Now, when it comes to suspicious or possibly malicious traffic on our networks,
there's
only two types of networks.
Networks that have had that type of traffic or networks that will have that
type of traffic.
And when it comes to malicious and/or suspicious traffic, we absolutely, if we
have the ability,
we want to know about it that it's happening.
And that is one of the features that NSX Intelligence brings to the table.
Now to facilitate the detection of suspicious traffic, we first of all need to
enable that
feature.
In the way that we've enabled the NSX Intelligence, we did that by going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In the way that we've enabled the NSX Intelligence, we did that by going to
System, then going
to the NSX Application Platform over here on the left, and then here in the
main pane
for the NSX Application Platform, we scroll down and we enabled NSX
Intelligence.
So even though we've done that, we also need to enable the specific detectors
if we're
going to use the detection of suspicious traffic.
So to do that additional step, we're going to go back here to Security.
And with Security selected, we're going to go down to Suspicious Traffic right
here
under Threat Event Monitoring. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
under Threat Event Monitoring.
So we'll click here on Suspicious Traffic.
So here with Suspicious Traffic selected, it gives us under the Events tab
right here,
an overview regarding the last by default hour.
We could also change that regarding suspicious activity.
But by default, nothing is going to show up here because the detectors are not
enabled
by default.
So one might ask, well, why are these all disabled by default?
The one I want to turn them all on.
Well, if we have them all on, it's going to take additional resources, CPU and
so forth,
to make it happen.
So you can enable them, but they're off by default. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So you can enable them, but they're off by default.
So let's take a look at a few of these as an example.
Here's the Horizontal Port Scan.
Or an intruder tries to scan one or more ports or services across multiple
systems.
They're trying to do a, for example, a sweep of hosts and ports.
So it's not enabled by default.
So we can click here on the pencil and say, you know what?
I want to enable it.
And then we can specify how tolerant we want it to be.
So I'm going to go ahead and for the demo, I'm going to set it all the way to a
one,
which is more likely to some false positives.
But for the demo, I'll be sure to capture any scans that I'm doing.
So then I'll go ahead and save it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So then I'll go ahead and save it.
And we also have an option of setting up a filter.
We go back to edit here.
We can also exclude certain devices, so we can exclude a group or specific BMs
so that
it won't pick up traffic based on it coming from those devices.
So I'm going to leave the Horizontal Port Scan enabled.
And let's grab one more.
Let's go down to a vertical port scan.
That's where somebody's doing a scan of an individual host.
We'll click on the pencil to edit that.
And let's go ahead and enable it.
And I'm also going to sensitivity that to way, way low.
And the number there is the confidence level.
So the higher you set it, if this fires off as a match, it's going to be more WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the higher you set it, if this fires off as a match, it's going to be more
likely that
that event is really happening versus if we put it all the way down here, which
I'm going
to do in my demo and we'll click on save.
So at this point, I've just enabled two of these suspicious traffic detectors,
one looking
for a network scan and the other looking for a specific host scan.
Although we could enable it on more, but those are the two that I can use to go
ahead
and do a demo.
So now with those two detectors enabled, if we go to events, if any of those
detectors WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
detectors
identify suspicious traffic, which would involve a host scan or a network scan,
those
results, if it happens in the last hour should be right here, we could also
specify the time
period we want to go ahead and show results for.
So let's go ahead and demonstrate those detectors in action.
So let me go ahead and bring in a client.
So here is one of our Linux Mint computers on the 1055 network.
And let me go ahead and close the browser.
Let me also go ahead and stop our little script that was doing the curls over
to our
web servers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
web servers.
And let's run an end map.
So currently I'm on the 1055 network.
We'll do an IF config to confirm that and sure enough, 1055 0151.
And let's do an end map.
And let's go ahead and do a scan of our local network.
And the dash P dash says I want to scan for all possible ports up to like 65,
000 per host.
And then I'm going to target that at my local network, which is 10.55.0.0 with
a 24 bit
mask will press enter.
So that's now in motions, we can press enter and get status reports. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that's now in motions, we can press enter and get status reports.
So this has like a minute and 39 seconds remaining.
And I'll continue to press enter.
So I found two hosts and now is doing a port scan on those two hosted that
found responsive
and it's testing like 65,000 possible ports to see which ports are open.
So in a moment here, it'll show us what's open.
So we've got port 22 open on one host on this local network.
I've got port 68, which is for a DHCP client.
And I've also got port 80, which is HTTP.
Now if we did that same thing again, but for the other network, let's go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now if we did that same thing again, but for the other network, let's go ahead
and target
the 66 network.
So that's just being routed over from the local 1055 segment over to the 1066
network
at which point is doing a ping sweep.
