So the next segment profile we're going to take a look at is the MAC Discovery
segment profile.
And for the MAC Discovery segment profile, it does two primary things. Number
one, if we specify
it can be done, it allows the operator here on this VM and the guest OS to go
ahead and change
the MAC address. So the burned-in or logical original address, if we want to
allow that to be changed,
it's the MAC Discovery segment profile that's going to allow that change.
And the second benefit of a segment profile is the ability to learn about
additional MAC addresses WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
additional MAC addresses
other than the ones that were specified on the VM when it was put in place. So
that way, if this
VM has its own MAC address and maybe it's changed or maybe it hasn't, either
way is great, if we
allow it in the MAC Discovery segment profile. And if they're running
additional services or
anything else that needs a second or third or fourth MAC address that's going
to be used as frames
are being sent out into the segment by this VM, we'd want to specify in our MAC
Discovery segment profiles
that we want to go ahead and enable MAC learning. So again, the MAC Discovery
segment profile
is for allowing the guest OS to change the layer two address and also to have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is for allowing the guest OS to change the layer two address and also to have
more than just one MAC
address. So to demonstrate that, let's go ahead and move to a different segment
. Let's go over here.
I have a little Kali Linux box that we can put right here on segment 10. And
then for our MAC
Discovery segment profile, we'll be able to go ahead and control whether or not
this VM through
the guest OS is allowed to go ahead and change its MAC address and have it be
used. So we might
have a user that can change the MAC address, but it doesn't mean without the
correct MAC Discovery
segment profile that that traffic from that new layer two address is going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
segment profile that that traffic from that new layer two address is going to
be sent through the
network. So let's begin by going to the vSphere environment and making sure
this Kali Linux box
is up and running and that it's on segment 10. All right, so here is Kali 10.
Let's right click
and click on edit settings. And we want to put this on the blue segment 10. So
for its network
interface card is currently on green segment 10. We'll click on browse and let
's go to blue segment 10
right there, select it, click on OK, click on OK again. And then we'll go ahead
and power that up.
And while that's powering up, let's take a look at blue segment 10 and the MAC WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And while that's powering up, let's take a look at blue segment 10 and the MAC
Discovery segment
profile associated with it. So to do that, we're going to go back over to the
NSX manager. We'll
click on networking. We'll go ahead and select segments on the left. And then
we'll take a look
at our blue segment 10, which is right here blue segment 10. Let's just expand
that and scroll down
and take a look at the segment profiles there. So by default, we have this
default MAC Discovery
segment profile assigned. And to take a look at that, we can either go to
profiles and take a look
at it here or we could go back to the segment itself and click on the three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at it here or we could go back to the segment itself and click on the three
dots to edit the
blue segment 10 and then scroll down here and expand segment profiles. And then
here for the MAC
Discovery profile, we can click on the three dots and then simply click on view
right here.
So here in the default MAC Discovery profile, they have by default MAC changes
enabled.
And for MAC Discovery, it's disabled, meaning that the client can't have more
than one MAC
address associated with that VM because the segment profile is not learning
about any additional
MAC addresses. So here's what I propose we do. Let's test this first and verify WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
MAC addresses. So here's what I propose we do. Let's test this first and verify
that the user
and the guest OS can change their layer two address and verify that it works.
And then what we'll do
is we'll go in and create a new MAC Discovery segment profile that doesn't
allow a MAC change,
apply that, and then compare and contrast the results. So to test this, let me
bring in that
little Kali Linux box. This is Kali 10, I'm logged in as root. And we should be
able to change
the MAC address. Let's verify what our current MAC address is with an IF config
for Ethernet 0.
