So our next step here is on Gateway Zero,
we're going to implement a Gateway firewall
to permit HTTP traffic inbound
if it's trying to reach the web server down here.
So we currently have our destination net rule in place.
So this Web10 machine out on this network maps to 23.1.2.181
and down here on the 1010 Zero Network,
its actual address is .181.
Also, to implement the Gateway firewall functions on a Gateway,
the Gateway needs to be associated with edge transport nodes. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the Gateway needs to be associated with edge transport nodes.
And so currently it is because we've used this for other features
like DHCP and so forth, as well as net,
which also require the services of the transport nodes.
So let's do a quick validation again from this Mint 23 machine
that we can ping this VM based on its global address,
that we can open up a web page to it based on its global address,
and also that we have connectivity using TCP port 22.
So here is this little web VM server,
and it currently has FTP services, web services,
SSH services, all running on it.
Fantastic, let's go to Mint 23 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Fantastic, let's go to Mint 23
and just verify that connectivity one more time.
So here is Mint 23, this device sitting right there.
We'll go to a command prompt and let's do a ping to 23.1.2.181.
And that's working, I'll do a Control C, let's type in FTP
to 23.1.2.181.
And sure enough, it's prompting me to authenticate,
so I'll do a Control C, we know that protocol is being allowed,
that's FTP, let's do a telnet,
to 23.1.2.181. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to 23.1.2.181.
And we'll go to port 22, just to verify that that's open.
And sure enough, it is, we'll cancel out of that.
And we can also right here from the command line,
use the command line URL with dash I to include headers
to 23.1.2.181 plus center,
and that's responding as well, including the content,
right there from the index.html page,
indicating it's the server at 1010.0181.
And from a graphical perspective, from a browser,
that would look like this.
All right, fantastic.
So all of our connectivity is currently in place. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So all of our connectivity is currently in place.
So let's head over to our NSX manager,
and with networking selected,
let's take a quick peek at the network topology.
So currently, if we double click on our tier zero gateway,
it's gonna show us, point that tier zero gateway,
we've already associated with edge one and edge two,
that's two is logical interfaces on that 23 network.
And currently edge one is active,
and edge two is standby for our gateway zero services.
So to implement our gateway policy,
we click on security and a left under policy management,
instead of going to distributed firewall,
which we did in previous skills, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which we did in previous skills,
we're now gonna click right here on gateway firewall.
It's also giving us a notice here
that we have identity firewall services turned off.
So we're gonna do that in a separate skill
with integration with the active directory.
So I'm gonna say, please don't show me that again.
So here on the security tab,
with the left hand tab of gateway firewall selected,
we can now choose from our various gateways.
So here we have gateway zero, A and B and B star plan.
We want this gateway firewall to be implemented
on our tier zero gateway zero.
So if we click here on all shared rules,
very similar to the different categories we had WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
very similar to the different categories we had
in the distributed firewall,
we also have multiple categories here
for the gateway firewall.
And they are processed from categories left to right,
and then for each category,
they're processed top to bottom.
So currently under emergency, we have zero,
system zero, pre-rule zero,
and if we click right here on gateway specific,
it's gonna whisk us away over here to this tab,
right here called gateway specific rules.
So if we click here on gateway specific,
it moves us over to this tab right here.
And currently with our tier zero gateway,
we only have the default policy in place. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we only have the default policy in place.
So on the left, I'm gonna go ahead
and minimize the left hand column.
That'll give us a little more room to work with.
And if we wanna add our own policy,
do permit HTTP traffic down to our web server.
We can go ahead and right here and click on add policy.
Let's call this our gateway HTTP policy.
And then we'd add a rule that's permitting the traffic
that we want to allow, which is the HTTP.
So with our policy selected here, we'll click add rule.
And we'll go ahead and rename this rule,
and we'll call this permit HTTP to web 10.
And then for the source, we'll go ahead and say WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then for the source, we'll go ahead and say
if it's coming from anywhere,
so we don't really care about the source information.
