So now that you have the opportunity to take a look at a few of the screenshots
regarding the customer's environment,
let's together validate, first of all, that the client can actually download
these test malware files.
And then secondly, we'll take a look at why that's still being allowed, even
though the customer believes they've implemented the policies to prevent that.
So let's start with our test VM. And so here is our little Mint Linux VM here
in the vSphere clients.
We'll right click and from the menu, we'll click on open remote console. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll right click and from the menu, we'll click on open remote console.
So here is the remote console for that little VM. Let's just do a couple of
quick verification checks.
So at the command line, let's just verify that we can get out to the internet.
We'll do a ping out to www.vmware.com.
So we have internet access. Great. We have name resolution. That's great. So
let's open up a browser.
And from the browser, it'd make a lot of sense to go ahead and validate what
the customer tried to download as far as a test file.
And then we want to replicate that so we can see it. So it looked to me based
on the screenshots that they were downloading some sample malware files from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on the screenshots that they were downloading some sample malware files from
Palo Alto networks.
So we'll type in Palo Alto networks, and then we'll say sample malware files.
And then here is wildfire test a sample malware file. Fantastic. And then we'll
scroll down a little bit.
And here it's saying that we have some files we can use for testing. And that's
if we have our SL decryption in place.
And in an environment where you just want to verify the actual malware piece
without worrying about the SL decryption being in place, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's go down to this set of files right here, which are all via HTTP. So I'm
going to go ahead and click on this first one.
And then my browser is saying, hey, danger will Robinson. So I'm going to say
go ahead and continue because it's a test file.
So I'll allow that download. And let's do this one. Once again, the browser is
warning me. I'll go ahead and say, yep, we're going to do that too.
And then this one, and then we'll say yes to the browser for that one as well.
And this one as well. And again, yes to the browser warning.
So those were all browser warnings, but it wasn't the actual network or any of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So those were all browser warnings, but it wasn't the actual network or any of
the gateways. So now if we go to the downloads folder here on this local
computer,
and I'll make that a little bit bigger. Here we have the list of the files that
the customer tested earlier.
And here are the four additional ones that I just did right now. So we've
validated that these sample malware files are coming down and they're not being
stopped.
So the next thing to ask ourselves is what could be preventing that? Well, one
thing that could be preventing that is maybe the malware prevention feature as
part of the NSX application platform. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
part of the NSX application platform.
Maybe that's not enabled or activated. So let me minimize remote console. And
let's head over to the NSX manager.
So here at the NSX manager, we'll go to the system tab. And with system
selected on the left, we'll click right here on the NSX application platform
right there.
All right, so this looks pretty good. So the NSX application platform is in
place. And if we scroll down to features, NSX intelligence is not enabled.
But what is enabled is NSX malware prevention. And that's the one that we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But what is enabled is NSX malware prevention. And that's the one that we're
after right here. So that is enabled.
So what else could be the problem? Let's go take a look at the network topology
that the customer is working in. So we'll click here on the networking tab up
on top.
And on the left, we'll click right here on network topology. So if we expand
this and make it a little bit bigger, we've got a tier zero gateway connected
out to the external network.
And then we've got a gateway A and a gateway C. I don't see a gateway B, but
maybe there was one at one point. And if we scroll down off of gateway A, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
maybe there was one at one point. And if we scroll down off of gateway A, we
have a 1066 segment.
And here is a VM, which is a web server. And there's no VMs on segment 1055.
And over here, we have network segment 106783.
And we have one VM here. And that's the actual VM, the Mint Linux VM, where we
did the testing from that was able to go ahead and download the sample malware.
So just to validate that, if we brought that VM back in, here it is, Mint Linux
VM that is indeed the name of that VM. And we sure did download those sample WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VM that is indeed the name of that VM. And we sure did download those sample
malware files.
So if we look at the topology here, that should be blocked right here at the
tier one gateway C, which is in the path between this VM and the outside world.
So now that we know that the NSX application platform is in place, we also know
that the malware prevention has been enabled. Let's go ahead and click on the
security tab.
And then on the top left with security overview selected, let's click right
here on malware prevention. And that's saying, yep, zero across the board. No WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here on malware prevention. And that's saying, yep, zero across the board. No
files blocked, no malicious file events.
So sure enough, it didn't catch anything. So still here on the security tab on
the left, let's go down to under policy management. Let's go down to IDS/IPS
and malware prevention right here, just to verify that it's enabled.
So our concern here is malware prevention. Let's go ahead and click here on
settings, the sub tab of settings under IDS/IPS and malware prevention.
And let's see if we have the feature enabled. So we're going to scroll down and
keep going down to our gateways. And there's tier one gateway A, which we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
keep going down to our gateways. And there's tier one gateway A, which we have
the IDS/IPS and malware prevention enabled.
And then we have gateway C and it's not enabled. So let's go ahead and enable
that feature here on the tier one gateway C because that's the tier one gateway
in the path between our VM and the outside world.
So now that that is activated, let me go ahead and bounce off to another page.
Let's go to the overview and go back down here to IDS/IPS and malware WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go to the overview and go back down here to IDS/IPS and malware
prevention and go to settings once again, just to verify that it is now indeed
on.
So if that was the only problem, that should now be able to identify when
malware is trying to be downloaded, or at least it's one step closer to the
solution.
