So it's now time to go ahead and start preventing or at least being aware of
those types of attacks.
We're going to do that by first of all, creating an IDS/IPS profile.
And to do that, we're going to do a few things.
Number one, we're going to enable on our distributed firewall the ability to go
ahead and do IDS/IPS.
And then as part of that, we're going to create an IDS/IPS policy.
And then the IDS/IPS rule will go ahead and refer to the profile.
And once we publish those changes, our distributed firewall that's now
leveraging the IDS/IPS WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
leveraging the IDS/IPS
should be now aware of and have visibility into those types of attacks,
or at least that traffic behavior that looks like it might be compromising to
our system.
So as far as the implementation of IDS/IPS, that's what we get to do right now.
So here in the NSX Manager, if we clicked on the Security tab up on top, on the
left,
if we have security overview selected, and then over here in the main pane,
if we click on IDS/IPS, which is right under threat event monitoring,
notice that it says, "Hey, the data center is not prepared for IDS/IPS WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because it has not yet been enabled." Furthermore, if we went under security,
and then on the left under threat event monitoring, and clicked here on IDS/IPS
,
notice once again, it says, "Hey, it's not set up."
So to set up and enable the IDS/IPS functionality,
what we're going to do is the security tab up on the top selected on the left
under policy management,
we're going to click right here on IDS/IPS and malware prevention,
and that leads us to this opportunity to go ahead and set up.
Now, we don't have to use the wizard to enable the IDS/IPS functionality, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, we don't have to use the wizard to enable the IDS/IPS functionality,
but it's super convenient. So if we click on Skip Setup, we could just do it
all manually,
but since we're right here in the wizard, let's click right here on Start Setup
.
So here in these two tiles, on the left, it's asking us how we want to set up
and enable IDS/IPS
and over on the right, it's asking us, do we want to set up and enable the
malware protection?
So the IDS/IPS looking for malicious activity and the malware protection is
actually looking at the payloads
and the content in an attempt to determine if it's malicious software, like
viruses and malware and so forth. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
viruses and malware and so forth.
So on this set of videos, we want to implement the IDS/IPS and we want to go
ahead and implement it,
let's start off with the distributive firewall for EastWest traffic and because
I don't have the additional VMs
deployed yet to support malware prevention, I'm going to say we don't want to
do any of that in this set of videos.
And then later, we can come back and we can enable North-South traffic
effectively enabling the IDS/IPS
for the gateway firewall as opposed to the distributive firewall and then we
can compare and contrast it to.
So for now, I just want to do EastWest traffic with IDS/IPS, which will be part WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for now, I just want to do EastWest traffic with IDS/IPS, which will be part
of our distributive firewall.
And we'll click on Next.
If we have a proxy server between us and the internet, we'd want to go ahead
and specify the details of that proxy server.
And the reason that this is important is because we want to get updates
regarding updated signatures
and that's going to be done online.
So if you have a proxy server, you specify here in my lab environment, I'm not
using a proxy server,
so I'm not going to configure one there.
We'll click on Next to continue.
And now it's asking us, do you want to go ahead and automatically update that?
Now with my evaluation license, if I click here on Auto Update, it's going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now with my evaluation license, if I click here on Auto Update, it's going to
give me an error, it doesn't like to do it.
So I'm going to be using the signature version from April 9, 2023.
That's what I got with this evaluation license.
That's what's currently here.
And I'm not going to bother trying to do auto update because with the
evaluation license, it won't get the latest and greatest information.
However, what we can do is go down here to the Intrusion Signature Set and we
can view and manage that set.
So currently, there's over 11,000 Intrusion Signatures that come with NSX.
So if we click right here on View and Manage Signature Set, here they are. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we click right here on View and Manage Signature Set, here they are.
There's 225 pages worth.
And here are all the details or if we want to filter on one, for example, let's
type in FTP and press Enter.
That would filter and show us just those signatures that have the text FTP in
them.
And then we can expand one of those, for example, and take a look.
So for our demo, I'm going to go ahead and not tweak or customize any of these
signatures.
