So now that we've got a few minutes to analyze the screenshots and take a look
at what we think is wrong,
let's confirm together what is wrong and we'll also put these solutions in
place to solve it for Carmine.
Again, we're trying to have Carmine at this VM called Win11 client to be able
to go ahead and SSH to this IP address right there.
As part of our troubleshooting, I'm just going to verify that indeed we cannot
use SSH up to that IP address.
So if you're enough, it's being rejected. Let's go and take a look at the
configuration. Let's start in NSX. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here in the NSX manager, let's go to system and I just want to verify that
we have active directory set up and we do.
So that looks OK. And if we click here on check status, that looks good.
And if we click here and click on sync all, although I have a set for five
minutes synchronization interval,
that's being synchronized pretty frequently. So all that part looks good. Let's
next go to security and under security,
we'll go down to distributed firewall and then with distributed firewall
selected, we'll click on settings. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That's why I make sure that we are enabled for identity firewall on the
distributed firewall.
And so if we scroll down here, it looks like we've enabled it here. That looks
great.
And identity firewall status is enabled for host transport nodes cluster. And
that's where the VM in question is.
It's running a host in that cluster. So that part looks OK. So if we click here
on category specific rules,
let's take a look at the rules involved. I'm going to collapse the left hand
side there so we can have a better look.
So here in this policy called domain admins, we have a rule that permits SSH. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here in this policy called domain admins, we have a rule that permits SSH.
So it says allow traffic.
If it's sourced from domain admins, that's our NSX group. If it's going to 23 1
.2.1 and it's using TCP and the destination port is 22.
So that part looks good and it's being applied to the distributed firewall.
And then we have the next rule as part of that policy, which is denying
anything sourced from 10 anything going to the IP address.
If it's TCP and going to part 22 and then the action there is reject and both WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If it's TCP and going to part 22 and then the action there is reject and both
those are enabled.
So it looks like we are not getting matched on this rule. So what we could do
is we could click on inventory and go take a look at domain admins
or we could just click the pencil right here and then here showing us domain
admins selected.
I'll go ahead and say please let me show the one selected. So domain admins,
that's the NSX group.
If we click here on view members, that shows us that we do have one virtual
machine there. Oh, that's the wrong virtual machine.
That is our Windows server. So I'm currently logged on to the Windows server as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That is our Windows server. So I'm currently logged on to the Windows server as
a user administrator who's a member of domain admins.
So the Windows server is showing up, but that's not the Windows client. So this
is the IP address of our Windows server.
And just to confirm the group membership of the click here on group definition,
AD groups, it's pulling based on the members in domain admins.
And so this all looks pretty good to me. So that leads me to leave. It might be
a problem with active directory itself.
Maybe the user Carmine is not included in that group called domain admins.
So let's bring up active directory and take a look. So here is our Windows WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's bring up active directory and take a look. So here is our Windows
server. Let me make that a little bit bigger.
And on the Windows server, we'll go ahead and log in. So here's our active
directory users and computers.
So there is Carmine. There's our domain admins group. Let's take a peek at the
user Carmine. So we'll double click on it.
And then we'll ask to see what members he's a group of. And he is a member of
domain users, but not domain admins.
And that is the problem. So let's go ahead and add Carmine to the domain admins
group.
So we'll click on add and we'll type in domain and then we'll click right here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll click on add and we'll type in domain and then we'll click right here
and check names.
And we want to add him to domain admins. So we'll click on domain admins. Click
on OK. Click on OK again.
So the fact that Carmine was not a member in AD of domain admins and that our
NSX group was based on domain admins,
that would be a really good reason why his virtual machine wasn't showing up.
So let's click on add.
So we'll click on apply here and OK. And then I'm just going to go in and
double check. We'll click on Carmine. Click on member of. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now Carmine's a member of domain admins. All right. So we'll click OK there
. And let me minimize the Windows server.
So back at our distributed firewall, if we went in and edited the source and
went to domain admins, we clicked right here on a few members.
Now there's our Win11 client right there. Fantastic, which is Carmine's
computer. So as a result of this,
we'll click on close here without making any changes here to our configuration
as part of NSX.
Let's bring back Carmine's virtual machine. And let's check now and see whether WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's bring back Carmine's virtual machine. And let's check now and see whether
or not Carmine can access that external router.
So here's Carmine's computer again. And a moment ago, when we tested it, it
wouldn't work. So let the upper key press enter and survey says still not
working.
Why is that? Hmm. Look at that. And we looked at that group. Let's take a
second peek here.
I hope we got inventory and on the left, go to groups and just to confirm
domain admins, if click on view members, there's his computer right there.
So it looks like he's being included, but just to air on the side of caution, I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it looks like he's being included, but just to air on the side of caution, I
'm going to go to system identity firewall and then click on the three dots
right here and say, let's go ahead and sync everything.
So I'll click on sync all then also just for grins. I'm going to go ahead and
log out and log back in as Carmine.
So we'll go ahead and sign out and then we'll go ahead and sign in again.
Fantastic. We'll bring up a command prompt and let's type in SSH dash L for
login as VYOS 223.1.2.1.
We'll press enter and sure enough, it's working. So we'll go ahead and log in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll press enter and sure enough, it's working. So we'll go ahead and log in
with the password for virus user.
So I'll supply that and we are logged in. So it could have been in the
background.
So we just took a moment or two to sync up and now it is working. And as
another test, let's also verify that other computers who are not members of the
domain admin group, they cannot access that IP address using SSH.
So if we go back to distributed firewall, I'll collapse the left hand side. Let
's take a close look at our rule. So this rule right here should prevent anyone
who is not in the domain admins group.
So we're coming from this source address starting with 10 and going to that IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we're coming from this source address starting with 10 and going to that IP
address using SSH, they should be denied. So to confirm that, let's go grab a
computer that's over here on segment 20.
And just to be on the safe side, I'll grab a Linux machine, which I'm sure is
not logging into Active Directory. So let's go ahead and use Mint 20 and we'll
confirm right here that is connected to segment 20.
And let's go and open up a remote console or to Mint 20. So we'll right click
in from the menu. We'll click on open remote console. So here is our Windows
machine where we're logged in as Carmine and SSH is working. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
machine where we're logged in as Carmine and SSH is working.
And this remote console right here is for Mint 20. It's a flavor of Linux and
it is not logged into Active Directory. So if we do a IP address, press enter.
The IP address is 10.20.0.165. Let's just verify with a quick ping that we can
ping 23.1.2.1 just to confirm we have connectivity to that IP address.
So if we try using SSH, so do SSH dash L will log in as the user Vios to 23.1.2 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we try using SSH, so do SSH dash L will log in as the user Vios to 23.1.2
.1. That should be rejected, which it is as indicated right there.
So as far as troubleshooting, all our NSX configuration, the two firewall rules
have a else were perfect. However, the problem was in Active Directory. Carmine
was not a member of the domain admins groups.
So once we added Carmine to that domain admins group in Active Directory, and
then we also gave a little push to the configuration on NSX to tell it to sync
up with Active Directory. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
up with Active Directory.
Regarding that membership, then when we logged in as Carmine at this VM right
here, it recognized that that source was a user who is part of the domain
admins group, which in turn made that VM part of the NSX group that was mapping
to the domain admins group.
And then because that was used as part of a security policy rule to permit the
SSH traffic that started to work. So thank you for joining me in this set of
videos in this skill regarding using identity firewall services as part of our
firewall rules inside of NSX. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And also you my friend in another skill very, very soon. Until then, I hope
this has been informative and I'd like to thank you for viewing.