Let us discuss about any take groups and the firewall rule methodology.
That means when we are creating the rule what are the various components we have inside the firewall.
Starting with groups you can see the group is nothing but when you collect common type of things so
you can collect various objects inside a container and that can form a group.
Now here you can see that group may refer the group so that that will become a reference object in the
first definition of group provides collection of reference object representing represented in a construct
called group.
Means you have one group.
So for example one container where you have a smaller small object set up object collected inside one
container and if you reference this inside some others I suppose this is a.
And then you're referring this inside some B so b the referring a that is again one type of group correct
and we have different type of methodology we have discussed this earlier that we have application infra
and networking methodology where we want to group the elements group the objects.
Correct.
No groups allow abstraction of work load grouping from underlying infrastructure topology so we know
that we have seen that we have three different type of methodology we have network we have intra and
we have application.
So obviously you have to take abstraction of the delay topology that you can refer at the level of application
level and we'll see that we have different type of a ruling methodology.
So when I log into the NSX manager I'll show you that you have various options.
So for example you have options related to Ethernet emergency infra environment application et cetera
to whom you want to group the elements and then you can apply those inside second rule book again a
group is a logical construct that allow grouping into common container.
So you may have a static like IP addresses and any sex object or you may have dynamic like VM name tag
scopes etc. This is a general construct which can be leveraged across a variety of NSX IP features.
That's okay.
You may have a static you may have dynamic when you're grouping the dynamic medium a means when you're
creating the dynamic group at that time you can use the Boolean logic Boolean logic we know that and
then our operation sector to group the elements a group construct a logical grouping of William based
on a strategy and then meet criteria.
Let me show you here in this particular diagram.
So you have object inside the group you can group in terms of IP addresses IP set you can go up in terms
of segment.
So all we can be Nick connected to this segment are logical switch you can group like that you can group
inside group so where you can refer one group to other groups.
Here you have the groups so grouping based on active active for identifying firewall we are idea search
et cetera.
So here you can see this is the group.
And here you have the groups this group is offering agility in the activity.
And this group is nothing but it is referencing some other group.
So elegantly nested group group within the group will see in the upcoming slides that how it looks like
our definition of group within group but we have groups for ages as well.
And then you have Rufus Mack at this Eddie.
So Mack SEC container will be use max it contains a list of individual MAC addresses.
These are just the name that we can group as per these names and ask for these accurate now if we can
group it according to we own property as well so what's the name of VM what's the tag what's our operating
system what's the computer name.
Now here you can see the granularity that NSX t is providing us to create the group and this type of
granularity we do not have in any other extant solution.
Now they are giving us the flexibility to choose what type of active boots we have.
And according to the act we can group the elements are the objects we have these three misery granted.
So what are they.
One that is we have a rule spray more consistent for a given policy model even as the data center environment
change the addition or deletion of workload will effect group numbers.
So say once you have the rule you can simply add the VM put inside that group.
That's it.
So you need to do any change in the rule you change the membership of the work load.
And that rule will be applicable.
So there is no CPE you memory and other effect inside the infrastructure because you're not doing any
major change then publishing a change of group membership to the underlying host is more efficient than
publishing the rule change.
It's a faster to send down to all the affected host and in cheaper in terms of CPM and memory.
The NSX key adds more grouping object criteria.
So if I summarise these points where they're telling that you have much more option it's easy to add
remove the group members
and it's easy to edit the rule as well.
Are members inside the rule.
So these are the things that we have means we have overall full flexibility and we are not.
It is not causing much sleep and memory and it's really easy to write those rules inside that certain
VM or inside the data plan listing of the groups we have.
Yes you can have a different type of active builds and you can group inside the common name.
So for example while a dynamic inclusion criteria all we have the name verb are included in the group.
So I have one is g web security group web where I have added all the Williams whose name is starting
with the web one type of group.
Other type of group you can see that VM contains the name app and their scope.
So here you have the name and their scope and you are putting inside say security group PCI app.
So you have two example of grouping here where you are collecting the name where you're collecting the
name plus group.
Then all we have that connected to a segment is GDP.
That area can see the collection with respect to segment that will be included in the name call security
group.
As a simple example as you give me so we can collect them.
With respect to name means we can group with respect to name we can group with respect to a scope and
name.
We can group with respect to segment as well and the nice thing is this that we can group all these
things inside a common group.
