In this section we are going to understand about the E6 I and gave him distributed firewall and we'll
see that.
What is the similarity and what are the differences we have inside both a whole straight firewall.
Either say yes exile you go straight or it's giving him a strict firewall.
We are going to see the topology and the hierarchy and all those things one by one by two in general
or the flow so we know that we have something called Management Plan Management Plan.
We can create the policy and then we can push through the centralized control plan from centralized
control plan.
It will go and get pushed through the data plan.
So finally we have the data plane and hearing data plan we have something called local control plan
so we have central control planning you have local control.
Now this is not all the things that we have when we are dealing with distributed firewall.
The caution here is guide to how the management plan is tracking the flow of the firewall or estate
or connection table that is there inside the data plan.
The second question arises here is that how you are controlling that which particular we aim which particular
Winnick you have applied the firewall rules.
So who is going to provide the control while you are pushing the configuration.
Who is going to provide you the monitoring of a steak table connection table flow et cetera.
And suppose if we are creating the rule with respect to object are the groups then who is going to convert
that object or groups inside the in into the IP addresses.
Okay so these are very important questions we have that will get the answer.
And finally how this distributed firewall arrangement look likes over E6 I E6 I host over give him Okay
so let's see this now Erica.
You can see in the diagram that you have the management plane and the control plane you have the NSX
60 management appliance.
Clearly we have centralized control plane.
So first of all in management plane you can go and write the rules.
Then you have to go and push the rule to the control plane then control plane will go and push the rule
and it will program virtually.
It has to go and program the data part are the line card and then that rule will be operation in the
data part in the flow.
Correct.
So these are the things that clearly here can a management plan.
You have the control plan you have the local control plane then you can see that you have management
plane agent and management plan agent is someone who has to crack the connection antiballistic and then
he has to report to the NSX manager.
We have the logical switch here.
This is nothing like the NSX watchful distributor switch.
And then you have the compute nodes in the bottom Oh yeah.
So at this point of time we should understand that what is the rule of the individual planes and how
from those different type of planes and hierarchy we are going to manage the distributed firewall.
So let me go and read all these points.
When a firewall policy rule is configured the NSX Management Plan service validates the configuration
and locally a store a Kansas trained copy this is actually very important because where is your database
your database is there with your management plan.
So he should store the copy of all type of configurations correct.
So that's the first thing.
The second point then the NSX team manager pushes a user published policies through the control plane
service within the manager cluster which in turn pushes to the data plan so we know this hierarchy management
plan control plan and data plan the management then control and then they get a plan.
So this at this point we have already discussed a typical distributed firewall policy configuration
consist of one or more section with set of rules like grouping segments application etc..
We are going to discuss about this so we are going to create the rules.
We are going to create the groups as well.
One of the example we have seen in the previous recording as well that how we can create one type of
asset search rule and you can apply.
So from our checking that can go and log into the inside user are made we can elect as assets as to
be honest with UBS etc etc. But we are going to create the firewall rule and we'll see that how we can
create how easily we can create and apply actually from the management plan to the control plan and
the data plan.
Now we have new information here that for monitoring and troubleshooting the NSX team manager interacts
with host based management and that's why hesitancy you have MP so we have the management plan agent
to recreate the distributed firewall traitors along with the rule and flow.
So we have seen this in the diagram.
The NSX team manager also collects an inventory of all his trade virtualize work load on NSX to transport.
This is dynamically collected and upgraded from all the NSX to transport.
So they are collecting all the way into these of all the host as well.
Say their that's their day to day routine that the management plan is being now coming to control pain
management plan will give the rules to control pain and to control plane has to push that to the data
plan.
So they are the receiver who is receiving the rule from the management plane then if any object is there
they are doing some to some sort of DNS type of activity they are resolving the object to IP mapping
table.
This table is maintained by the control plane and upgraded using the IP discovery mechanism how because
they are discovering the IP with IP discovery mechanism once the policy is converted into a set of rules
based on IP address the control plan pushes the rules through the local control plane on all the transport
node.
So far we are very much clear with the flu the CCP utilized the hierarchy system to distribute the load
of CCP to LCP communication obviously.
Put Lord to one of the LCP that you can refer the diagram.
The responsibility for transport node notification is distributed across the manager which is using
the internal hashing mechanism that's okay.
So for example if we have taken transport nodes managed by three manager then one of the manager will
manage 10 of the transport nodes.
So we are not overburdening the managers with different type of transport nodes.
We have the equal or equal load balancing then a data plan.
How.
So now we have this case about the management plan control plan and now their data plans are how the
policy will come and programmed inside the data path or inside the grid coupling.
So the NSX key transport node comprised these distributed decoupling with the DFT DFW enforcement and
had the hypervisor can deliver.
That's the important thing we have and we have discussed about this that these DFW actually they are
the current level program and it is there at the hypervisor kernel level.
Then each of the transport nodes had given time connect to only one of the CCP manager and that's one
of the restrictions we have.
It's okay.
So we have one to one mapping so transport node our map to the CCP manager on each of the transport
node once local control plane LCP received policy configuration from CCP uses the firewall policy and
rules to the decoupling figures in the kernel for each of the virtual lake.
This is actually very important.
And then we'll stop with the applied to field in the rule or the section is defined the scope of the
enforcement.
The LCP makes sure only the living DFW rules are programmed to the relevant Nick.
So here we can see that you're are that you're creating and really validating the rule from the management
plan then you're pushing through the control plan here.
He is doing the IP to group or 82 segment or whatever resolution he has to resolve their two rules inside
the IP tables or inside the IP.
Then when it is coming to data plane and we know that we have the transport Jun we know that we have
the transport nodes.
So we are not going to apply the rules related to that particular transportation but we have the granularity
that which particular Vinick I want to go and program the rules that I am getting from the central control
plan.
Actually we have local control in the duty of the local control plane that they have to select that
particular rule and program to the virtually a Nick.
So that's why I can see that LCP makes sure we only relevant DFW routes are programmed on relevant virtual
Nick instead of every rule everywhere.
Which would be suboptimal use of the hypervisor resource and that's the one D and we have the local
control plane so quickly take that where I have to go and push the configuration alike.
So let's do one thing let's break this within two part.
Let's stop here and in the next section will go and especially that how iOS 6 and iOS 6 a.m. give him
the distributed firewall is actually distributed.