In the previous video, we took a look at how NSX Intelligence could give us
visibility into the traffic flows on our network.
And in this video, you and I are going to have NSX Intelligence help us one
more time,
this time, by making recommendations about what we should have in place
regarding firewall rules.
And I'm curious about this unknown group right here.
Let me go ahead and right click and take a look at IP addresses involved.
OIC, so 10.1.2.3 is my logical D-HEP services instead of NSX.
224 is a multicast address, and then I've got a link local address as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
224 is a multicast address, and then I've got a link local address as well.
All good.
So we'll click on close there.
And let's imagine that we want to control the traffic between our web servers
and our clients.
What we can do is right click on that link there that represents the flow and
go to flow details just to confirm what they are.
Fantastic.
So this is the tab for completed flows.
There's also a tab here for active flows may close that.
So for the recommendations, let's right click here on our clients group.
And I have some recommendations that I ran earlier, but let's go ahead and
start some new ones by right here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
start some new ones by right here,
clicking on start recommendation from the dropdown.
So I right clicked on this clients group and then from the menu system here
under action,
I'm going to click right here on start recommendation.
So I'm going to name this recommendation name client group recommendation for
demo.
And this warning is to get take a few minutes to complete the lab environment
isn't that big.
So it shouldn't take that long.
And then if we scroll down, we have the option for actually specifying the
scope.
And you know what? Let's do this. Let's modify the name here and let's go ahead
and call this demo for clients and web servers group.
And then for the actual entities in the scope, I'm going to go ahead and click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then for the actual entities in the scope, I'm going to go ahead and click
on this hyperlink right here.
Currently, I have one group because that's where I started and I want to go
ahead and simply add a second group.
So instead of just the clients, let me go ahead and do web servers.
So for the recommendations it's going to make, it's going to include the
clients group and its members there and the web servers.
So then we'll click on save.
So now it says two groups. And if we scroll down, here's the time range for the
last hour, last 12 hours, etc.
I'm going to choose the last hour. And then just for grants, let me expand
advanced options as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
advanced options as well.
And then under advanced options, we have some additional nerd knobs that we can
dial in.
So we can go ahead and specify the traffic to analyze.
Again, we have several options here. The ports and protocols to exclude.
So by default, it's excluding the flows for multicast and broadcast.
So if we wanted to include those, we can simply remove those as exclusions.
And sometimes you may have a management system or a pen testing system out
there that's authorized.
You might want to exclude certain ports or protocols from the recommendations
it's about to make.
And then as we continue to scroll down, there's additional options regarding WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then as we continue to scroll down, there's additional options regarding
the rule recommendations and what the results are going to be.
So as we continue to scroll down here, one of the options also is
recommendation service type.
So L4 services simply means recommendations based on layer three IP addresses
and layer four protocols and ports,
where if we said context profiles, it's actually looking at the application
layer and making recommendations for our rules based on application layer
information,
such as is this really SSH or is this really SSL slash TLS versus is it just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
such as is this really SSH or is this really SSL slash TLS versus is it just
using TCP port 443 or for SSH TCP port 22.
So for the demo, I'm going to go ahead and leave all the advanced settings at
their defaults.
And what we're really just looking at is a recommendation for firewall policy
rules regarding traffic concerning these two groups.
So we'll click right here on start discovery.
So now it's letting us know that the recommendations discovery has started and
that if we want to check on its status,
we can go to the recommendations tab.
So I'm going to click on dismiss here and that recommendations tab.
If we didn't click on the hyperlink of that message, it is under plan and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we didn't click on the hyperlink of that message, it is under plan and
troubleshoot and on the left under discover and plan.
It is right below discover and take action.
So here is the recommendations section right here.
So let's go ahead and click on recommendations.
And here are a couple that I ran earlier.
I did a test a little while ago and then I did yet another recommendation and I
didn't apply it.
And this is the entry right here that we just ran a moment ago.
So here's the details for that recommendation that is currently processing over
here.
It has our two groups.
If we click on that, it'll confirm for us what those groups are clients and web WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we click on that, it'll confirm for us what those groups are clients and web
servers.
Great, great, great, and currently it shows us status of waiting.
