --> 05:54.000 open up the browser. 101 05:54.000 --> 05:59.020 And let's go ahead and let's pick on this one. And that is still coming down. 102 05:59.020 --> 06:01.000 So that's the browser trying to say no. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 102 05:59.020 --> 06:01.000 So that's the browser trying to say no. 103 06:01.000 --> 06:03.940 And we really don't need to try the others because the gateway, our tier one 104 06:03.940 --> 06:07.560 gateway, still allowed that to be downloaded. So let's go ahead and take a look 105 06:07.560 --> 06:09.000 at our downloads folder. 106 06:09.000 --> 06:13.210 And sure enough, there it is right there. All right. So that isn't the complete 107 06:13.210 --> 06:17.580 solution, but this is one step in that direction. So the next thing that we 108 06:17.580 --> 06:22.000 would probably want to verify is whether or not we have a policy and associated 109 06:22.000 --> 06:27.000 rule in place on the tier one gateway C that says we want to look for malware, 110 06:27.000 --> 06:30.320 because if we don't have a policy with an associated profile in place on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 110 06:27.000 --> 06:30.320 because if we don't have a policy with an associated profile in place on 111 06:30.320 --> 06:34.000 gateway C, even though it's enabled, it still isn't going to function. 112 06:34.000 --> 06:38.060 So to do that with the security tab still selected, let's click right here on 113 06:38.060 --> 06:42.270 gateway firewall underneath policy management. And I've got some weird wrapping 114 06:42.270 --> 06:45.000 over here and part of that's due to the font size that I'm currently using. 115 06:45.000 --> 06:49.000 So I make my font size a little extra big. So it's easier to see in the 116 06:49.000 --> 06:53.180 recordings. So now that we're here under security and under policy management 117 06:53.180 --> 06:58.000 with gateway firewall selected, let's go ahead and let's click on settings. 118 06:58.000 --> 07:02.800 And I've got the gateway firewall enabled for all three firewalls are tier zero WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 118 06:58.000 --> 07:02.800 And I've got the gateway firewall enabled for all three firewalls are tier zero 119 07:02.800 --> 07:07.680 tier one gateway and most importantly for our discussion here tier one gateway 120 07:07.680 --> 07:08.000 C. 121 07:08.000 --> 07:12.300 And if we go to gateway specific rules and we go to the gateway in question, so 122 07:12.300 --> 07:16.900 we want to take a look at tier one gateway C. If we expand this, I'll have here 123 07:16.900 --> 07:18.000 is default rules. 124 07:18.000 --> 07:30.000 And then see the rules and policies for the IDS / IPS and malware prevention. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 07:30.000 --> 07:34.200 So here if we expand this, wow, we have a policy is the policy is called 128 07:34.200 --> 07:38.810 gateway IDS and malware. Then we have two rules. We have one for IDS and one 129 07:38.810 --> 07:40.000 for malware. 130 07:40.000 --> 07:45.020 And oh, I see the problem is it's being applied to gateway A and we don't have 131 07:45.020 --> 07:49.000 any rules. Let me go ahead and take a look at gateway C. 132 07:49.000 --> 07:54.570 We don't have any rules applied whatsoever for malware or IDS / IPS for gateway 133 07:54.570 --> 07:58.710 C. And that would be yet another problem why the gateway C isn't identifying 134 07:58.710 --> 08:02.000 any malware is because the features not enabled right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 134 07:58.710 --> 08:02.000 any malware is because the features not enabled right here. 135 08:02.000 --> 08:06.170 So let's go ahead and let's create a profile for malware. So we have one right 136 08:06.170 --> 08:10.310 here called our malware, I'm going to make one more and then we collapse the 137 08:10.310 --> 08:13.000 left hand column to give us a little more room. 138 08:13.000 --> 08:18.910 And I'll call this malware profile for gateway C. And then I'm going to go 139 08:18.910 --> 08:22.000 ahead and I want to match on all these different types for file categories. 140 08:22.000 --> 08:25.800 Then we'll go ahead and save that. And now that we have that profile, let's go 141 08:25.800 --> 08:28.000 ahead and include that as part of a gateway rule. 142 08:28.000 --> 08:31.870 So we'll click on gateway rule, make sure we have the correct gateway selected, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 142 08:28.000 --> 08:31.870 So we'll click on gateway rule, make sure we have the correct gateway selected, 143 08:31.870 --> 08:37.000 always important. And then we'll add a policy, we'll call us gateway C policy. 144 08:37.000 --> 08:40.560 And then we'll add a rule to look for malware. So we'll click on the three dots 145 08:40.560 --> 08:43.000 to the left of that policy and click add rule. 146 08:43.000 --> 08:46.380 We'll call this look for malware and from any source, any destination, any 147 08:46.380 --> 08:50.540 service. And then here for security profiles, we'll click on the pencil to edit 148 08:50.540 --> 08:51.000 that. 149 08:51.000 --> 08:54.950 And we want to select malware prevention and then choose the one that we just 150 08:54.950 --> 08:59.000 made, the profile called malware profile gateway C and click on apply. 