So for this last piece, it's going to look very similar to the distributed
firewall with
ID/IPS, but instead of going to the tab for distributed, we're going to go to
the tab for
gateway.
And we'll specify that we want the ID/IPS policy in the specified rule as part
of that
policy applied just here to gateway.
So here in the NSX manager, we'll once again go to security and we'll go to our
policy
management with ID/IPS.
And I'm going to take this policy that we just created and let's go ahead and
disable
all rules. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all rules.
Once we publish this, there's no rules that are currently enabled on the
distributed firewall
regarding ID/IPS.
So still here with security on the top selected, on the left ID/IPS over here
selected, we're
going to click on profiles just to confirm we still have our profile here
called our ID/IPS.
And now we're going to use that, but instead of using it as part of our
distributed firewall,
we'll apply it specifically just to gateway A.
So to do that, we're going to click here on gateway rules as opposed to
distributed
rules.
And here it's warning us that we don't have it enabled. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And here it's warning us that we don't have it enabled.
So if we click here on settings, so on the left, we have ID/IPS selected on the
sub tab
here under ID/IPS, we are clicking on settings.
And then as we scroll down, here's where we now have the opportunity to go
ahead and
specify for the distributed ID/IPS to enable it, which we did earlier.
And now we can also enable it for our gateways.
That's the key word there to enable the ID/IPS functionality on a specific
gateway.
So based on our plan, if we want to enable the ID/IPS policy on gateway A, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So based on our plan, if we want to enable the ID/IPS policy on gateway A, we
need to
at least enable it here for gateway A.
So I'll click that slider there.
We'll click on yes.
And also while we're at it, I'll also go ahead and enable it for gateway B in
the event
that we want to do the ID/IPS on gateway B at some point as well.
So now here we have the gateways enabled.
And up here, we also have this cluster for distributed firewall services for ID
/IPS enabled.
So we click on refresh.
Just to confirm our settings, those all look good.
So now we can go back to our gateway rules right here.
And for our gateway rules, we'll go ahead and choose the tier one gateway that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for our gateway rules, we'll go ahead and choose the tier one gateway that
we want
to apply this to.
So we'll go ahead to our gateway A and we'll click add policy.
Let me collapse the left hand side to give us a little bit more room.
And for this policy, let's call it IDS on gateway -a.
And then in this policy, we'll create one rule.
And for this rule, we'll say use our profile.
And that's going to refer to our ID/IPS profile, which we will select right
here.
So we'll click on the pencil and the column for security profiles.
And we'll select once again our IDS-IPS profile we created earlier, click on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll select once again our IDS-IPS profile we created earlier, click on
apply.
And then specify here under mode, which mode we want.
Do we want IDS only, which is detect only, or do we want IPS, which is detect
and prevent?
And again, initially, we probably want to do detection only, see what actually
gets hit
and matched on, and then tune our profiles and then move into a mode where we
can start
doing prevention as well.
So I'm going to leave this as detect only for here.
We'll click on publish, we'll make sure it is completely pushed out.
We'll click here on refresh, that looks good. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll click here on refresh, that looks good.
So now that we have the IDS/IPS implemented at a gateway.
And I've also sent some more traffic through the network.
We can view that by going here under security and security overview.
And then here under threat event monitoring, click here on IDS/IPS and our
counts have increased.
So if we want to see the ones that were just from the distributed only, which
were earlier,
we click on here, if we want to see the ones that were related to just the
gateway based
IDS/IPS, we click here.
And then furthermore, we could go ahead and click here and now take us down
under threat
event monitoring, IPS/IDS with the gateway only option selected right here as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
event monitoring, IPS/IDS with the gateway only option selected right here as
well.
Or if we wanted to switch that back, we could just use the dropdown, say look
at all traffic.
And that would include the IDS/IPS on the distributed firewall, as well as the
IDS/IPS
applied to the gateway.
So once again, if we want to see the gateway based traffic only, we see it
right here.
Then we can hover over here, see more details and also down below it has more
details as
well.
So now as part of our plan, we've also walked through the process of using IDS/
IPS, but instead
of applying it as part of a distributed firewall function, we're now applying WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of applying it as part of a distributed firewall function, we're now applying
it here to gateway
A.
[BLANK_AUDIO]