So in the previous video, we started generating some network traffic, some of
that traffic
coming from our Linux clients going to our web servers and also from our Linux
clients
going out to the internet and in the background, those traffic patterns are
still happening.
So if we go over here to my little script, it is still doing curl every five
seconds
to each of the web servers.
And that's happening from both of the clients.
So I just want to confirm we have our traffic patterns still in place.
Let me minimize the remote consoles.
And now let's go ahead and put the NSX intelligence feature to work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now let's go ahead and put the NSX intelligence feature to work.
So we already enabled the NSX intelligence feature.
So if we go to system and down to the NSX application platform and then as we
scroll
down, here is the NSX intelligence, which has been activated successfully.
Now it's time to leverage that information.
So to actually see the visualization of our traffic patterns courtesy of NSX
intelligence,
the way we do it is go to plan and troubleshoot right here.
And then when we click here on plan and troubleshoot, it takes us to this first
option under discover
and plan and that's discover and take action.
And that is showing us a visual representation of our traffic flows. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that is showing us a visual representation of our traffic flows.
And let's focus up here on what our options are.
So if we use the drop down here, we have the option to take a look at this and
the traffic
flow is based on groups or we can do it based on computes.
So if we select computes, we can say, you know what, I want to see traffic
based on
this VM and I don't need the cluster services.
So we want this VM and that web server and that web server.
And then click here on apply and this is going to show us a representation
based on what we
selected.
So if we expand this and make it a little bit bigger, here we have one of our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we expand this and make it a little bit bigger, here we have one of our
mint computers.
So that's our mint on 10.55.
And you're just hovering over the name.
And here we have our other mint VM that's our mint on 10.66.
And here we have our web server on 10.66.
And over here we have our web server on the 10.55 network.
It's also showing us for the pop up here regarding how many protected or
unprotected flows it
currently sees.
If it says unprotected, that means that traffic is flowing.
However, it's not being controlled by a rule as part of a firewall policy or if
we had
some that showed up as blocked, that means that we have a firewall policy rule WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
some that showed up as blocked, that means that we have a firewall policy rule
that's
blocking that flow of traffic.
And if we have a firewall policy rule that says permit a certain flow of
traffic that
would show up as allowed now because they don't have any specific firewall
policy rules
in place that I created, everything is going to show up as unprotected.
So these are our four VMs and this 10.1.2.3 that is my DHCP service.
So if we expand this big enough, it'll show us the actual ports involved.
We can also right click on that flow and then click here on flow details and it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can also right click on that flow and then click here on flow details and it
'll give
us a nice nitty gritty detail on what that is.
So if we expand that, that is UDP traffic.
And if click here on services is DHCP using UDP port 67.
So a DHCP services port 67 is used on the server side and port 68 is used on
the client
side.
So when a DHCP client is talking to a DHCP server, it'd be coming from UDP port
68 going
to the server well known port of UDP port 67.
So this is showing us about that flow courtesy of NSX intelligent. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is showing us about that flow courtesy of NSX intelligent.
Let me go ahead and close that or another option would be to go ahead and right
click
on our VM here.
And from here, we could say, please show me the flow details like that.
And that's showing us all the flow details from the perspective of this VM.
So here's our web traffic internally.
There is our DHCP traffic.
Here's traffic to the other web server.
And we also have traffic going out to public IPs.
So if we expand that, there's a DNS request going out to 8888.
And if we collapse that and open up the next one and expand that, this is
traffic going
out to a whole bunch of different IP addresses. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
out to a whole bunch of different IP addresses.
So there's the list.
And if we click here on services, it'll give us better insight as to what was
being sent.
All right, so let me go ahead and close that.
Now another way of looking at the detail would be to look at it based on groups
.
So up here on the top, we'll use the dropdown.
And if we say, we want to see it based on groups, we can then go ahead and
choose our
groups.
So we only have two groups that I created, web servers and clients.
We can select one or both of them, click on apply, and that's going to change
the way
it's reflected here.
So now we can focus on our group membership.
So we right click here on the web servers group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we right click here on the web servers group.
And then we go to members, it'll show us who the members are.
There's our two web servers.
And if we go down here to our clients and right click there and click on
members, it'll show
us who the members are there.
So we've got traffic is showing between the clients and the web servers as
shown by this
red line right here.
And because it's red, it means it's unprotected, meaning there's no firewall
rules either permitting
or denying that traffic.
And between our clients and the internet, if we hover here, we have eight
unprotected
flows for traffic that's going out.
And we could right click there and click on flow details to see what those are. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we could right click there and click on flow details to see what those are.
So there's some DNS.
There's some HTTP.
There's some NTP.
There's more DNS.
There's some HTTPS and there's some unknown.
What does that so expand that and take a look and for the unknown, it's UDP
port 443.
So that would be quick, which oftentimes is used by Google and YouTube services
for faster
delivery of their content.
So here for the application, if we expand this, it's showing us it's YouTube
and SSL and quick.
There it is right there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There it is right there.
Fantastic.
So for the destinations over here, if we click here on the destination, here
are the
list of IP addresses that we were reaching out to.
And when I say we're here, I'm talking about this mint client on the 1066
network.
So we go ahead and close that.
And if we double click, for example, on one of these groups, again, it zooms in
on the
detail there.
And then here we have our web server at 10550122, just by hovering over it, it
gives the details
regarding the name of that web server, as well as the allowed or blocked or
unprotected WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
unprotected
flows.
And if we go to the other web server right here, again, a similar result.
And then to go back, you simply click on back right here.
So the fact that we have all red blows means that we don't have any security
policies in
place, any firewall rules that are explicitly permitting that traffic.
And ideally, if traffic is going to flow over our network, we want to have
explicit rules
that say this traffic should be allowed, for example, from clients going to the
web server
or from web servers out to the internet or between various application servers
in our
environment that need to communicate with each other, for example, like front WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
environment that need to communicate with each other, for example, like front
end servers
and database servers and so forth.
So to solve the problem of us not having any rules in place here, we can have
NSX intelligence
help us with that as far as recommendations.
And that my friend is exactly what you and I get to do in the next video.
So I'll see you there in just a moment.
[BLANK_AUDIO]