So let's begin with the acronyms for IDS and IPS.
IDS is the acronym for intrusion detection system.
And then the IPS would be intrusion prevention system.
And the biggest difference there between an IDS and an IPS
is what the device that's running the IPS IDS software
is going to do when it actually sees an attack.
Or if it sees there's some abnormal behavior
that triggers an IPS/IDS event.
Is it going to just detect it and report it
or is it going to go ahead and not only detect it, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or is it going to go ahead and not only detect it,
but also prevent it from moving any forward
through the network.
And the biggest difference when implementing IDS versus IPS
in NSX is what we specify on the rule.
For the rule, we're going to have an action,
which is going to say, do you want to go ahead and just
detect this?
Or do you want to go ahead and prevent it
from making it any further through the network?
And as a result of that rule, that
would make it IDS for detection only or IPS.
It was doing the detection as well as the prevention
of that traffic flow going any further through the network.
Now, one of the questions that might come up is, OK,
well, why would we ever want to say intrusion detection only WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
well, why would we ever want to say intrusion detection only
and not prevention?
And one of the big answers is, when you first
enable the features, there may be traffic that's actually
innocent production traffic going through the network
that we are going to be accidentally denying and rejecting.
And as a result, we can impact production networks.
So one of the strategies is to go ahead and set up
the policies and the rules and have it go ahead and do detection
only initially.
And then after we've let that run for, let's say, 45 days
or a couple of months, and we've had a chance to take a look
at all the events that are being generated, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at all the events that are being generated,
then maybe we start to customize our profiles and policies
and rules, and then we set up some of it
to go ahead and do prevention.
And again, that's like a one, two punch.
And that way, we're not accidentally just
turning it on and say, stop everything
and possibly harming production traffic.
And let's talk for a few moments about some of the methods
that NSX is using to identify an intrusion.
The primary tool is a set of signatures.
And so in those signatures, we could
be looking for an exact match regarding a traffic flow
or a behavior.
For example, for this VM to be doing a TCP send request WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For example, for this VM to be doing a TCP send request
to the server right here, that's pretty normal.
But this device right here is doing
a scan or a TCP request of this device
and every other device on the 1020 network.
That's no longer so innocent.
And if those connection requests happened
at lots of different machines or we're scanning
one individual machine and we're scanning
on the first 10,000 TCP ports or UDP ports
to find out what's available, that's a pretty good indicator
that something abnormal is happening here from this VM.
At which point, if we had some rules in place WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
At which point, if we had some rules in place
that said to go ahead and prevent it,
when NSX sees that traffic and that signatures
matched in the behavior scene, it can go ahead
and stop that traffic from flowing further through the network.
Now another question is, where do we want our NSX
to implement the ID/IPS?
And the answer is hopefully we're
going to implement it where it's needed.
But there are a few options.
One is we could implement a policy for ID/IPS
as distributed, so think of that like hovering
over our entire network.
Or we had the option of implementing the ID/IPS on a gateway. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or we had the option of implementing the ID/IPS on a gateway.
And so currently with the current flavor of NSX,
we can implement it on any of our tier one gateways.
And let's imagine we just want to apply here on gateway A.
And then whenever policies and rules we configure
and create regarding ID/IPS will be implemented
for traffic that's being routed through
this logical gateway A.
So in the interface, when we go to work with
and configure the ID/IPS, when it asks us
about protecting East West traffic,
what it's really referring to with ID/IPS
is the IPS policy being implemented WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is the IPS policy being implemented
on our distributed firewall.
And if we implement our ID/IPS on our gateway
in the interface, it'll offer refer to that
as North-South traffic.
Although that's not 100% completely true,
because we could also have this gateway right here
running the ID/IPS policies and rules.
They would also protect, for example, traffic from here
that's trying to go over here.
Because once again, it's going through this firewall.
But in the interface, just be aware that for DFW,
it's often referring to East West traffic
and for the ID/IPS implement on the gateway WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and for the ID/IPS implement on the gateway
is focused on North-South traffic.
And one other feature that's very commonly talked about
right in the same paragraph as ID/IPS
is the concept of malware protection.
And while ID/IPS is focused on seeing
if there's intrusion attempts,
malware protection is actually taking a look
at the files and content that are being sent
in the payload of our packets,
and logically assembling those segments together
to take a look at the payload,
and then identify whether or not that payload
is carrying any type of malware.
So the implementation of malware protection WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the implementation of malware protection
is a few additional steps,
including some appliances that we'll need to pull it off.
However, for just the ID/IPS part,
we can do that with our existing nodes,
our host transport nodes and our edge transport nodes.
And we don't need to add a separate appliance
or component instead of NSX, just for the ID/IPS.
And also one other thing I should mention about ID/IPS
is that we also need to have an appropriate license
to go ahead and run it.
So in the lab here, I've got my license from Vmug,
which is an evaluation license for NSX, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is an evaluation license for NSX,
and it does support the basics
of implementing the ID/IPS functionality.