So back at the NSX manager, if we go to the system tab,
I just want to verify by clicking on the left here
on the NSX application platform.
I just want to verify that the malware prevention
is fully activated.
So if we scroll down the features,
it shows activation was successful
and that is currently fantastic.
So if we click right here, go to NSX malware prevention,
that's going to take us to the security tab,
which is right here.
And then under the threat event monitoring,
it'll take us to the malware prevention.
Now currently it's not showing us any events
because we don't have malware prevention included WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because we don't have malware prevention included
as part of any of our firewall policies.
So to fix that, what we're going to do is we're going to down
under policy management to the IDS/IPS
and malware prevention section once again.
And then here in the main pane,
we're going to click on profiles.
So there are profiles for IDS/IPS
and there are profiles for malware prevention.
So we've done the IDS/IPS previously.
So we'll click here under profiles.
We'll click on the sub tab for malware prevention.
Here is the default.
And what we're going to do is we're going to go ahead WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And what we're going to do is we're going to go ahead
and create our own.
So to create a profile, we'll click right here on add profile.
Let's call this our malware profile.
And then for the submission criteria,
we can specify the type of files that we want to check for
regarding malware.
And then we have a checkbox here that allows us,
if it's checked to send the files to VMware's NSX ATP,
that's the advanced threat protection services in the cloud.
So I'm going to leave checks in all those checkboxes
and we'll click on save.
So now we have a malware profile called our malware profile.
We'll click on refresh there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll click on refresh there.
That looks great.
Now the second thing we want to do to make sure we can use this
is we want to include it as part of a policy rule.
So to do that, we're going to go to our gateway rules.
So once again, we're on the security tab here
and over here on the left, we're under IPS/IDS and malware prevention.
Then we're going to click right here on gateway rules
and then we're going to go to gateway specific rules.
So right now it's warning me that IDS/IPS is deactivated
for this tier one gateway.
And that's okay because we're not going to use IDS/IPS.
We're just going to focus here on anti-malware. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're just going to focus here on anti-malware.
So I'll close that message and then we'll create a new policy.
So we'll click right here on add policy.
And then we collapse the left hand side,
it gives a little bit more room.
And let's go ahead and call this our anti-policy.
So there's the name of our policy.
It's also warning us that, hey, unless you add at least one rule
to this policy, it's not doing a whole lot.
So we'll go ahead and click on the three dots
and we'll add a rule by clicking on add rule.
And we'll call this rule no malware.
And so for the source and destination,
we'll leave that as any and the service as any. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'll leave that as any and the service as any.
And then for the security profile,
we'll click on the pencil right here.
And then we'll click on the tab here
for malware prevention profile.
And then we'll select our malware prevention profile
that we just made.
So with that selected, we'll then apply it.
So this rule, as part of our policy,
which is applied to our tier one gateway,
is going to be looking for malware.
And here in the applied two column,
it's showing that it's going to be applied
just to the tier one gateway.
And then for the mode, we have two options,
detect only or detect and prevent.
So initially, if you're just setting a new environment up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So initially, if you're just setting a new environment up
and you don't want to accidentally have false positives
or maybe drop some traffic that shouldn't be dropped,
you can do detect only, then take a look at the results
and then move it over after time, over to detect and prevent
once you're sure you're not going to have false positives.
So I'm going to go ahead and click on publish
and that's going to push that out.
And we'll click on a refresh there
just to make sure it pushed out successfully.
Awesome.
So now if we went back to networking
and we went down to network topology
and we look at our tier one gateway,
it currently has DHCP services. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it currently has DHCP services.
It also has the gateway firewall rules
that include the rule looking for malware
and if it sees it, it should go ahead and create an alert.
Now we have a couple of options here.
Now that we've implemented our policy
for malware prevention and that is,
we could just hope it works or we could do some testing
to verify that it works.
And that's the option I'd like to do with you
in the next video.
Is to test and verify whether or not
our malware prevention policy correctly identifies malware.