Now that we have our Active Directory integration with the LDAP and also Logsc
raping enabled,
our next step is to train the distributed firewall and gateway firewall
functions
that we want to enable the ability to leverage identity-based firewall services
.
So think of it like this step, putting all the infrastructure in place,
and then this step is actually telling the distributed firewalls and the
gateway firewalls
they can now start using identity services as part of their security policy
rules.
So to train those two firewalls, distributed firewall and the gateway firewall,
that we want them to be able to use identity services as part of their security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we want them to be able to use identity services as part of their security
policy rules,
we're going to click on security right here in the NSX manager.
And then on the left, we're going to go to the distributed firewall and gateway
firewall
respectively to tell them, yes, we want to be able to use identity services.
So we'll start off with the distributed firewall right there by clicking on
distributed firewall.
And then in the distributed firewall pane over here,
we're going to click on the sub tab of settings right there.
So we'll click on settings and you'll notice that here we have the distributed
firewall service
settings on by default. However, for the identity firewall services, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
settings on by default. However, for the identity firewall services,
we need to enable that specifically. So we're going to click right here in the
sub tab called
identity firewall settings. So here's warning us that if we want to provide
identity firewall
services for physical machines, make sure you turn on logs scraping, which we
already did.
So I'm going to dismiss that message. And then right here, for the distributed
firewall,
if we want to be able to use identity firewall services, we simply flip that
switch and say,
yes, there, and then furthermore, we'd scroll down and identify exactly which
clusters.
So because right now we have over on segment 10, we have our windows client WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So because right now we have over on segment 10, we have our windows client
sitting there,
and it's in the cluster called host transport nodes. In fact, let's verify that
real quick.
So back in the VCR client, here we have when 11 client, and we just click on
the VMs for testing
and click on the VMs tab right here. And that will show us where it's running.
So when 11 client
is currently running on ESXIA, and if we go over to our host and clusters view,
and we go to our
host transport nodes, sure enough ESXIA is in the host transport nodes cluster.
So in NSX, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in NSX,
we'll simply say, you know what for that cluster, we want to go ahead and
enable identity firewall
services. So back in the NSX manager for that cluster called host transport
nodes, we're going
to go ahead and enable it and says, are you sure I'm gonna say yes, and boom,
identity firewall
services are now enabled on VMs that are running on hosts in that cluster. And
then in my management
cluster, those two ESXIA hosts are not enabled for NSX. And I don't have any V
Ms on the management
cluster ESXIA hosts that need to report in regarding logging on to AD. So I'm WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
cluster ESXIA hosts that need to report in regarding logging on to AD. So I'm
just going to go ahead
and enable it for this one cluster host transport nodes, which is where our
windows client is running.
So that's how we would enable that feature for the distributed firewall. And
while we're here,
let's also enable it for the gateway firewall as well. So we'll click on
gateway firewall on the
left. And then once again, here in the pane for gateway firewall, we'll click
on settings.
And very similar, we're simply going to enable the identity firewall services
on the gateways
where we intend to use policies and rules that are going to be matching on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
where we intend to use policies and rules that are going to be matching on the
source information
based on an NSX group, which behind the scenes is tied to our linking to an
active directory group.
So I'm going to go ahead and enable this for all three. So I just did it for
the tier zero gateway,
or we can just click on all of them and click right here and turn on and
identity firewall
and turn on. And that would enable all three as well. It's also warning us that
we need to have
at least one event log source turned on for identity firewall to work. So if we
go back to the system
tab here, and then on the left, if we go to identity firewall AD right there, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tab here, and then on the left, if we go to identity firewall AD right there,
and here if we
click on edit, here we can specify our event log server as well. Should we need
it? However,
in the lab, I'm just going to be using my one Windows client VM, which has the
VMware tools fully
installed. And we're going to be using that as a demo as part of the
distributed firewall. So we
don't really need to set that however, in the event we needed to, we could
click set right here,
and then click on add event log server and put in the details for our event log
server. So I
can't sell out of that with no changes there. So it's a quick summary of what
we've done. We trained
NSX about the active directory server, including the LDAP services to do the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
NSX about the active directory server, including the LDAP services to do the
group mapping association
between a user and what groups to remember of. We also went to the security tab
and we went to
our distributed firewall and gateway firewall and under settings, we said
please enable the
identity firewall services. So we do that right here by enabling it and then
specifically saying
what clusters we want to enable that function on. And then our last step would
be to make a group
that is linking to or referring to the membership of an active directory group.
