So in this video, we're going to take the IDS/IPS profile
that we just created in the previous video.
And now we'll apply that as part of an IDS/IPS rule
as we apply it to our distributed firewall.
And before we create this new security policy and rule,
let's take a current look at the distributed firewall
over here on ESXIA.
So here is ESXIA.
We're at the NSX CLI and let's do a get IDS status.
So it should say enabled,
and that's because we enabled it for the cluster.
So that part looks great.
And let's do a get IDS profile. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's do a get IDS profile.
So currently it shows we have no IDS profiles.
And that's because we don't have our profile,
we just created applied yet as part of the rules.
So we can confirm that by doing a get IDS rules press enter,
and currently there are no IDS rules.
However, the moment we create a policy and rule
and associate the profile with it,
once we publish that out ESXIA,
which is one of our host transport nodes,
we'll have both a copy of that profile that's being used
as well as the rule where that profile is being used. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as well as the rule where that profile is being used.
So here at the NSX manager,
we're gonna go to the security tab once again,
on the left under policy management,
we'll go down to IDS/IPS and malware prevention.
And for our first example,
we're gonna go ahead and use an IDS/IPS policy
as part of our distributed firewall.
So we're not gonna click, for example, on gateway rules,
that'd be the policies and rules applied to individual
gateways, we wanna go ahead and apply it
to the distributed firewall.
So we'll click right here on distributed rules,
and then we have two categories.
We have the emergency threat rules and threat rules, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have the emergency threat rules and threat rules,
they both have zero policies and rules in them.
So we'll click here on threat rules
and we'll click on add policy.
And then we collapse the left-hand side.
And it's just a reminder of where we're at in the interface
under IDS/IPS and malware prevention.
And let's name this policy our IDS-IPS policy.
And then with it selected,
we'll go ahead and click on add rule.
And we'll call this first rule,
use our profile rule 'cause that's what we're gonna do.
So we can specify sources based on things
we've done in the past, for example, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we've done in the past, for example,
based on group membership or IP address and so forth.
Same with destination.
And for services, we could have this rule
apply just to specific services we're looking for.
I'm gonna leave this all set to any wide open.
And then here under security profiles,
we'll click on the pencil.
And then here we'll specify the actual security profile
we wanna use.
So there's a tab for IDS/IPS profiles,
one for malware prevention.
We wanna use the IDS/IPS profile we just created.
So we'll select that as a reminder of what it's doing.
We can expand it and take a look
at which signatures it's gonna be using, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at which signatures it's gonna be using,
it's gonna be using all of them.
So we'll click on apply.
And then for the mode, we can go ahead
and specify detect only or detect and prevent.
And then to push this out, we'll click right here on publish.
So this new rule as part of this new policy
is part of our distributed firewall for IDS/IPS functionality.
So that looks like it's all good to go.
And we can also go to the CLI
on one of our transport nodes just to verify
that it now sees a profile and it also sees a rule.
And that rule should show as rule number 8168 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that rule should show as rule number 8168
as reflected right here.
So a moment ago, when we did this get IDS profile,
it didn't have any.
And now there is the profile that it's using.
And the reason it has it is because it's using it
as part of this rule 8168, which has the action of prevent.
Also we went back and we changed this from detect
and prevent to just detect only and published it out.
And then went back to the CLI and then hit the up arrow key.
It's now gonna show as detect.
So either way, whether it's prevent or detect,
we're gonna have the event show up inside WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're gonna have the event show up inside
of our monitoring for IDS/IPS traffic.
So as we take a look at our checklist,
we verified our depology,
we verified our intrusion tools with N-Map and Metasploit.
We created the profile, we use the profile
as part of our distributed firewall.
And for our next step, we get to test just to verify
that the NSX IDS/IPS functionality is picking up
and identifying on some of that traffic
that looks a little bit suspicious from this VM
that's going over to this VM right here.
Now the cool thing also about the distributed firewall WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now the cool thing also about the distributed firewall
with IDS/IPS is that we don't have to be going
through a gateway to get there.
We could also be talking about traffic
between one VM here on segment 10 and another one.
And that's one of the beauties of a distributed firewall
is the micro control we have between VMs.
Whether or not they're actually going
through a layer three router to communicate
with the other device.
[BLANK_AUDIO]