However, if it's trying to go to the destination
of our web server, then we wanna go ahead
and permit it if it's HTTP.
So for destination right here,
we'll click on the pencil.
And currently we have a bunch of groups that we could use
if that server was a member of one of those groups,
or we could just go right here to IP addresses
and put in the IP address.
Now, when we sit up NAT, we told to go ahead
and pay attention from a firewall perspective
to the internal addresses.
So if we wanted to match on traffic going to our web server, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we wanted to match on traffic going to our web server,
right here, we'd put in 10.10.0.
And its IP address is 181.
So that would be the match for the destination
as opposed to matching on a group.
Or we could do this, let's click on apply here.
Then we'll go ahead and save this real quick.
Click on publish.
We also could, if we wanted to go back to inventory,
and I'll expand the left-hand column here
and click on virtual machines.
And from here, we could select a web 10.
So let's go ahead and click on the three dots to edit it.
And then if we wanted to, we could add the tag right here.
So currently we have tags for client tag,
DB tag, edge, odd, even, and servers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
DB tag, edge, odd, even, and servers.
So I'm gonna go ahead and sign the tag right here of servers.
I had to modify the resolution
so it would actually show up there.
And now with that servers tag selected,
let me go ahead and click on save.
And let me change the resolution back a little bit
to make it easier to read.
And now if we go back to security.
And on the left, if we now select gateway firewall once again,
and I'll collapse that left-hand side.
So we're focused here on the gateway firewall
for the T0 gateway.
And there's our new policy, along with the new rule.
So here for the destination,
instead of specifying the actual IP address for that host,
we can click on the edit here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can click on the edit here
and go back to the IP address and remove it.
And simply use a group membership.
So because we had the tag called servers to that VM,
if we now go to the server group,
let me just verify here with clicking on view members,
we should have web 10 showing up here as well.
So now we're still matching our web 10
as a member of this group.
Either way is great, so we'll click on close and apply,
and let me publish those changes as well before I forget.
And then for services, we wanna go ahead
and specify we want to allow HTTP traffic.
Effectively TCP port 80, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Effectively TCP port 80,
so we'll go ahead and type in HTTP press enter.
And then we'll filter down to these service names
that include HTTP.
And we want this one right here, HTTP for TCP traffic
to a destination port of 80 for the initial flow of traffic.
So we'll select that, click on apply,
and we want to permit that traffic.
So we'll go ahead and publish that.
Now even before we specify this rule of allow,
that traffic as we just demonstrated a moment ago
was still being allowed.
And that's because we don't yet have anywhere any rules,
either distributed firewall rules or gateway firewall rules
that are otherwise preventing that traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that are otherwise preventing that traffic.
So if our goal is to permit the HTTP,
but tonight everything else,
we need to add yet another rule.
So I'll choose our policy, click on add rule.
In fact, let's just clone this one right here.
So we'll just click on this rule right here,
save this little work.
And with that rule selected, we'll click on clone,
and then I'm gonna drag that below the other rule.
So the first rule right here permits it.
And for this one, we want to deny everything else.
So we'll just call it deny to web 10,
and the source can be anywhere.
And the destination is the server group where web 10 is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the destination is the server group where web 10 is.
And it just occurred to me that we are also setting up policies
concerning the other servers in that group as well.
So I'm gonna modify,
instead of using the server group there,
I'm gonna go back in and simply put in the IP address
of that one server, which is 10.10.0.181,
and go back to groups and say, you know what?
Please show only selected,
and we don't want to include that group.
And now we are being very accurate and concise
with this rule and I'll do the same thing for the deny.
So we'll click on the pencil,
click here where it says show only selected, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
click here where it says show only selected,
remove that group, and then go ahead to IP addresses,
and then put in 10.10.0.181, just like that,
and click on apply.
All right, so now it's only gonna affect traffic destined
to that specific VM with that specific IP address,
as opposed to the group, which included additional servers.
