So, as the very first step before we start setting up filtering and denying
stuff,
let's just do a quick verification of our topology. So, over here on segment 10
,
I have a little VM, it's called Mint-1. It's lint minx on the 1010 zero network
,
it's getting an IP address via DHCP. And I've got another Mint Linux device
right here,
which is Mint 2 that's on the 1020 zero network. And currently, they should
have access to,
if they want to, SSH up here to my external router at .1 on the 2312 network.
And they should be able
to get out to, for example, the internet and go to sites like Cisco.com and e WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to get out to, for example, the internet and go to sites like Cisco.com and e
bay.com. And I think
we should take just a moment to verify all that before we start putting in the
filtering. So,
let's go to the vSphere client. And let's make sure these two VMs, Mint 1 and
Mint 2,
are on their correct network segments and we'll power them up. So, here in the
vSphere client,
let's go to the VM and templates view. And I've got a folder called VMs for
testing. So,
with this folder selected and the VMs to have up here selected, let me go ahead
and select Mint 1
and Mint 2 and right click for those two and click power. And then from the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and Mint 2 and right click for those two and click power. And then from the
menu, we'll power them
on. And then we'll go ahead and open up remote consoles for each of them as
well. So, let me
click on Mint 1 here and let's go ahead and open a remote console by clicking
here on launch remote
console. And we'll do the same thing for Mint 2. Click on Mint 2 and click on
launch remote console.
And while those are powering up, let's also just verify from the networks tab
here that on segment
10, we have Mint 1 right there, great, great, great, great. And that on segment
20, there we have Mint WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
20, there we have Mint
2, that looks good as well. So, let's start with Mint 1 and just verify that it
can do SSH up to
this router here, also that it can get to Cisco.com via HTTPS and also that it
can get to eBay. So,
here is the remote console for Mint 1 up here on the top left, Mint 1.
Fantastic. Let's just confirm
its IP address real quick. So, we'll open up a terminal window and we'll type
in IF config.
And it's at 10.10.0.165, great, great, great. So, it's on the right subnet.
Another way of seeing
that information is IP address and pressing enter. And it also confirms for us WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that information is IP address and pressing enter. And it also confirms for us
the IP address is
involved. So, there's the 10, 10, 0, 165. So, here at the command lane, let's
do a ping at to www.cisco.com,
just to verify DNS is working great, great, great, or we can use dig for www.e
bay.com. That looks great,
or an NS lookup for VMware.com. That looks great. Another option we can use
right here at the command
line is curl, which is the command line URL. And so, with curl, we do a dash
dash help and press enter.
Here are options for curl. So, we can use, for example, right here, a dash i to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Here are options for curl. So, we can use, for example, right here, a dash i to
include the
protocol response headers, just to make sure we're really talking to the
servers. So, let's go ahead
and do a curl dash i and let's go out to www.ebay.com. In fact, let's put an
HTTPS in front of that,
so it doesn't default to HTTP or some other protocol. So, we'll do a curl,
include the headers for
HTTPS and then that URL will press enter. And sure enough, this is responding,
fantastic. And
let's do that also for cisco.com. Fantastic. We can also open up a browser and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's do that also for cisco.com. Fantastic. We can also open up a browser and
test it as well.
So, we'll open up a browser and let's just verify basic connectivity real quick
by using fast.com.
And sure enough, we are connected out to the internet. So, that looks good. And
let me
open up another tab and let's go to ebay.com. So, even though I'm not typing in
HTTPS, it's going
to redirect me there. And there we go. There's ebay.com using HTTPS. And that
looks like it's
working as well. I go ahead and close those tabs. And just as a quick check, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
working as well. I go ahead and close those tabs. And just as a quick check,
let me also verify and
mint to that it has the correct IP address. And it's also going to have the
same connectivity,
assuming it has an IP address that works. So, let's bring in mint to and here
it is right here.
This should be over on the 20 subnet. So, we'll go ahead and bring up a command
prompt. And then
here we'll do an IF config or the IPA for IP address. It's just to confirm that
it has a valid IP address
and it sure does says the .153 address on the network 10200. And that same
information was
output here from the output of IF config. And then just as a quick task, we did WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
output here from the output of IF config. And then just as a quick task, we did
a curl here.
-i to include the headers out to www.sisco.com. That works. Let's also go ahead
and put HTTPS
there in front of it. HTTPS colon slash slash enter. And that looks good as
well. So, we have
IP addresses. We have connectivity to the internet. Oh, one other thing I want
to verify is connectivity
up to this router right here in our topology with SSH. So, let's go back to
mint one and verify
just a quick SSH session from mint one up to this router right here. So, here
is mint one. So,
we'll go ahead and do an SSH space dash L to login as. And the user up there is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'll go ahead and do an SSH space dash L to login as. And the user up there is
VYOS. And the
IP address is 23.1.2.1. We'll press enter. And we want to accept the
fingerprint and continue.
We'll say yes. And then the password is VYOS also. And then we are in. So, if
we type in who here,
it's going to show us who's currently connected. So, we are coming in from 2312
115. And that's
because we're going through the NAT process that we set up in a previous skill.
So, as we go through
the tier zero gateway, NAT services are there. So, as this VM connects to this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the tier zero gateway, NAT services are there. So, as this VM connects to this
external router,
it's showing up as that IP address on the 23.1.2 network based on the pool we
have assigned for
DHCP services. And just to verify that, let's peek at the NSX manager for a
moment. So, here in the
NSX manager, if we go to networking and on the left-hand side, if we go down to
NAT under network
services, here's our source NAT rule. Then we collapse to the left-hand side.
It gives a little
more room here. If we click on the little icon for statistics, here's showing
we have one active
sessions. And over time, we've had a lot of traffic flow through there. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sessions. And over time, we've had a lot of traffic flow through there. And
that would include all
the traffic from our fast speed test and other traffic that's being sent from
our network out
through the gateway zero. And now that we've verified all of our existing
connectivity from our VMs
here, including SH up to here, and also the fact that they can get up to Cisco.
com, and also the
fact that they can get to eBay. Now, we didn't test every single option on both
VMs, but between the
two of them, we verified all of this connectivity. And currently, they are
using the default
distributed firewall policy rules for traffic going through our NSX environment WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
distributed firewall policy rules for traffic going through our NSX environment
. And by default,
the last entry is permitting all traffic. And that's why none of this traffic
as it goes through the
network and out to the public internet or up to this router interface for SSH.
That's why none of
this traffic is being denied because the default distributed firewall rules
permit the traffic.
However, we are going to change that as we begin to implement our plan and
leverage
distributed firewall rules in conjunction with context profiles to deny certain
flows of traffic.
[BLANK_AUDIO]