For our game plan to help reinforce the concept of using context profiles,
let's do the following.
And again, these are all going to be related to the distributed firewall.
So for the first demonstration of using the context profiles,
which we're looking at what's really going on at the application layer,
let's deny SSH. If it's really SSH, not just the well-known port of TCP port 22
,
but if it's really SSH, let's go ahead and deny it if it's attempting to go to
this interface
right here. So this is a little virus router that has the IP address 23 1.2.1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right here. So this is a little virus router that has the IP address 23 1.2.1.
And we have reachability from our previous skills on getting there.
So we should be able to initially before we deny the SSH traffic,
we should be able to go to a VM like this one right here, connect up to that IP
address via SSH,
and that should work just fine. So let's go ahead and deny SSH from clients to,
and I'm going to
point to that IP address right there to 23.1.2.1. So as part of our rule, to
identify which
machines are actually clients, we also want to take a moment and make sure that
we have the
tags associated with each of our client VMs, and then make sure that we have a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tags associated with each of our client VMs, and then make sure that we have a
dynamic group
that's looking for all those tags and putting them into a group called clients
that we can then use
as part of our security policy rule. So I'm going to add to this deny SSH from
clients to 23.1.2.1.
So as part of that, we will specify for the services that we want TCP port 22
to be blocked,
but we're not just going to rely on these services looking at the layer for
information,
we're also going to go ahead and use a context profile. So I'll put a little
plus symbol there,
and then in green, let me go ahead and put context profile. So the context WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then in green, let me go ahead and put context profile. So the context
profile will be looking
at the application layer to verify based on a signature ID that it really is
SSH, and not just
some other application layer services that's being tunneled or sent over TCP
port 22. Again,
that's the benefit of a context profile is we can take a closer look at what's
really going on at
the application layer. And for our second task, let's do some fully qualified
domain name filtering
if clients, meaning VMs that are in the clients group, if they're trying to go
out to the internet
using HTTPS to and for the domain name, let's go ahead and use asterisk, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
using HTTPS to and for the domain name, let's go ahead and use asterisk, which
means anything at
unless you Cisco.com. Now, to pull this one off, we are going to have to do a
couple of things.
Number one, at the application layer, we need to tell the NSX environment that
we want to pay
attention and look at all the DNS traffic that's going through. So we'll create
a rule that says,
please look at all the DNS traffic. And that gives us the ability to take a
closer look at what's going
on with the DNS that's being used. And then secondly, once we have the DNS
inspection effectively in
place, we'll have another rule that says, you know what, if clients are trying WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
place, we'll have another rule that says, you know what, if clients are trying
to go to anything at
Cisco.com using HTTPS, go ahead and stop it, meaning that the distributive
firewall is going to stop
that traffic. So to make that all happen, we are going to be looking at layer
four at UDP port 53.
So UDP port 53 is the older, well known port and protocol being used for a DNS
request, a DNS
lookup. However, in a production environment, just be where there's more than
just UDP port 53
that clients may be using for DNS requests. Examples of some alternatives to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that clients may be using for DNS requests. Examples of some alternatives to
that would be
DNS over TLS. And the acronym for that is DOT. At which point we wouldn't be
using UDP at all,
we're using TCP with TLS. And there's also DOH, which is DNS over HTTPS. So in
the lab environment
here for our demo, I'm going to go ahead and just use the UDP port 53, because
that's what my clients
are using by default when they make DNS requests. So as part of our setup for
the fully qualified
domain name filtering, we need a train that distributed firewall to pay
attention to UDP traffic.
And also the application layer, make sure it's not just using those ports, but WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And also the application layer, make sure it's not just using those ports, but
make sure it's
actually really DNS. And the second part of that fully qualified domain name
filtering is stopping
clients from actually getting to anything at Cisco.com. If it's HTTPS said to
do that,
we're going to implement at layer four, we're going to say, Hey, look for HTTPS
traffic,
which behind the scenes is TCP port 443, as well known port for HTTPS services.
And at the application
layer in a context profile, we can specify we're looking for HTTPS services.
And again,
at this point, we're really looking what's going on. And we're also looking for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at this point, we're really looking what's going on. And we're also looking for
the domain they're
trying to reach. So I'll put a little plus here and put asterisk. Cisco.com. So
this first part
right here is to train the NSX environment that we want to take a closer look
at all the DNS traffic.
And the second part here is going to be used to identify both at layer four
with TCP port 443
and the application layer that they really are using HTTPS. And in addition,
that they're trying
to go to anything at Cisco.com. And when we set that up as a rule, we'll go
ahead and save for
this one to go ahead and tonight. And effectively, we're now doing fully WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this one to go ahead and tonight. And effectively, we're now doing fully
qualified domain name
filtering using a context profile. Now, I also want to point out that there's a
separate feature,
which will also cover in a separate skill called URL filtering, where we can
categorize, for example,
certain types of URLs, for example, auction sites or hate sites or whatever it
is. And then we can
filter based on those categories. So we'll cover the URL filtering in a
separate skill. But for now,
for the demonstration of using a context profile, we're simply going to be
looking for HTTPS traffic
and looking for a specific domain that the client might be trying to go to. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and looking for a specific domain that the client might be trying to go to. And
then we're filtering
based on that. And then as our final example here of using context profiles,
let's do some
filtering. If at the transport layer per call is TCP port 443, which is a well
known port for HTTP
services, and at the application layer as part of our context profile, let's
look for the app
for eBay. Now they have a specific app already set up that identifies eBay
traffic looking at the
application layer information going back and forth. So we're going to leverage
that built-in
application as a further demonstration of using a context profile. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
application as a further demonstration of using a context profile. So
everything in green here
represents using a context profile. So up here, we're actually literally wrote
out context profile
looking for SSH. I'm going to go ahead and clean that up just a little bit. And
I'm going to literally
write in the app ID we're looking for. So we'll go ahead and just write an SSH.
So just a reminder
here, the green color represents a context profile focusing on the application
layer information.
And the orange color here represents layer for information and where
appropriate the actual
ports associated, for example, with TCP or UDP. So in parentheses, I'll put TCP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ports associated, for example, with TCP or UDP. So in parentheses, I'll put TCP
and UDP, although
there could be other protocols there at layer four as well, including matching
on other protocols
like GRE and IPsec and ICMP and others. And instead of our distributed firewall
policy rules,
that layer for information is referred to as services. So in the NSX interface,
when we see
services, I'd like you to think of layer for information. And when you see
context profile,
I'd like you to think of the application layer information. In fact, I'm going
to go ahead and
rewrite these right down here next to where they fit in. So for the application WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
rewrite these right down here next to where they fit in. So for the application
layer inspection,
we're using context profiles. And for layer four, we're using the concept of
services,
because that's what it'll look like inside of the distributed firewall, when we
're setting up
and configuring the rules.