And then for the services here,
if we want to deny everything else,
we want to go ahead and say HTTP,
we'll go ahead and say show only selected,
and we'll remove that and click on apply,
and effectively now it's any services,
so any port, any protocol, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so any port, any protocol,
and we want to specify that that traffic should be rejected.
So the first rule here, when it's hit at gateway zero,
should permit HTTP to that IP address,
and any other traffic trying to go
to that specific IP address should be dropped.
So we'll click on publish,
and now that it's been updated, let's test it out.
So here is our topology in the upper right-hand corner.
Let's bring back in Mint 23 to test connectivity
down to web 10.
So here is Mint 23, we'll bring up a command prompt,
and let's do a ping, or try a ping, down to 23.1.2.181, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and let's do a ping, or try a ping, down to 23.1.2.181,
and that this Hnet is gonna lead down to web 10,
earlier it worked, and now it's not,
so do a control C, let's also do a curls,
we'll type in C URL, dash I, going to 23.1.2.181, press enter,
and that is working, and that's because
we're permitting HTTP, so that's still working, that's great.
However, if we tried doing a telnet,
to 23.1.2.181, and going over to port 22,
which we were able to open a connection earlier, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which we were able to open a connection earlier,
now that's being denied, and that's because
our gateway security policy rule right here,
on tier zero gateway zero, and let's also try FTP,
going to 23.1.2.181, and earlier when we tried that,
it was giving us a prompt asking us
for our username and password information,
but now it's just getting a connection refuse,
because the firewall, specifically the gateway firewall
here on the tier zero gateway, was denying that traffic,
and because the action for that rule was reject,
it was sending a TCP reset back to this client,
which is why we're seeing that right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is why we're seeing that right here.
And just to confirm, if we open a browser,
on this Mint 23 machine, and we go to the IP address 23.1.2.181,
and we click refresh a few times,
sure enough that it's hitting that server,
we can also verify that with the net rule
inside NSX Manager.
So here if we click on networking, on the left,
if we go down to net, here's our destination net rule,
right here, and if we scroll to the right,
and click on the icon for stats,
it's showing us zero active sessions,
but let me go ahead and go to our client,
and let me click on refresh a few times there,
and then we'll click on refresh here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then we'll click on refresh here,
and sure enough it's showing us
that we have one active session,
and that's our HTTP session that we have
from that client on the outside that 23 network,
coming down to the server at 10, 10, 0, 181,
using this destination net rule.
So we'll close that.
And then going back to security here in the NSX Manager
and to the gateway firewall,
if we click on the icon for stats over here,
where the actual rule itself,
it generates statistics every 15 minutes.
So if we waited up to 15 minutes,
it would then show us an aggregate hit count
regarding this rule for the past 15 minutes WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
regarding this rule for the past 15 minutes
that it's doing the aggregation for.
However, even though it's not showing yet
the hit counts and byte counts and packet counts up here,
down here under max popularity and max session count,
we have some hits there,
and that's due to that rule being matched.
So if we wait a few minutes,
the aggregate numbers here would show up on the top row as well.
And just to confirm that this rule really is hitting
the traffic that's not HTTP traffic,
if we disabled it for a moment and published it,
and then we went back to our client,
and we tried one of those tests again.
So there's the tell net session,
trying to open up on port 22, that's working.
If you do our ping to that IP address, that's working. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If you do our ping to that IP address, that's working.
And conversely, if we enable that rule again,
that rejects everything that's not HTTP traffic
and publish that,
and then we go back to our client,
those same types of traffic flows
are now gonna be denied.
So there's the ping that's not working,
I'll do a control C there,
and we'll go ahead and do the tell net to port 22,
and that's being rejected.
Again, because this rule is catching that traffic
and stopping it.
So in this video, we've implemented on Gateway Zero,
a gateway firewall that permits H2 traffic
if it's trying to go to this VM.
However, all other traffic that's trying to go to that VM WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, all other traffic that's trying to go to that VM
is gonna be blocked right there at our tier zero,
gateway zero firewall.
[no audio]