All right, my friends.
So for our game plan regarding the implementation and testing of IDS and IPS,
let's do the following.
First, let's verify our topology.
And that'll be important because I did add a couple new VMs.
I added a Kali Linux VM right here on segment 10.
That's ready to go with a whole bunch of pen testing tools.
And I also have a little VM down here called Metasploidable.
And I'm currently using Metasploidable version two.
Now, one of the questions might be, well, what exactly is Metasploidable?
That is an intentionally vulnerable system with tons of weaknesses. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That is an intentionally vulnerable system with tons of weaknesses.
And with that intentionally vulnerable machine to test environment, we can test
our scanners
and vulnerability testing tools and penetration testing tools and get that
practice of what
it looks and feels like to have a system that is compromised and also how to
use the tools
that do it, which leads me to our next step.
Once we verify our topology, let's also verify a few of our attack tools.
From here are Kali Linux box going down to our intentionally vulnerable Metaspl
oidable
version two VM right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
version two VM right here.
So I'm just gonna say test intrusion tools from here to there just to verify
that they're
working and available.
Also just to remind ourselves about what a vulnerable system looks like and how
dangerous
it is to have a vulnerable system or an unpatched system on our network.
So our next step is then to go ahead and enable the IDS/IPS functionality
inside of NSX.
And to do that, we're gonna create an IDS/IPS profile that specifies what we
want to look
for based on signatures.
And then secondly, we're also gonna go ahead and apply that profile inside of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then secondly, we're also gonna go ahead and apply that profile inside of
our IDS/IPS
rule that will apply.
And initially, we'll include the IDS/IPS as part of our distributed firewall.
And then once we have that in place, we'll go ahead and then test to verify
that works.
And then just for grands, I think we should also take a moment and see what it
looks like
instead of implementing it as a DFW policy.
Let's implement our IDS/IPS as a gateway policy.
And let's also implement it right here on our tier one gateway A.
And again, the distributed firewall would be an example of controlling East- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And again, the distributed firewall would be an example of controlling East-
West traffic
as the distributed firewall is hovering, if you will, over our entire
architecture where
all the VMs are.
And the IDS/IPS implemented the gateway would only control traffic going
through the gateway
we applied on.
So for example, if we only had IDS/IPS implemented on this gateway, traffic,
for example, here
from this VM going to this VM, they would not be going through this logical
gateway.
And as a result, that traffic wouldn't be inspected or looked at for the
benefits of
IDS/IPS. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
IDS/IPS.
And for some of the tools that we could use for the testing here, let's go
ahead and use
N-Map or as graphical based cousin, Z-Map.
And we can also use the MSF, the Metasplodible Framework, which is already part
of the Kali
Linux distribution, to go ahead and test and interact between our Kali Linux
box and this
vulnerable server.