And our current MAC address is ending in F754. Let's also verify our current WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And our current MAC address is ending in F754. Let's also verify our current
connectivity out to
the internet with a ping out to www.google.com. And that seems to be working
great DNS and
internet connectivity. And let's use utility called MAC Changer. So I'm going
to type in MAC
Changer -h for help. So if we want to set up a random layer two address for
Ethernet 0, we use the
up arrow key and change that h to an r for random MAC address. And then type in
eth 0 referring to
the ether interface and press enter. So that was the previous address ending in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the ether interface and press enter. So that was the previous address ending in
F754. And now we
have a new one ending in 8288. So now if we had the up arrow key a few times
and tried it at ping
Google.com, no problem at all. We changed our layer two to us. And the MAC
discovery profile is
allowing that no problem whatsoever. So I'll do a control C there. Let's go
back to the NSX
manager. We'll close that. And we're still in edit mode for the blue segment 10
right here. So let's
go down to the segment profiles. And then for the MAC discovery, let's go ahead
and choose a non-default
one. So to do that, we're going to go ahead and create a new MAC discovery WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
one. So to do that, we're going to go ahead and create a new MAC discovery
profile by clicking
and create new. Let's call this our MAC discovery profile. And we're going to
specify that MAC
changes are not enabled. So we'll click on save and then click on save again,
then go ahead and
click on close editing. Then I'm going to open up that segment detail one more
time, just to verify
that it took so MAC discovery, we're using our MAC discovery profile. Fantastic
. And for that
segment, if we collapse this and we scroll to the right a little bit, if we
click here on the port
slash interfaces, that gives us an opportunity to confirm the VMs that are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
slash interfaces, that gives us an opportunity to confirm the VMs that are
connected and also if
we scroll down details regarding which segment port profiles are using. And
this VM is inheriting
them from the segment profile on the segment itself, including our MAC
discovery profile. All
right, sounds great. So we'll close that and let's bring back our VM. So as a
fair test for this VM,
I'm going to set the MAC address back to its original one. So let me go ahead
and do a MAC
changer dash H. And I'm going to use the dash P option to set it back to its
original MAC address.
So we'll hit the up here key a few times. And instead of dash R, we'll do a
dash P, press enter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
dash P, press enter.
And let's go ahead and try to ping out to Google.com. And that's working no
problems. We'll do a
control C. However, now if we try to change the MAC address, so I'll go ahead
and use the dash R
option again to change the MAC address for Ethernet zero. So there was the
original MAC address. Now
it's the one ending in D 025. However, now because we have a MAC discovery
segment profile that says
nope, not allowed changing layer two addresses at the client. Any traffic that
we now try to send in
from this new layer to source MAC address should not be allowed at the segment.
And we can also
confirm with I have config that indeed we have that layer to address. So now if WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
confirm with I have config that indeed we have that layer to address. So now if
we try to do a ping
or any other traffic for that matter out to the rest of the world, we are being
dropped right at
the segment because we are not allowed to change our layer to address. So hit
the up here key a
few times. And we did the dash P, which is to restore it back to its original
address. So now it's
back to its original address. And then we try to ping now, no problem
whatsoever. So I'll stop that
ping. And as part of that profile is attached right here, if we needed our VMs
to be able to use more
than just one or two MAC addresses, we could edit the profile so we could click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
than just one or two MAC addresses, we could edit the profile so we could click
here on profiles or
just go to where that profile is applied. So here for blue segment 10, if we
edit the segment and
click on edit here and then go down and expand the segment profiles. And then
for MAC discovery,
we can go ahead and edit this one right here by clicking on the three dots and
clicking on edit.
So here if we want to allow MAC changes, we'll go ahead and choose that option
there. If we want
to have multiple MAC addresses allowed, we can go ahead and use the MAC
learning and then we can
set up our limit. So I'm going to leave it in this state where we're allowing a
change and we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
change and we're
allowing more than just one MAC address to be used by a VM. And that'll be
allowed by using this
option right here of MAC learning. And we'll click on save and save and we'll
click on close editing
and just to confirm, let's bring back our client. So a moment ago, when we
changed the MAC address,
I'll go ahead and do a change with the dash R. Now we have a different MAC
address. Now we're
still able to go out to the internet and forward traffic because we're allowing
changes. And if
this VM had more than just a single MAC address, that would be allowed as well.