So for our next segment profile, we're going to take a look at spoof guard and
spoof guard is all about preventing the guest OS for example on a VM right here
from changing the IP address to some other IP address and having that IP
address being able to used by this VM.
So if this client was given the IP address ending in dot 185 through D HCP
services.
And later the user on this VM with the guest OS tries to change that to like
186 or some other IP address that wasn't discovered and associate with this VM
spoof guard is not going to permit any traffic without source IP address coming WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
spoof guard is not going to permit any traffic without source IP address coming
in from this VM,
because it's not the one that that VM should be using.
So the goal of spoof guard is to prevent VMS from lying about their source IP
address as they send traffic into the network.
So in this video, I'd like to go ahead and create our own customized spoof
guard segment profile, apply it to the segment and then verify the results on
this VM.
So currently I've got Kelly 10, this little VM right here, and I just moved it
over to this segment right here segment 10 non VRF.
So let's bring in that little VM and just verify basic connectivity. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's bring in that little VM and just verify basic connectivity.
So we'll bring in that little client will go to command prompt.
And from here, let's do a ping out to www.google.com that works great.
Fantastic that verifies DNS verifies internet connectivity.
And let's also do an IF config for ethernet zero just to verify its IP address
as 10 10 0 184.
So here in the NSX manager, if we go to that segment segment 10 right there,
and we scroll to the right a little bit if we click on this link here under
port slash interfaces, it'll show us the details for that Kali Linux box if we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
port slash interfaces, it'll show us the details for that Kali Linux box if we
expand it and scroll down.
It's also going to confirm for us the segment profiles that are currently in
use.
Now this segment is using all the defaults, including the spoof guard default.
So let's go ahead and create a new profile click on close here.
So still here in networking and with segment selected, let's click on the sub
tab for profiles and let's create a new spoof guard profile.
So we'll click right here and add segment profile from the drop down will
choose spoof guard.
And then for the spoof guard profile will go ahead and enable port bindings and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then for the spoof guard profile will go ahead and enable port bindings and
click on save.
And then the last step will lead to apply this spoof guard profile to our
segment.
So under segments, we'll click here here in NSX, we'll go down to our seg 10
non VRF will click on the three dots will click on edit and then scroll down
and here will expand segment profiles.
And for the spoof guard will use the drop down and simply choose our spoof
guard and click on save and we'll click on close editing.
And now that we've applied that profile, let's bring back our client.
So here's our client and the social verify internet connectivity that still WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here's our client and the social verify internet connectivity that still
works.
But if we were to change the IP address, for example, to 185 or 186 because
spoof guard is in place, that traffic won't be allowed.
So let's change the IP address with pseudo I have config for ethernet zero and
let's specify 10 dot 10 dot 0 dot 185 with a 24 bit mask and press enter.
I'll go ahead and authenticate and we are good to go.
So now if we do an I have config for ethernet zero, there's our new IP address
ending in dot 185.
And then we tried internet connectivity again. That's not going to fly. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We could also try to ping an IP address like 888 and that's not going to fly.
We could try to ping our default gateway of 10 dot 10 dot 0 dot 1 and that's
not going to fly.
However, if we put the IP address back to where it was, so do the I have config
again.
And let's set it to 184. Now we try to ping our default gateway no problem.
If we try to ping the internet, no problem, and we can do that with her without
name resolution because we now have internet connectivity out to our DNS server
as well.
So now that we have the IP address that's expected for us from this VM, it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now that we have the IP address that's expected for us from this VM, it's
once again allowing that traffic to flow over the network.