And welcome back.
So for the NSX application platform, it is currently up and running.
The feature for NSX malware prevention is enabled on the security tab on the
left with
IDS/IPSM malware prevention selected.
If you go to settings, we have enabled the ability for our gateway to use
malware prevention.
And then furthermore, we went to our gateway rules.
We created a policy with one rule looking for malware with detect only.
And that's being applied to our tier one gateway.
So now to test this, let's go ahead and go to a VM that has access to the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now to test this, let's go ahead and go to a VM that has access to the
Internet.
So if we go to our topology view for the network down here off segment 1055, I
've got
three VMs and let's go ahead and let's use this one right here mint on 105500.
And just to confirm that VM's traffic is going to go through this tier one
gateway as it
goes out to the Internet.
So let's go to the remote console for that VM.
So here is that VM and let's verify its IP address with an IF config. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here is that VM and let's verify its IP address with an IF config.
And that's at 105500.151.
We'll do a route to take a look at a steeple gateway 105501, which is the
logical interface
on our tier one gateway.
And just verify we go all the way up to the Internet will do a ping to www.vm
ware.com.
And that is looking good name resolution works, Internet access work, we're in
good shape.
So let's go ahead and test our malware policy.
Now, I really don't want to bring live malware down to this little VM, even
though it'd be
pretty easy to recreate it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
pretty easy to recreate it.
If we have malware that's bad enough, it could start spreading and that would
not be good.
So let's use a test file to test the malware.
So we'll open up a browser and one of the very popular test files out there is
from
I car.
So we could go directly to the source to icar.org using a test file like that.
That's not malicious, but it should trigger is a great way of doing testing
because that
way we're not accidentally bringing in malware just because we're testing our
security appliances.
Also, there's something super important that I just realized that we should WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also, there's something super important that I just realized that we should
chat about.
And that is encryption.
Now encryption is a fantastic option to protect data to make sure that
unauthorized individuals
can't see what's going on.
So if we have a client computer down here, for example, that is going out to
the Internet
to a server on the Internet, we're very likely going to be using HTTPS with TLS
, transport
layer security.
In the old days that was referred to as SSL.
That was the original technology for that.
But at the end of the day, we have an encrypted session leveraging HTTPS so WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But at the end of the day, we have an encrypted session leveraging HTTPS so
that if an eavesdropper
is looking at that traffic, it won't be able to tell what's really going on at
the payload
because that payload is all encrypted, including if we download a test file via
HTTPS.
And that's because the device who's sitting here in the middle, which is our NS
X environment,
it doesn't have the keys to unlock that data that's being encrypted and den
encrypted by
the server at this end and the client over here.
So let me share with you the option that many companies implement to get around
that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that.
What they're going to do is to use something called a TLS proxy.
And this feature is implemented by anybody who really wants to see that data.
And the way it works is the client, as it goes out, they're actually being prox
ied at
this device, which is normally a firewall, but in this case, it also could be
our NSX environment.
So there's actually two HTTPS sessions.
There's a session here from the client to this proxy.
And then there's a session from that device out to the server.
And here in the mind of that device, just for a moment, is that data un
encrypted. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
encrypted.
And the reason I pointed out right now is that if we went out and we downloaded
a virus
and we were using HTTPS and NSX because we haven't yet implemented TLS
inspection and
TLS proxy and NSX would not be able to decode the content of that file.
And as a result, it wouldn't be able to identify that it was malware.
Another gotcha is that if we have a zip file and a zip file has a password and
because
the device in the middle, even if it's enabled for TLS proxy and decryption, if
it doesn't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it doesn't
have the password for the zip file, it then can't actually take a look at the
real contents.
Because once again, that device in the middle doesn't have full access to see
what really
is in the payload.
So for this demonstration to bypass all that and just to test the anti malware
capabilities,
I'm going to go ahead and download the I-Car test file using HTTP instead of
HTTPS.
And that way we can do a fair test to verify whether or not the NSX can
actually detect
the malware.
And in a production environment, we want to enable the full TLS inspection and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in a production environment, we want to enable the full TLS inspection and
proxy,
which involves setting up certificates that our clients trust.
And that way, after that's in place, then the NSX environment can do its own
decryption
of the content, then run its own policy for the malware prevention to identify
malicious
traffic.
All right, so let me go ahead and clean that up.
That looks better.
And let's go ahead and grab a copy of that file, which is not encrypted.
So let's go out to Kapursky.
So they've got a copy.
I know because I tested it a little bit earlier today, they've got a copy of
that file with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that file with
HTTP only.
And I think if we go to the I-Car, the official site, they've just got
encrypted HTTPS versions
of it.
So let me scroll down here.
And here is a link right there, the icar.zip archive via HTTP.
So we'll click on that.
And okay, so I have a warning here.
Now this is my browser warning me about that.
So I'll go ahead and say, please allow the download.
And because the policy on NSX is just to detect that download should work just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And because the policy on NSX is just to detect that download should work just
fine.
But again, the goal of doing that download of that test file was to verify
whether or
not the policy that we have in place is currently working.
So once again, that policy is under security under policy management, IDS/IPS
and malware
prevention, gateway rules, and there's our policy right there.
So here is a little stats window over on the right, right there.
And so sometimes there's a little lag between like five and 10 minutes before
hits will
show up.
So let me go ahead and click on the stats window.
And sure enough, hits count too. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And sure enough, hits count too.
And here's the little reminder in blue saying that the statistics may be stale
as the aggregated
states are computed every 15 minutes.
So now that our malware prevention policy has identified that malware was
attempting
to come into our network or because of the detect only it did come into our
network,
we can monitor that and see the details of that by once again clicking here on
security
and the security tab on the left under threat event monitoring, we'll click
right here on
malware prevention.
And currently it's showing us for the last hour and then we can set the last 12 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And currently it's showing us for the last hour and then we can set the last 12
hours
or 24 hours, et cetera, et cetera.
So I'm going to have it show us just for the last hour and there is our event
right there.
So if we hover over that in the pop up, it's showing the file hash associated
with that
malicious content.
And if we go down here below and scroll down and expand this event and let me
collapse the
left hand side gives a little bit more room here showing the verdict.
So malicious files are going to have a verdict between 70 and 100 suspicious
will be between
30 and 69.
And in the event that there's a file that NSX isn't sure about, it can send WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in the event that there's a file that NSX isn't sure about, it can send
that up to
the cloud for near real time analysis.
So here's the malware family, the malware class last inspected.
There's the shock to do six file hash.
And as we continue to scroll down, there's the server where we downloaded it
from that
came down to our client at 1055 0151 and also has details about the file type
and the details
for that file and the protocol and total inspection.
So if we click here on the four, it's showing me the number of times I tried to
download
that file.
So these are the two that I did during the initial demo. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So these are the two that I did during the initial demo.
And then when I went back to get a little more hit counts, I tried two more
times right
here.
So we'll go ahead and click on close for that.
And for some malware, there will also be a separate link for a reports option
for more
details about that malicious software.