Let's continue the previous section.
This is actually important section will we'll learn the differences in between the E6 I versus Korean
data plan deployment in terms of distributed firewall.
So for example in terms of management plan and control plan both are almost similar but there are some
differences.
While it is deployed through the data plan.
So what other differences.
Let's first of all check that.
Yes exciting deployment and then we'll go and check the key VM arrangements how it is arranged.
So so far we have a strategy that are like you have the management plan you have the control plan you
have the local control plane you have the management agent or management plane agent.
So if I go here in a small box if I try to go here and here you can see that we have management plan.
You have control plane.
I'll make this central control plane.
That's my management appliance.
These are these are my management airplanes and it is recommended that you should have cluster of three
then inside the data plane.
You have say for example local control plane and then you have something called M.P. management plane
is intangible.
These are the arrangements that we are seeing here.
Now we know that we have the transport June and we have the in radius.
So the point number card here we will see that NSX uses NSX distributed virtual switch a virtual distribution
switch on EA's exciting host which derive from a visa until we guys can see these enter regales along
with the reason we're in the networking service insertion platform.
In short this is a VM where service insertion platform cannot module for firewall.
So this is the component here for firewall.
On the other hand we don't have any videos inside giving them in Syria that we have the Ovi is open.
We switch.
All right so let's see first of all the E6 I arrangement out in the range here.
So we have any that is for virtual work load we know about this.
We have seen so many slides related to this and we have performed various labs as well.
So we have in videos connected with the virtual workloads are connected with VM.
Now this entry in any 60 distributed firewall kernel space implementation yes it's a same.
Same as the implementation of NSX what we experience here we can see the same like that NSX 60 distributed
firewall same like NSX for reuse for both are on the same.
It uses a VM where sip.
So for example in ShoreTel you sip but there is nothing more service in size and platform kernel module
and the kernel IAG and freighters we have the free kitchens it is at scale does not require we center
to be present for distributed firewall.
That's the key we have inside and it's extreme because the NSX doesn't require a visa enter NSX they
can be operated separately utilities operated separately unlike in the NSX for example there are three
or four prior version we require the center but it is now independent software.
Now we don't need actually we sent this software to manage the NSX six week can we manage with their
own dashboard knowledge.
Let me show you the diagram in the next slide so here you can see that you have your NSX manager cluster
we really have three appliances inside the cluster you have the management plan you have the centralized
control plan you're monitoring the flow and the rules and the visibility you have for all the data part
to the management plan by the MBA.
We have the local control plan who is managing real to put which particular rule so which particular
rule will go to which particular Vinick This is the user space but inside the kernel space you can see
that we have the V.C. and you have the firewall kernel module and inside the kernel space because this
is actually DFW is nothing by the hypervisor kernel model.
So here you can see that how the rules and the flow table is and maintain with help of we see the insertion
service incessantly from and it is a catch with the NSX begins and then you have a computer nerd.
That is the arrangement this is this the way this the architecture that distributed firewall works.
Now let us go and check that how this is working inside the kingdom inside giving him also you have
everything actually have some new things I'll show you then I will see you in the next diagram what
new things we have inside their data plan we'll see that.
So let me quickly read this and then I'll show you the diagram NSX use is obvious and it relies on giving
him to provide distributed firewall functionality that does the LCP agent implementation differ from
E6 a host.
Yes here we have what we as open virtual switch there we have the end we yes.
So that's the implementation it's different.
Okay.
That's okay.
We can understand this thing.
Now the key VM you'll find that there is additional agents I should highlight this in my slide.
But let me try to highlight here you have extra agent inside the cabin.
Why.
Because the use of this agent is to can do some sort of conversion will see that what type of conversion
that we.
So we have NSX agent and we have LCP we have two things inside the data plan with both running it in
inside the user space.
When LCP receives a firewall policy from the CCP it sent to the NSX agent.
So now we here can see that LCP will send.
And so the order is this here that you are receiving the rules from the management plan.
So you're receiving from the management plan you're creating actually in the management plan you're
sending through the control plan then you're sending to the LCP and then you have something called NSX
agent.
Why.
Because now you're going to program or we obvious so that citizens let's see here in the next bullet
point that the NSX agent will process and convert policy message received to a format appropriate to
all we are straight about.
So from E6 I can think is excited about how it can be converted to give GM data apart.
That's the usability we have with the NSX agent.
Okay.
And does the NSX as in programs the policy rules onto the obvious data apart using open flow messages
for respectful distributed firewall rules and is it still uses the line X connection track utility to
keep track.
The state of permitted flow connection allowed by the strict full firewall rule so we have the obvious
firewall module there that is tracking the obvious flow and connection table etc..
So now you can say that you're the management plan is the same you control plane in the same but inside
data plan along with LCP you have something called NSX agent now NSX isn't an LCP you can see they are
in the same data part.
This NSX agent is converting whatever rules they're there in the LCP is converting so it is converting
in the obvious kernel module fast path module.
Native language so that he can understand those rules and for that he can program the DFW flows or rule
inside the kernel.
So that's the new thing you can see that we have you don't have the service insertion platform or sip
or we sip in of ECP have over your SKU phosphate module and you have one extra edge into our programming
a set of programs that is converting the rule into the native cadmium data part language or the data
part in the giving him can understand that allowed.
So I hope you understand the architecture for the distributed firewall inside the iOS excite and the
key input.