Let's click on refresh and in a moment or two or three that will change from
waiting and it will show us that it's now processing.
And then after processing, you'll eventually get to ready to publish where we
can go ahead and review its recommendations and then decide to either edit and
or push out those firewall rules.
So let me click on refresh and sure enough discovery and progress.
Okay, that looks good.
And again, that may take anywhere between five and 30 minutes depending on your WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And again, that may take anywhere between five and 30 minutes depending on your
topology.
So we'll go ahead and give that a few minutes to complete right now.
Actually, while it does, here are a couple of previous recommendations.
And so as a sneak peek of what's about to happen, if we click on the three dots
here, we have some options, including delete it, meaning I don't want this.
Let's go ahead and not do it or let's go ahead and review the recommendations
and then push them out or review the recommendations and then have it rerun the
discovery.
There's also options for exporting it as well.
So while we're waiting for the one we just ran to finish, let's go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So while we're waiting for the one we just ran to finish, let's go ahead and
click on three dots here and click on review and publish.
So we can also expand and shrink this as well.
So the green lines represent in its recommendations, the fact that we're going
to be controlling the traffic and agreeing represents that we're permitting it.
So we're going to the recommendations here.
Let me give us a little bit more room by bringing that up here.
The recommendations it has for us so we can rename the policies and the
individual rules and modify them as we desire.
And then once we're done, we could go ahead and push them out.
So this is on a little example I did earlier. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is on a little example I did earlier.
Let me go ahead and click on cancel and let's take a look at our status for the
one we just ran.
So let me go ahead and refresh this.
And again, that may take a few minutes to complete.
So we'll come back to this point right here once the discovery is completed.
All right, and it is done ready to publish.
So let's take a look at the results.
So we'll click on the three dots and we'll click right here on review and
publish.
So here in the recommended policy, it involves four rules.
So here's our policy.
We could actually rename this right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We could actually rename this right here.
Let me go ahead and do that.
So I'll call this from recommendation press enter there.
And then for this first rule, I just call this rule one.
So for the first rule, here's the source and destination.
There's a services, AKA the ports and protocols involved and the action is
allow.
And if we go down to rule two, let me go ahead and rename that so it's a little
bit easier to read.
And in a production environment, we want to go ahead and name these rules
something meaningful.
So when we see them, we'll know what they do.
So for the source, we have our groups going anywhere looks like DNS.
Again, we can click on the pencil and go in and edit that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Again, we can click on the pencil and go in and edit that.
And this rule is going to be applied to those two groups and that's allowing
that traffic.
And then we have rule three, which also be called rule three.
And that's from the clients group going to anywhere.
If those services are HTTP, NTP or HTTPS and that's being applied to the groups
and if we scroll down,
here's rule four, I'll call that rule four.
And then for rule four, we have the source and destination again, you can go in
, verify what those details are.
And then edit as needed.
Or if you don't want to rule, for example, you just go ahead and say, you know
what, click on that one
and delete that rule and not include it at all. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and delete that rule and not include it at all.
So let's assume that we want to take all those as they are with the only change
we made was renaming the rules
and we'll click right here on proceed.
So here it's recommending that we put this new policy that's coming from the
recommendation above our existing rules
because we have existing rules that are denying certain types of traffic.
We want to make sure any permits here are going to be placed above.
So we can reorder and we sequences if we want.
We'll go ahead and take them as they are and click on publish.
It's asking us if for sure we'll go ahead and click on yes.
And it gives us a message that it's done is now pushed out those firewall rules WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it gives us a message that it's done is now pushed out those firewall rules
and we can see them under the security tab.
So we'll go ahead and click on dismiss here.
So next if we go to the security tab right here and on the left under policy
management, let's go down to the distributed firewall.
And here in the distributed firewall, you'll notice we have our policy and
there's the four rules.
So in the background, I still have our traffic flows being generated from our
two mint Linux clients.
Some traffic is going out to the internet still and some traffic is going
between our web servers.
So back here at Discover and Take Action, I also want to just give you a heads WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So back here at Discover and Take Action, I also want to just give you a heads
up that I spent about 15 minutes
continuing to generate traffic before I brought this graphic up.
