Let us discuss the distributed firewall policy lookup and packet flow.
And this is not different than if you know about the is a firewall or any type of a state full firewall.
Who is doing the filtering does the same.
So what is happening at this point of time that management a plane we have created the policy control
plane has gone to the group to IP lookup and then control plane.
They have pushed that policy to the data plane that's the local control plane.
And now in the hypervisor kernel module it has been installed.
It has been programmed.
So how the lack of will happen what will happen when the packet will come.
We'll see that.
I have one diagram let me show you that.
So here we can see that we have one VM and you can see the highlight as well that you have point number
one.
So when the packet will come and hit the VM what will happen or the VM will do.
So this particular VM here you can see let me highlight it will check.
OK.
The packet whose sources this destination is this the port or the application is this.
This is for DCP sin.
So for this particular packet do I have any existing flu.
So first of all it will go and check the flow.
Now if we go and check all the flu and he will find that or there is no flu related to these information
in a firewall in this courtroom that is nothing by the station table so if there is no she is in table
somewhere you'll find a connection will as well in Cisco also with a reference session table connection
table where we are referring the escaped full firewall inspection so when you have a state full firewall
inspection at that time they are tracking or maintaining the session.
So a quick check inside the flow table.
Do I have this empty existing if that entry is not there in the flow table they then it will go and
check the roulette table.
So here you can see the rule table where I have rule one rule to rule three and rule four five et cetera.
Now what is happening here also in NSX deals it is not different than the ACL rule payroll processing
or any type of rule processing is the end.
What is happening that rule will start reading the hour is scanning the table from top to bottom.
So it quickly start reading from first second third fourth.
Likewise they will start scanning all those things at the moment.
It will find the hit then it will stop the scanning it will not go in a stop anything.
It will scan anything after that it means match found a stop there.
Take the action.
That's the thing we have now.
We'll see.
There goes the default policy by the end of this supposed if nothing has been matched in the table.
Then what will be the default action.
But suppose in this case you can see that the rule with the five double entry has been mass.
So we're going to f with the street if he is allowed then this action will be taken.
Now once this action will be taken here you can see in the point number five there.
Now this particular rule table will update the flow table.
So what will happen next time in the package will come.
It will check the floor table.
It will not go in Iskandar.
The rule table.
This is actually the flow of packet.
And let's see the theory.
We have some theoretical bullet points as well.
So let's quickly cover it.
So we have rule table and we have the connection cracker cable.
So we have connection table a floor table.
So for example we think this is a rule table is okay.
And then plus we have the flow table.
First of all it will check the flow table again its connection cracker first and second it will check
the rule table if it is not for an inflatable.
Check the rule table and update the flow table it's like that its algorithm or program is like that.
Now the firewall can allow for policy to be a state full or stateless.
It can check both a state rule and a stateless.
But remember only for a state fully until we have the connection table or the cracker cable connection
cracker table is populated well before the state full rules.
And this is true for both E6 and E6 I give him environment.
Now this rule will read our process from top to bottom and once the match will happen.
So.
So for example each packet checked against the top rule in the table before moving down.
The first rule in the table matches the traffic parameter is enforced the search is then terminated.
So if you find the match stop the search because of this behavior it is always recommended that you
put the most granular policy at the top.
So try to put those things that you want to match first on the top of the table.
So it will work properly this will ensure more specific policy and enforced.
First day of the DFW default policy tool will be located in the bottom.
It is catch all rule package do not matching any of the rule.
It will go and it will allow all known most of the Cisco you'll find a block at the bottom.
But here you have allow all at the bottom.
That's not good practice.
And that's we have seen earlier that we have different methodology.
We have methodology so for example black list and then we have methodology see white list.
So once you convert into the white list that means we have to put the rules.
So you have the rules and if the rules will not match then it will start dropping the packet.
So based factors that will go and use the likeliest model rather than black list model.
This ensure that we aim to be communication is not broken during the staging and the migration process.
So the thing is that that you create.
First of all you do make that firewall a distributed file well as a whitelist and then create the rules.
Once you have the various rules those rules will be process first.
They will take the connection tracker or flow table if it is there.
It will take that and work.
Otherwise if it is not match it will go and check the rulebook.
So you have the rulebook from sequence 1 2 3 4 etc. and then it will go and update the flow table and
the next entries.
They will not go and check the rule book rule book rather than they will go and follow the connection
tracker or the flow table now or they will we have a study.
You can pause the recording and the same thing point by point.
You can check here.
So all the points we have.
And finally what is happening that once they find the rule entry then they will go and update the rule
table.
And that is for the next upcoming package.
Alright so let's stop here.