So let's go back to our client, which just a moment ago was able to download
the sample malware files from the Palo Alto site. And let's try again. So we'll
open up the browser.
And let's go ahead and let's pick on this one. And that is still coming down.
So that's the browser trying to say no. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that's the browser trying to say no.
And we really don't need to try the others because the gateway, our tier one
gateway, still allowed that to be downloaded. So let's go ahead and take a look
at our downloads folder.
And sure enough, there it is right there. All right. So that isn't the complete
solution, but this is one step in that direction. So the next thing that we
would probably want to verify is whether or not we have a policy and associated
rule in place on the tier one gateway C that says we want to look for malware,
because if we don't have a policy with an associated profile in place on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because if we don't have a policy with an associated profile in place on
gateway C, even though it's enabled, it still isn't going to function.
So to do that with the security tab still selected, let's click right here on
gateway firewall underneath policy management. And I've got some weird wrapping
over here and part of that's due to the font size that I'm currently using.
So I make my font size a little extra big. So it's easier to see in the
recordings. So now that we're here under security and under policy management
with gateway firewall selected, let's go ahead and let's click on settings.
And I've got the gateway firewall enabled for all three firewalls are tier zero WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I've got the gateway firewall enabled for all three firewalls are tier zero
tier one gateway and most importantly for our discussion here tier one gateway
C.
And if we go to gateway specific rules and we go to the gateway in question, so
we want to take a look at tier one gateway C. If we expand this, I'll have here
is default rules.
And then see the rules and policies for the IDS / IPS and malware prevention. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here if we expand this, wow, we have a policy is the policy is called
gateway IDS and malware. Then we have two rules. We have one for IDS and one
for malware.
And oh, I see the problem is it's being applied to gateway A and we don't have
any rules. Let me go ahead and take a look at gateway C.
We don't have any rules applied whatsoever for malware or IDS / IPS for gateway
C. And that would be yet another problem why the gateway C isn't identifying
any malware is because the features not enabled right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
any malware is because the features not enabled right here.
So let's go ahead and let's create a profile for malware. So we have one right
here called our malware, I'm going to make one more and then we collapse the
left hand column to give us a little more room.
And I'll call this malware profile for gateway C. And then I'm going to go
ahead and I want to match on all these different types for file categories.
Then we'll go ahead and save that. And now that we have that profile, let's go
ahead and include that as part of a gateway rule.
So we'll click on gateway rule, make sure we have the correct gateway selected, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll click on gateway rule, make sure we have the correct gateway selected,
always important. And then we'll add a policy, we'll call us gateway C policy.
And then we'll add a rule to look for malware. So we'll click on the three dots
to the left of that policy and click add rule.
We'll call this look for malware and from any source, any destination, any
service. And then here for security profiles, we'll click on the pencil to edit
that.
And we want to select malware prevention and then choose the one that we just
made, the profile called malware profile gateway C and click on apply.
And then we'll go ahead and set this to detect only and then click on publish. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll go ahead and set this to detect only and then click on publish.
And that's being pushed out to our tier one gateway C and the functionality for
that tier one gateway C is being provided by our edge nodes.
So we'll go ahead and refresh that. All right, that looks like it took. So let
's take a peek once again at our settings to make sure everything's in place on
our system.
And NSX application platform right here. NSX application platform has been
deployed, everything's looking green and we also have the NSX malware
prevention enabled. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Secondly, if we go to security and we go to ID / IPS and malware prevention and
go to settings regarding malware prevention, it is enabled on both of our tier
one gateways.
Then furthermore, still under security and still under ID / IPS and malware
prevention, if we go to profiles, we have our profile for malware prevention.
And we included that profile as part of a firewall policy rule. So here under
malware prevention with gateway rule selected and selecting our gateway in
question, which is the tier one gateway C. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
question, which is the tier one gateway C.
We have a policy in place along with a rule that's leveraging our malware
prevention profile. So currently, if we went to security overview, I'll go
ahead and say, yes, let's navigate there.
And we went to malware prevention. Once again, we haven't noticed or seen any
malware. However, let's go back to our client and attempt to download some
malware once again.
So back here at our client, we'll open up our browser. Let's once again attempt
to download some sample malware files. So let's go ahead and click on this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to download some sample malware files. So let's go ahead and click on this
first one to test it and check this out.
So here on the security tab with the security overview selected is now showing
one malicious file event and for threat event monitoring, if we clicked right
here on malware prevention.
And then we took a look at the last hour here in the potential malware. Here we
have our indicator right here about the attempt that we just made.
So if we go back to networking and topology with all those components in place,
including the correct policy in place here on our tier one gateway C. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
including the correct policy in place here on our tier one gateway C.
Now, when this client, which is attempting to download malware off of the
internet, when it does so, this gateway with the malware prevention feature as
part of the NSX application platform enabled and with a profile created and
that profile included as part of a rule and applied to this gateway and also
having this gateway enabled so it's going to support the malware prevention
with all those components in place.
It's now doing its job and actually identifying malicious traffic as it's
trying to come into the network. So thanks for joining me in this set of videos WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
trying to come into the network. So thanks for joining me in this set of videos
as we've taken a look at the implementation and verification of NSX malware
prevention in an NSX environment.
And I look forward to seeing you my friend in another skill very, very soon.
Until then, I hope this has been informative and I'd like to thank you for
viewing.