I'll use the default set.
We'll click on Cancel.
And then as part of the wizard, we'll click on Next.
So now the wizard is next asking us, OK, where do you want to enable this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now the wizard is next asking us, OK, where do you want to enable this
distributed firewall functionality for IDS IPS for your East West traffic?
And so if we expand that, it's now giving us an opportunity here to specify
where we want that enabled.
So I don't have any standalone hosts, so I'll leave that off.
I do, however, have two hosts.
That's ESXIA and B in my cluster called Host Transport Nodes.
In fact, let's just verify that for a moment here.
So here in the vSphere client, we'll go to Host and Clusters.
Here's our Host Transport Nodes cluster and there's ESXIA and B. Fantastic.
So back in the NSX Manager, I'm going to go ahead and enable it just for that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So back in the NSX Manager, I'm going to go ahead and enable it just for that
cluster.
So we'll click on Yes.
And then my management cluster, I don't have any transport nodes there, so I'm
not going to bother enabling it there.
So for our two hosts, Host A and B, which are both in that cluster, the ability
to do IDS/IPS policies with the distributed firewall once we're done with the
wizard should be in place.
So we'll click on Done.
It's also giving us a reminder here for the IDS/IPS and malware prevention that
for the malware part of it, we need some additional VMs to be deployed to
support that.
So just be aware that for the malware, it takes an additional component. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So just be aware that for the malware, it takes an additional component.
However, for the IDS/IPS, we are good to go.
So with the security tab up here on the top selected on the left, if we click
on Security Overview, now if we go to the tab here for IDS/IPS under Threat
Event Monitoring, it's now giving us a nice dashboard.
So here's the IDS/IPS summary.
Currently it's showing us all traffic, but we could also take a look at rules
regarding distributed only, or if we had Gateway, IDS/IPS, we could choose
Gateway here.
To refine that down, if we scroll down further, then we have a distributed IDS/ WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
To refine that down, if we scroll down further, then we have a distributed IDS/
IPS summary and then further down a gateway-based IDS/IPS summary.
And at the moment, there is no activity because we just enabled it a moment ago
.
So on the left under Security Under Threat Event Monitoring, if we click here
on IDS/IPS, we have nothing to report yet.
Also, back under Security Overview, if we go to Threat Event Monitoring, IDS/IP
S, once we do have events here and we click on them, it will take us over to the
IDS/IPS.
So now that we have enabled IDS/IPS for our cluster, does that mean it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now that we have enabled IDS/IPS for our cluster, does that mean it's
currently being used?
And the answer is no, because we also need to have at least one security policy
with one rule regarding IDS/IPS if we want it to work.
So if security is still selected on the left under Policy Management, we're
going to click right here on IDS/IPS and Malware Prevention.
And this is where we went originally, and because it hadn't been set up, it
gave us the wizard. But now that it's set up, we can go ahead and create a
policy.
So for a distributed firewall policy rule for IDS/IPS, we're going to click on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So for a distributed firewall policy rule for IDS/IPS, we're going to click on
distributed rules. If we want to do gateway-based IDS/IPS, we click here on
gateway rules.
And in either case, we are also going to need an IDS/IPS profile, then we can
go ahead and assign.
So there's one here by default, it's called default IDS profile.
And it's only matching on signatures in the critical category, and there's over
5,000 of them out of 11,000.
So for the demo, let's create our own. So we'll click here on Add Profile.
And let's call this our IDS/IPS. And then for the IDS signatures, I'm going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's call this our IDS/IPS. And then for the IDS signatures, I'm going to
include all of them.
So critical, high, medium, low, suspicious. We could also further refine this
based on attack types and attack targets and CVSS information, as well as
products affected.
So I'm going to leave those all out there, default for the demo, and click on
Save.
So now if we expand our IDS/IPS profile, it's going to show us which IDS
signatures it's going to be using, which is effectively all of them,
with no additional filtering based on the attack types or attack targets and so
forth.
[BLANK_AUDIO]