So let's do that as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's do that as
well right here by clicking on inventory on the left, we'll click on groups and
let's create a new
group. So I'll click right here on ad group and I'm going to put a period in
front that way it
sorts to the very top and be super easy to find. And let's call this NSX group
tied to AD group.
So when we refer to this group on the back end, it's going to be looking at the
group membership
in active directory. So I'm going to name it like that. So when we see it, we
'll know what it does.
And then as far as who's going to be a member of this group under compute
members, we'll click on
set. So then for the criteria regarding who is a member of this group, instead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
set. So then for the criteria regarding who is a member of this group, instead
of using the option
here for member criteria, we have this sub tab over here called AD groups. So
currently, there's
nothing being identified as far as being a member of this group. So we're going
to change that by
clicking here on AD groups. And then we're going to scroll all the way down or
we can just filter
the group I made an ad was called yes, I believe, so I'll type in yes. And
there's yes to SSH. So
we're going to select that ad group and that group called yes to SSH is in the
users container,
which is the domain component NSX demo, which is in the top level domain WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is the domain component NSX demo, which is in the top level domain
component called local.
So we're going to include any users that are a member of that group and
effectively,
they're going to be a member of this group called NSX group tied to AD group
and we'll click on apply
and then click on save and check this out. So here's our group. So here is our
windows computer.
Let me go ahead and log back in. So we are definitely logged on to the domain.
So here in this group,
if we click right here on view members, it should show us that machine. So
right here,
this is effective members, it's all zeros, let me click on refresh. And you WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this is effective members, it's all zeros, let me click on refresh. And you
know what,
let me just log out and log back in because we just added that group a moment
ago. In fact,
let's do a couple things. I'm going to click on close here and let's go back to
system and we'll
go down to identity firewall ad. I'm going to click right here and say, please
sync everything.
And then with that done, I'm also going to hedge my bets and let's log out of
this little windows
client. So we'll go ahead and log out and then we'll go ahead and log back in.
I'll put in the
password there and we are now logged in. So now that everything has been WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
password there and we are now logged in. So now that everything has been
refreshed, this user is
also logged in. We should now be able to go back to our inventory by clicking
on the inventory tab,
go to groups. So here's our NSX group tied to ad group. And now if we click
here on view members,
we should see that VM and I don't see it. So that's going to be a pretty boring
demo if we don't
get that user machine in this group. So let me go ahead and close that and let
's just check our
work. So system on the left hand side, identity firewall ad and that all looks
good. If we click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
good. If we click
check status, this has success. So that looks good. And then under security and
distributed firewall
and settings for distributed firewall, we currently have identity firewall
services enabled. And it's
also enabled on our host transport nodes cluster. So that part looks good. And
then for our gateway
firewall and under settings for the gateway firewall, it's also enabled as well
. So I'm going to go
ahead and take my little VM here and I'm going to completely restart that VM.
So I'm going to restart
this VM and then log back in and let's go back and take a look now that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this VM and then log back in and let's go back and take a look now that we
refreshed and checked
all of our work. All right, so we'll log back in is 80 NSX user to so that
looks good. Let's also
verify connectivity out to the internet. So ping Google dot com. So name
resolutions working. And
if you do NS lookup, so I verify we're using the correct DNS server, we are
fantastic. So I'll
type an exit and let's go back and take a look at our work. So we'll minimize
that. And let's go
back to inventory. We'll go ahead and click on groups. We'll take a look at our
NSX group tied to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
NSX group tied to
AV group, click here on view members. And sure enough, there we go. There's our
win 11 clients. So
our group definition is based on the AD group called yes to SSH. And that user
is a member of
that group. That's why that VM is showing up right here. So that's great news.
We'll click on close
there. And now we can leverage that group as part of our security rules. And we
'll take that next
logical step in the very next video. So I'll see you there in just a moment.