Now with our Windows client logging into the server,
and VMware tools installed on that client,
it's now time to train NSX on how to
interact and work with the Active Directory server.
This is a required step even if we have
the VMware client software installed here.
Because even though the client may be logging into
an Active Directory environment,
we still need to know via LDAP,
which group that user is a member of,
and we're going to be using the interaction between
NSX and Active Directory in LDAP to determine that.
So let's head over to the NSX manager and tell it about WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's head over to the NSX manager and tell it about
our Windows Active Directory server right here at 10.10.0.100.
So to do that here in the NSX manager,
we are going to click on the System tab right there.
So here with the System tab selected and the Identity Firewall AD selected,
we are going to add Active Directory by clicking on
Add Active Directory right here.
So we'll click on that.
And then on the left-hand side,
I'm going to collapse that column to give us a little bit more room,
and here it's asking for our domain.
So let's bring back our server for a moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's bring back our server for a moment.
So here is our server,
and we click here on Local Server.
Here it's showing us the server name is server-10.
And the domain is NSXdemo.local right there.
All right, so let me minimize that.
And I'll put in the domain as NSXdemo.local.
Let me go ahead and move the column over a little bit so we can see that.
And then for the NetBios name and upper case,
that's going to be NSXdemo.
And then for the base distinguished name,
effectively that's telling NSX where to start querying and looking
instead of Active Directory.
So I'm going to use DC for domain component equals NSXdemo, comma, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'm going to use DC for domain component equals NSXdemo, comma,
and then DC equals local.
And then for the Delta synchronization interval,
the default is 180 minutes.
And what I'm going to do in the lab environment only,
I'm going to set that to five minutes.
And I want it to query and synchronize super frequently.
However, in a large Active Directory environment,
you probably don't want to set it to such a small value.
But for responsiveness here in my lab environment,
I'm going to set it for five minutes.
We also have options of limiting our scope in Active Directory as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We also have options of limiting our scope in Active Directory as well.
So for my lab environment,
because my Active Directory is pretty small,
I'm going to leave that to all.
And then for the LDAP server,
which is used behind the scenes for mapping
a individual user to a specific group,
we need to specify that as well.
Hence the little red asterisk there.
So we'll click on set for LDAP server,
and it's the same server.
So I'm going to click on add LDAP server,
and that server down there is at 10.10.0.100.
And I don't have LDAP S set up yet.
So I will just use the plain old LDAP with port 389.
And then for those LDAP queries, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then for those LDAP queries,
I'll specify the username that I can log in as,
as well as specify the password.
And in a production environment,
it's super common to have specific service accounts
with limited rights that have just enough permissions to do what we need them
to do.
So in this case,
even though I'm using administrator,
that is way too many rights and way above what's seen as just four LDAP queries
.
But because I have it set up,
I'm going to go ahead and use that right now.
So with those details in place, I'll click on add,
and that looks good.
And we'll click on apply, and then we'll click on save.
All right.
So because it's in an error, that looks pretty positive. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So because it's in an error, that looks pretty positive.
So let me click here on check status, and that looks good.
So the test, let's bring in our active directory environment.
And let's just create a brand new group.
So let me make this a little bit bigger.
So here in server manager, we'll click on tools,
and let's go down to active directory users and computers right there.
And here it is. And I've got a user called 80 NSX user to this currently logged
on.
And let's take a peek to see what groups that user is currently a member of.
So we go to member of that user is a member of domain admins and domain users. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we go to member of that user is a member of domain admins and domain users.
And what I propose we do, let's create a brand new group.
So I'm going to click here to create a new group.
And let's call this yes to SSH.
So we'll make this a group in active directory.
And then as we refer to this active directory group as part of an NSX group,
we can then use that NSX group
instead of a security policy rule to permit access to SSH.
So here in active directory, I'm going to call it yes to SSH.
Click on OK.
And then we'll double click on that yes to SSH and click on members. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll double click on that yes to SSH and click on members.
And let's click on add.
Then for the user, I'll type in AD and click check names.
And there's our AD NSX user to click on OK to add that person to the group.
And click on OK.
So now if we go back to this user, AD NSX user to,
it's a member of this group right here, which is yes to SSH.
So let's click on OK.
And I'll minimize the Windows server.
So also because I just made a change in active directory,
we could probably wait five minutes and that would work.
Or we could also just click on the three dots over here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or we could also just click on the three dots over here
and click right here on sync all to get any latest and greatest updates from
active directory.
So now just to test this, if we went to inventory and we went to groups
and we wanted to add a new group, so we'll click on add group.
And then for compute members, if we click on set,
here we have an option for AD groups right here on the right.
So we click that tile.
And here showing us the AD groups and the fact that they all show up is a very,
very good sign.
It means we have the active directory integration set up correctly.
So if we scroll down to the Y's here, here's yes to SSH.
So I just want to confirm that that group that we just made, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I just want to confirm that that group that we just made,
which has that one member shows up here as an option.
So I'm going to click on cancel.
We'll make a group in a later step.
I just want to verify that the active directory groups were showing up as
options to be included as part of our NSX groups.
Also, while we're here, let's do one other thing.
And that is even though we don't at the moment have external windows servers
that we also
want to be able to identify group membership for.
If we did have that, we'd also want the ability to do the scraping of the
security logs
to identify those users who have logged on. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to identify those users who have logged on.
So just as a preemptive step, because we may at a later time be adding a
physical
computer running a Windows client logging onto a domain,
let's also add the analysis of the security logs.
Because as I mentioned before, if we have a physical Windows client that's not
running VMware
tools, it won't be able to on its own do the introspection to be able to report
to the NSX
manager. So to add the log scraping, we'll click right here on security.
And then on the left, we're going to scroll down and click on general settings.
So the path is security and then under settings, general settings. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the path is security and then under settings, general settings.
And then over here in the main pane, we're going to click on the sub tab
identity firewall event log
sources. And then here under event log sources, we're going to enable the ad
log scraper,
which is taking a look at the security logs.
So that way, if we do want to integrate and use security rules that leverage AD
, including AD
membership for physical computers that are not running VMware tools, and then
use those security
policy rules on the distributed firewall or a gateway firewall, we can now use
them. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
them.
So now that is on. So even though we could now use the log scraping with the
distributed firewall
and the gateway firewall, we have yet another step to enable identity firewall
services
on both of those firewalls. And so in the next video, I'd like to walk you
through enabling
the identity firewall for both our distributed firewall and our gateway
firewall.
And again, we'll do that in the very next video. So I'll see you there in just
a moment.