To help us reinforce the concept of ID/IPS.
Whether they are distributed rules applied across the entire topology or
whether they're
a gateway-based rule applied to a specific gateway, this scenario is going to
help us
confirm our understanding.
And here's the scenario.
The customer thinks or believes that the ID/IPS functionality is enabled to
protect all VM
traffic within the segments of segment 10 over here and segment 20 over here.
However, unfortunately, the ID/IPS events that should be popping up and should WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, unfortunately, the ID/IPS events that should be popping up and should
be appearing
instead of NSX for two VMs, for example, like these two right here or, for
example, like
these two right here.
The traffic between those two VMs that normally should be triggering off
signatures and there
should be alerts and alarms, they are not being recorded.
So here is your mission, my friend, should you choose to accept it.
I'd like you to take a peek at the following series of screenshots right below
this video
and take a look at each one of them regarding the NSX configuration with an eye WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and take a look at each one of them regarding the NSX configuration with an eye
towards
IPS/IDS and using those screenshots.
Here's what I would love for you to determine.
Identify why, for example, these two VMs here or these two VMs here in the same
segment.
Why it is that the ID/IPS isn't identifying or seeing any traffic which would
normally
be picked up by ID/IPS.
Something is wrong with the config and based on the screenshots, the customer
would like
us to help identify what the problem is.
So here is what I would like you to do.
Take the next minute or two to consider the topology and the existing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Take the next minute or two to consider the topology and the existing
screenshots and
identify what you think the problem is.
And then once you've had some time to go through it, join me in the next video
as we
take a moment and compare notes about what we think is wrong and why the ID/IPS
isn't
working as expected for this customer.
So have some fun with this scenario and I'll see you in a little bit when you
are ready.
[BLANK_AUDIO]