Hello and welcome. My name is Keith Barker.
And we've been using Firewalls and networks for a long, long time.
And the concept of a firewall is some device in the network that's controlling
what's allowed through.
So if we have clients over here and clients over here and they have to go
through the firewall,
the firewall can control what's allowed or not allowed based on a layer three
IP address or
layer four protocol and/or port and a next-generation firewall also has the
ability to look at the
application layer to make decisions on whether traffic should be allowed to go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
application layer to make decisions on whether traffic should be allowed to go
through or not
based on policy. So a firewall is all well and good, but what if we have a
firewall sitting right
here and we have two computers on this side of the firewall? They're both on
the same network.
How do we control traffic between them? The answer is with this firewall, we
can't. However,
something really cool in the world of NSX is the concept of the distributed
firewall. Imagine
a firewall where we set the rules about what's allowed or not allowed based on
individual VMs
or group memberships or other criteria that we specify. And then no matter
where those VMs move, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
where those VMs move,
if they moved from segment 10 to segment 20 to segment 30, we can control what
traffic is allowed
or not allowed between those VMs based on our distributed firewall rules. It's
because of that
that we have the concept of micro segmentation. So in the past, if we had a
firewall here and we
had two computers over here on this segment, we really couldn't control with
this firewall
what could be sent back and forth over the network between those two VMs.
However,
with a distributed firewall, we can now have that micro segmentation and micro
control regarding
exactly what's allowed between those VMs, even if they're on the same exact WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
exactly what's allowed between those VMs, even if they're on the same exact
network segment,
because logically that traffic is going through NSX. And as part of that, the
traffic has to go
through the logical distributed firewall rules to allow to be sent if that
traffic is going to be
allowed between those two VMs. And by default, with a distributed firewall, the
default rule
at very end says, please permit all your IP traffic. And that's why up to this
point,
using the defaults, we are able to send traffic back and forth between various
VMs. However, as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VMs. However, as
we'll see as we go through this set of videos together, we can change that
behavior with the
micro segmentation provided by the distributed firewall. So join me in the next
video as we take
a big picture look at the world of a distributed firewall, and then we'll
follow that up with a
specific game plan, and then we'll implement and verify that game plan together
. So also you, my
friend in the next video in just a moment.
[BLANK_AUDIO]