151 08:59.000 --> 09:04.090 And then we'll go ahead and set this to detect only and then click on publish. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 151 08:59.000 --> 09:04.090 And then we'll go ahead and set this to detect only and then click on publish. 152 09:04.090 --> 09:07.900 And that's being pushed out to our tier one gateway C and the functionality for 153 09:07.900 --> 09:11.000 that tier one gateway C is being provided by our edge nodes. 154 09:11.000 --> 09:14.340 So we'll go ahead and refresh that. All right, that looks like it took. So let 155 09:14.340 --> 09:18.200 's take a peek once again at our settings to make sure everything's in place on 156 09:18.200 --> 09:19.000 our system. 157 09:19.000 --> 09:24.100 And NSX application platform right here. NSX application platform has been 158 09:24.100 --> 09:28.450 deployed, everything's looking green and we also have the NSX malware 159 09:28.450 --> 09:30.000 prevention enabled. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 160 09:30.000 --> 09:34.850 Secondly, if we go to security and we go to ID / IPS and malware prevention and 161 09:34.850 --> 09:39.290 go to settings regarding malware prevention, it is enabled on both of our tier 162 09:39.290 --> 09:40.000 one gateways. 163 09:40.000 --> 09:44.750 Then furthermore, still under security and still under ID / IPS and malware 164 09:44.750 --> 09:50.000 prevention, if we go to profiles, we have our profile for malware prevention. 165 09:50.000 --> 09:54.770 And we included that profile as part of a firewall policy rule. So here under 166 09:54.770 --> 09:59.250 malware prevention with gateway rule selected and selecting our gateway in 167 09:59.250 --> 10:01.000 question, which is the tier one gateway C. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 167 09:59.250 --> 10:01.000 question, which is the tier one gateway C. 168 10:01.000 --> 10:06.190 We have a policy in place along with a rule that's leveraging our malware 169 10:06.190 --> 10:11.250 prevention profile. So currently, if we went to security overview, I'll go 170 10:11.250 --> 10:13.000 ahead and say, yes, let's navigate there. 171 10:13.000 --> 10:17.330 And we went to malware prevention. Once again, we haven't noticed or seen any 172 10:17.330 --> 10:20.890 malware. However, let's go back to our client and attempt to download some 173 10:20.890 --> 10:22.000 malware once again. 174 10:22.000 --> 10:26.550 So back here at our client, we'll open up our browser. Let's once again attempt 175 10:26.550 --> 10:30.870 to download some sample malware files. So let's go ahead and click on this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 175 10:26.550 --> 10:30.870 to download some sample malware files. So let's go ahead and click on this 176 10:30.870 --> 10:33.000 first one to test it and check this out. 177 10:33.000 --> 10:37.510 So here on the security tab with the security overview selected is now showing 178 10:37.510 --> 10:41.850 one malicious file event and for threat event monitoring, if we clicked right 179 10:41.850 --> 10:43.000 here on malware prevention. 180 10:43.000 --> 10:47.710 And then we took a look at the last hour here in the potential malware. Here we 181 10:47.710 --> 10:52.000 have our indicator right here about the attempt that we just made. 182 10:52.000 --> 10:57.220 So if we go back to networking and topology with all those components in place, 183 10:57.220 --> 11:02.000 including the correct policy in place here on our tier one gateway C. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 183 10:57.220 --> 11:02.000 including the correct policy in place here on our tier one gateway C. 184 11:02.000 --> 11:06.210 Now, when this client, which is attempting to download malware off of the 185 11:06.210 --> 11:10.760 internet, when it does so, this gateway with the malware prevention feature as 186 11:10.760 --> 11:15.240 part of the NSX application platform enabled and with a profile created and 187 11:15.240 --> 11:20.000 that profile included as part of a rule and applied to this gateway and also 188 11:20.000 --> 11:24.000 having this gateway enabled so it's going to support the malware prevention 189 11:24.000 --> 11:25.000 with all those components in place. 190 11:25.000 --> 11:29.020 It's now doing its job and actually identifying malicious traffic as it's 191 11:29.020 --> 11:32.950 trying to come into the network. So thanks for joining me in this set of videos WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 191 11:29.020 --> 11:32.950 trying to come into the network. So thanks for joining me in this set of videos 192 11:32.950 --> 11:38.110 as we've taken a look at the implementation and verification of NSX malware 193 11:38.110 --> 11:40.000 prevention in an NSX environment. 194 11:40.000 --> 11:44.000 And I look forward to seeing you my friend in another skill very, very soon. 195 11:44.000 --> 11:48.410 Until then, I hope this has been informative and I'd like to thank you for 196 11:48.410 --> 11:49.000 viewing.