And then it's going into each of the individual hosts doing an extensive port
scan for those
hosts that have found up and responsive with the ping sweep.
So if we press enter, it'll give a status about what's going on.
So still doing the ping sweep almost done with that.
And then when that's done, it'll start doing the actual host scans.
So the purpose here was just to generate some scans.
Also, if we wanted to target a specific host, we could go ahead and do that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also, if we wanted to target a specific host, we could go ahead and do that
same command,
except target 1066, 0.151 over there.
We'll press enter and that's going to do a specific host scan to that target
and we'll
press enter to get status.
It's about halfway done.
Now, the whole purpose of that was to generate some traffic that we could see
in these suspicious
traffic outputs.
So for the detector definitions, it's very likely that we've triggered this one
right
here, the horizontal port scan.
So let's check it out.
So if the security tab selected on the left, suspicious traffic selected, let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if the security tab selected on the left, suspicious traffic selected, let's
click on
the tab right here under suspicious traffic called events.
And let's see what it's showing us.
So for the last hour, we'll click on refresh.
I'm not seeing anything quite yet.
Again, it may take just a moment for that to show up.
Now, what I can show you while we're waiting for that last attack to show up
with that
last suspicious traffic, we could go ahead and take a look at the last 24 hours
because
I also did a few tests about an hour and a half ago and that's showing up right
here.
So about 9 a.m.
Local time, it identified these attacks. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Local time, it identified these attacks.
So two horizontal port scans.
So we expand those here, it's showing us the source and the target and the
targeted ports
and the two targeted VMs.
So against this machine at .151, which is one of our web servers, it was
targeted port 38,386
using TCP at layer four and 5,446 more.
And then for the mint computer on the 1066 network for that VM, the targeted
port was WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
port was
TCP port 63,379 and 4,947 more.
So I'll go ahead and close that.
And if we hover, it's going to show us the severity and also the confidence
level regarding
that being an accurate match.
And I also do the attack again, but this time I did it from the 1066 mint VM
going over
to the 1055 network.
So here's the details for that one.
And then each of these are hyperlinks to give us more details on the ports
involved and
the VMs involved and also a little visual representation here about the source WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the VMs involved and also a little visual representation here about the source
and the
targets.
Also in this suspicious traffic report here, if we click on this link for view
affected
VMs and their current traffic right here on the bottom right, that takes us
back to the
plan and troubleshoot, discover and take action so we can see exactly what's
going on.
And as a result of the scans I just did, there's a whole bunch of traffic and I
don't
know if you can notice, but it is all red, meaning unprotected.
So we didn't have rules in place that either permitted or denied that traffic,
but indeed
those ping scans were allowed. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
those ping scans were allowed.
And if we look at the very center of this whole thing, it'd be the mint
computer that
I just launched it from right here.
So we right click and then click on flow details.
Here it has page one of 257 for a total whopping over 12,000 flows that it is
aware of.
And we can do it each one of these and take a look.
And so as part of the default rules permitting anything to anywhere is showing
us why that
traffic is being allowed.
So to prevent this type of traffic, we could go in and set up our rules
ourselves on our
street of firewalls or we could ask NSX intelligence to help us with some WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
street of firewalls or we could ask NSX intelligence to help us with some
recommendations.
So I'll close that.
Then we have one green line here as well, which indicates a protective flow.
So we could right click on that and then look at the details for that
protective flow.
However, most of this traffic is bad news because it was just scanned.
So let's go back to the security tab here and on the left under suspicious
traffic.
And let's take a look at the last hour and there is our attack that we launched
right
there and there is our suspicious traffic right there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there and there is our suspicious traffic right there.
So if we go to the last 12 hours, that's the previous ones that I generated and
this represents
the scanning that we did just a moment ago.
So if we click on the last one hour, that'll be the only one that shows up.
And then we can go ahead and expand it to see more details about what was going
on.
So we have one source here.
That's our little mint VM and the targets were the web server 10660151.
Also the mint Linux machine over at 1066 caught a little bit of that as part of
our scanning WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
our scanning
and also the web server at 10550152.
So there were thousands of targeted ports on these three VMs and there they are
right
there.
So we'll click on close and they'll go ahead and collapse that.
So in this set of videos, we've taken a look at one of the features as part of
the NSX application
platform and that is the NSX intelligence which that component alone brings
three major things
to the table.
Number one, it gives us a visualization of our traffic close.
Number two, recommendations on improving our firewall policies to permit the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Number two, recommendations on improving our firewall policies to permit the
traffic that
we want to allow.
And then third, by enabling detectors to be able to identify suspicious traffic
on our
networks.
[ Pause ]