The upcoming important sections we have is the grouping and micro segmentation act Circa Now to understand
micro segmentation and grouping.
Let's understand the NSX security policy how we can do the planning designing and implementation and
obviously we are going to take help from grouping and we'll discuss about micro segmentation as well
in the upcoming elections.
So we have three step process for policy design and why we have these as tips and methodology Why.
Because the reason behind that we are dealing with three tier application architecture and in this application
define is the end solution.
Our application based that is the solution.
The security is one of the prime concern.
Now we have 70 percent work load or 70 percent traffic that is east to west.
So at that time we should know how to group how to tag how to provide security in terms of micro segmentation
and all.
That's why this design is proposed so we have a policy methodology.
We have policy the rule model.
So what's the margin for that particular policy.
And finally the policy convention how it is going to be consumed not in the policy might have a methodology.
We'll see that we have various options like we have application centric interest in Greek network centric.
So when you're creating the policy more precisely when you're creating the rule model.
So what type of infra are what type of a structure you have to whom you want to create the policy.
Is it application centric policy or it's interesting policy or it's an equal thing to policy or rule
once we have a and b then obviously we should go and apply it.
So that's the implementation phase you have whenever you have the grouping whenever you have the segments
you can go and apply those things.
Now you hear we have the broader picture you can see in the bottom we have the network layer then infrastructure
layer and then application to application basically derived either from infra on network or combination
of both means network infra consist network and application or a writer abstracted from the network
that's the order we have now here you can see that the applications so when you're creating the rules
related to application that means they are not tied with any.
So for example IP we'll announce subnet application based rule means that particular application can
be part of any of these subnet we land etc. etc. So we are breaking the boundary of network related
activities.
Actually you can see the higher they're tailored make policies specified to individual application tier
functions are rules not tied to physical or logical topology it will to be automatic.
Okay.
So here actually the overall goal we have in the as solution is that we should create the application
based rule now Norbert NSX they are providing options to create.
So for example in previous rules as well in four variables or whatever in four variables we have.
So for example logical and physical boundaries knowledge granularity dictated by topology all those
things.
Whenever you create the policy take these things into consideration the network based rule policy IP
based Mac with the static rules and it's difficult to operate in a scale because of the very much you
are doing.
Manuel and here your planning for automated means here you have the full freedom here you have the constraint
upon which you are creating the rule.
So these are the methodology one by one you can see that we have the application in friend network so
whatever we have discussed same things here in the slide you can go and file the recording if you want
to read out you can go through it and read it all these points these are related to application then
we have a few points related to in front area of the physical logical boundary you need to know that
what's a segment port VM et cetera et cetera then you have the network layer policy model where it is
using the traditional approach to group the L2 three elements not whatever model we have either it's
set in for our application or application our internal network in all three models we have option to
group the objects group the same type of activities not only we have option to group the objects but
it can see in the conjunction model that you can define or we can put some sort of tag you can define
the scope so define their scope put the tag.
So suppose if we if I have thousand VM 300 VM related to what is scope related to which particular business
unit.
So for example broad production and then for example H.R. broad for example sales broad for example.
Anything say for example finance like that within scope defined the scope and for the time.
Likewise you can have non-profit.
And then you may have sales etc. in whatever different different groups.
So it's easy that you can define the scope and you can put the tag on that.
Apart from that we can group the workload the work load.
We can group in terms of dynamic dynamic as Catholic membership criteria based on VM name tag segment
IP port etc..
And we are going to create the rule in the upcoming sections.
We're going to create the group and then we are going to create the rule and then we are going to implement
the rule as well in the upcoming session.
So it will be much more clear in the upcoming section then define security policy using the firewall
rule table define the security policy have categorized the policy.
Obviously I will see that security policy and how these rules will look like what we need to do that
we need to define what the source what the destination what is there with what's the application what
what is the action you want to take.
So all these things will be defined inside the rule.
MARTIN So this is the overall three tier policy architecture we have where we should do the planning
designing and finally we can go and implement.