And as a quick reminder of all the many wonderful things that the NAP can bring
to the table
to include NSX intelligence, which we've looked at in a previous skill, the
ability to do
network detection and response, which can give us a big picture correlated view
of our
network activity and what's going on.
Metrics is also included in the list.
And what I want to focus on in this set of videos is NSX malware prevention.
And here's the overall process of implementing this feature of the malware
prevention.
Number one is we need to have the NSX application platform deployed. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Number one is we need to have the NSX application platform deployed.
So we did that a couple of skills ago.
And then secondly, we need to activate the feature of the NSX malware
prevention, very
much like how we enable the feature of NSX intelligence.
We go down under the NSX application platform and we click on the tile to
activate that feature.
It does some pre checks and away we go.
So that's step number one, step number two.
And then once we've been able to feature, we then want to go in and enable it
on our
gateways, specifically the gateways where we want to implement the malware WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
gateways, specifically the gateways where we want to implement the malware
prevention.
So that'd be step number three.
And then once it's enabled, we then go ahead to step number four and create a
profile.
And in that profile, it's going to specify what it is we're willing to accept
or not
accept or look for as part of the malware.
So we create a profile and the fifth step is to take that profile and include
it in
a rule as part of a anti-malware policy.
That's then applied to the firewall and away we go.
So between now and the previous skill when we looked at NSX intelligence, I
removed the
existing NSX topology and I redeployed the edge notes because I needed the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
existing NSX topology and I redeployed the edge notes because I needed the
extra large
edge notes to be able to support the anti-malware or malware prevention
features at the gateways.
So just to share with you what I currently have, let me give you a peek at the
topology.
If we go down to network topology and take a look, I currently have a tier zero
gateway
that we zoom in a little bit so that tier zero gateway is connected to an
external router
with two edge interfaces, and I'm also supporting DHCP and that here as well WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with two edge interfaces, and I'm also supporting DHCP and that here as well
for the ability
for customers to get up to the real internet.
Then if we scroll down, I have a tier one gateway and here the tier one gateway
I have
two services.
I've got a gateway firewall rules.
The default ones are in place and DHCP services.
As we scroll down, I have two segments 1055 and 1066 and I've got some VMs that
are connected
to each of those including a Linux Mint machine and also an intentionally
vulnerable Metasplatable
system should we need it.
So those are all on the 1066 network and then over here on the 1055 network, I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So those are all on the 1066 network and then over here on the 1055 network, I
've got a
Kali Linux box that we can use for attacks.
I've got a little web server and I also have a little Linux Mint computer right
here as
well all on the 1055 network.
And if we click here on the system tab and on the left, if we click on the NSX
application
platform, currently the platform shows as stable.
That's a good sign.
And if we scroll down to the feature section, I have the metrics which is
enabled and I
have NSX intelligence which we could enable.
I have the NSX network detection and response which can be used for correlation WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I have the NSX network detection and response which can be used for correlation
and visualization
of our network traffic and events.
And then we have this tile right here for the NSX malware prevention.
So because this process takes about 10 to 15 minutes to enable, let me go ahead
and click
on activate.
I'm going to go ahead and choose the region of the United States and then we'll
go ahead
and click right here to run the Pre-checks.
So for the Pre-checks it's validating.
I have a license.
It's also going to validate that it can reach the cloud services.
It's also going to verify that the license I have entitles me to use those
services. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
services.
So I'm using for all of these labs.
The licensing I'm using are the ones I got through V-MUG Advantage which
includes a one-year
e-val license for many of the products from VMware including NSX, Tanzu and
more.
So in the United States that runs for about 200 bucks a year for the V-MUG
Advantage membership
and those are the licenses that I'm currently using.
So the Pre-checks all pass, that's great news and so we'll go ahead and click
on activate.
And again this process right here will take about 10 minutes to go ahead and
activate. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
activate.
And that is not the only activation we need to do.
We also need to go into the gateways where we want to use the anti-malware and
actually
enable those gateways so they can use those policies.
And then once we've told the gateways that we want them to be able to use those
policies,
we then need to create the profiles and the actual policies themselves and
associate them
with the gateways.
So we'll continue this process of enabling the function of the anti-malware in
the very
next video.
So I'll see you there in just a moment.