So if we go here to groups and we go to compute and we choose our mint
computers and also our web servers,
it's going to be one way of looking at that traffic flow will click and apply.
So notice here the traffic from the mint computer going over to the web server
at 1066 and also to the web server here at 1055.
That traffic flow shows up as green, which if we hover over indicates that it's
allowed traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also from those two mint computers is to go out to the internet.
That traffic is being allowed as well based on the rules from the
recommendation that we applied.
And if we right click on that flow and then from the drop down choose flow
details.
It would give us details on what those flows are. So there's UDP traffic. There
's some HTTP and HTTPS.
And we can expand any of those sections to see more about that detail.
So close that. Another way of looking that would be based on the groups.
Now as part of the recommendations, it also made some new groups.
So if we go back to inventory here and we go to groups, here's the two groups WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we go back to inventory here and we go to groups, here's the two groups
that we created clients and web servers.
And as part of the implementation of the recommendations, it created these
groups for us, the group one and group two.
And it use those groups as part of the rules. So if we go back to plan and
troubleshoot and then left to discover and take action,
we could go ahead and sort based on those groups as well. So from the drop down
, we can say groups and then we could go ahead and choose those two groups.
So I'll select both of those, click on apply. So this is right here between the
clients group and we can right click on that just to verify the members there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
clients group and we can right click on that just to verify the members there.
So that should be still the two mint VMs. That's great. And then here on this
group right here, we'll right click and click on members.
Who the heck is that? Oh, that's our DNS server inside of NSX at 10.1.2.3.
And just to confirm that let's go to networking and on the left, go down to
networking profiles and DHCP.
And sure enough, 10.1.2.3 is the IP address I'm using for my DHCP services.
Again, we get a visualization regarding what's being allowed, meaning
explicitly permitted as part of a firewall rule or what's being blocked. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
explicitly permitted as part of a firewall rule or what's being blocked.
Or currently, is this floor right here showing we have one that is currently
still unprotected.
So in this flow, it has one that's allowed and the one that's unprotected is
our traffic going to the DHCP services.
And then once again, we could leverage NSX to create recommendations for us and
help us modify our firewall policies.
So back in groups, if I wanted to just take a look at my clients and web
servers groups, the ones I created and click on apply, once again, it can
reflect that traffic and those flows.
And if we go up and select computes, then we just choose the VMs that we're
concerned about.
We'll go ahead and use mint and mint and web and web. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll go ahead and use mint and mint and web and web.
Again, let's just confirm the traffic flows there.
So it looks like this right here, if I right click on it and click on flow
details.
So based on the flow information here, we have some traffic that is being
explicitly permitted.
That's this part right here.
And then we have other traffic flows here in the red representing that traffic
is not being permitted or denied explicitly by a firewall rule.
So if we wanted to go in and either have NSX intelligence, make additional
recommendations or go in manually and modify our firewall policies, we could.
So we'll close that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll close that.
And again, all these green lines that show up here now are due to the policy
changes that we implemented based on the recommendations from NSX intelligence.
And for all of the red dotted lines here, that represents at least one
unprotected flow.
So for example, this right here between our mint computer, which is the mint on
1055 and going up here to this web server on 1066.
We have two flows that are allowed and one that's unprotected.
And if we right click, it can show us the details on what's not being protected
.
And if click on the services here, it can show us what's being unprotected. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if click on the services here, it can show us what's being unprotected.
So it's the HGP services, which are not being blocked, but they simply are not
being permitted or denied explicitly as part of a firewall rule.
So we go ahead and close that.
So up to this point, we've used NSX intelligence for three basic things.
Number one, to go ahead and get a visualization regarding our traffic flows in
our environment.
And then secondly, we had to make recommendations for us regarding firewall
rules.
And then third, we actually published and pushed out those rules as part of a
distributed firewall.
And there is one additional really cool feature that NSX intelligence brings to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And there is one additional really cool feature that NSX intelligence brings to
the table.
And that is the ability to detect suspicious traffic on our networks.
And you and I get to take a look at that feature next.
So I'll see you in the next video for exactly that.
exactly that.