Let's put a game plan together regarding leveraging Active Directory with our
group membership in NSX.
So for our first step, let's verify what we have in place, including Active
Directory and also our VMs.
And so what I expect to have in place is a little Windows server I put right
here.
This is a server and it's at .100.
That's providing Active Directory services and then this is a little client
right here.
And it is a DHCP client getting an IP address via DHCP.
So as part of our verification, I also want to verify that DHCP that we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So as part of our verification, I also want to verify that DHCP that we're
getting on this segment,
courtesy of gateway-based DHCP services in NSX, I want to make sure that we're
handing out the correct DNS server.
Because this little client is going to be logging on to the domain.
So for DHCP, I want to make sure that DNS points to .100.
We also want to make sure that this Windows client VM right here is running the
full complement of VMware tools.
Then once we've verified those are in place, next we need to do the integration
between NSX and train it where this server is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
between NSX and train it where this server is
that's supporting our Active Directory environment.
So we're going to add Active Directory and LDAP information to NSX.
So for the VM running VMware tools, it'll be able to report to the NSX manager
about its IP address and so forth.
If it's running in a cluster where the identity firewall has been enabled.
However, for external physical clients, we'd also want to go ahead and set up
logs scraping
so that those devices can be supported as well.
So here I'll jot down plus logs scraping.
Again, that'd be for non VM clients that we also want to include in group WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Again, that'd be for non VM clients that we also want to include in group
membership and have NSX be aware of it.
Another step is that we need to train our distributed firewall as well as our
gateway firewall that we want to be able to use identity firewall services.
So that way we can leverage groups that refer to AD groups as part of our
distributed firewall and gateway firewall rules.
So for distributed firewall and gateway firewall, we'll simply say enable IDFW
or the identity firewall functionality there.
Then the next step would be to go ahead and create some NSX groups that include
some AD groups. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
some AD groups.
So I'll put a little I and C there for include.
And then finally, we want to go ahead and use those NSX groups as part of our
firewall security policy rules.
And for a consistent test regarding what we want to permit and deny, here's
what I propose we do.
Let's go ahead and permit or deny access right here to this little IP address
of 23.1.2.1, which is our little router here, our external router that supports
SSH.
So for rules, let's say permit SSH in group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And here's what I mean by that.
If our user is logged on here and they're a member of a specific group and we
use that group as the source in our rule, we want to go ahead and permit SSH
traffic.
Again, if their source is coming from one of the groups that we specified.
And for everything else is not explicitly permitted using SSH to that IP
address.
Let's go ahead and deny all the other SSC traffic trying to do that same IP
address.
So we'll go ahead and say deny for all.
And then we'll put the rules in this order.
So if you're a member of the group in active directory, which makes you a group WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if you're a member of the group in active directory, which makes you a group
in the security policy rule and NSX, then you'll get SSH access to this IP
address.
And if you're not in that group, you'll have it denied.
So now that we have our game plan in place, our very next step is to verify our
topology and make sure that we have VMware tools installed on our Windows
client.
So we'll see you in the next video as we begin our verification of our existing
topology.