So now we have a nested group called Security Group app 1 or 2 year whose members are web BCI app and
DV and that's the power that we are getting in the grouping containing this fact.
We have the firewall rule policy as well so let's quickly see that how the firewall rule.
We are creating and obviously in the upcoming section we are going to create the rules as well with
the NSX manager.
By default it will be in the allow more.
Once you convert this to the white list then you have to go and write the rule on top of this block
all by default.
It will be allow you have to convert it.
Then the firewall rule and that's the important thing we have.
So when you're writing the rule you have a category like Internet emergency infrastructure environment
and application.
I'll show you in the upcoming section that query will see all these things so you can write the rule
with respect to Internet emergency in infra environment and application.
And once you apply the rule once you publish the rule what will happen that in their data apart they
will follow this order.
So first of all let me check the Internet rules means rule defined inside it and then emergency in my
environment application etc..
Let me quickly log into the NSX manager and let me show you this thing.
Otherwise we will miss later on.
Let me quickly log into the NSX manager.
I logged in inside the NSX manager and here you can see that you have the distributed firewall.
Means I can go to the Security and disability firewall and the category can see at the moment by default
this is blacklisted so case allow all I can make is as widely as and I can add the rule but we have
some inbuilt rule means the old rules are.
Here you can see and many are seeing this rule you can see the columns the name of the rule as a source
or to destination or the service.
What's the profile applied to what's the action at the moment everything is visible.
You can see anywhere it's blacklisted.
So why I came and log into this particular assessment is that at this point of time because I want to
show you the Internet emergency infrastructure environment and application so in the data party can
see that this will check the policy related to these options that we have in the top and then it will
be applicable.
Later on will log into the application and we'll see all these rules.
So for example if I want to add one new rule so we are already inside the name of the name of this rule
is the trickier for example.
And I want to add one more rule in the same list.
So I have this option and rule now it is asking the horse to rule them.
So for example I'll give the name as a testing what's the source.
If you go and click to the source you will get the source.
And here you can see the ad group.
I can create a group for the source if I click AG Group say test scores inside that.
What is the members say here you can see the name the compute members so I can go and click here and
then you can see the membership criteria at the moment.
No members are there and the criteria what do you want to add.
The virtual machine.
Logical Port Said You can see virtual machine logical port logical switch IP sect tag.
And here you can see when you're using the grouping you have the boolean option that you can go and
use the equal.
You can put the tag you can put this code clearly you can see here and that's why we have this because
the theoretical portion so I can go and put their tag.
I can go and put the scope inside this criteria.
Correct.
So at the moment I don't want to create this rule.
I can cancel it but you can see that you have the option here.
There are a few rules.
A few members and some group is there and you can see that I have one group called app server and if
you want to see that inside this app server how many computer members are there.
You can go and click.
You have app 0 1.
Let me close this.
If I go to see for example DV and I want to see the members I can see they remember virtual machine
and IP.
This then group definition members IP all sort of option we have.
Correct.
So at the moment I whatever every do that I'll go here and in the testing portion I will use any existing
group say observers.
Now here you can see the absolute guard selected then will go and click here to their destination in
destination.
Also you have the same type of options that you can see here at the moment all you see for example have
to do we shall choose this TV so you can see the also consider destination.
Then you have the services no service is long and it's actually big.
So you may have pre-defined services you want to choose or you can go and click add new services to
service and here you can see that in the new servers up sick service entry what you want to set add
a new service entry say test service.
Now what service type is it that IP will service ICMP ICMP war easy DCP UDP ether ICM before I will
go and check this application label gateways and all but you have this option that you can go and select
So for example I'll go use JCP then it is asking the source port and their destination port so I can
go and give the source and destination port civic so I have one service call test service.
I have given the range there on the top if you are.
You can go and search.
So I have this test this service I have search I'll apply here.
So now you can see that you have the source of the destination of the service.
Then you have the profile.
Now this profile is basically four in seven type of application in this for application.
It's something you can see here.
It's related to add new context profile so we can live it will see this in the theoretical section is
in the slides I'll cover it then you have this applied to we can apply it to the firewall you can apply
to the group again you can see the groups are there so groups are always there groups are there for
source the destination even services different type of service application also you can group then your
profile and apply to finally have action what action you want to take.
Allow group or reject.
Once you create your rule then you have option to click on the top to publish it and then this rule
one of the rules will be published inside this rule book correct.
So let me quickly come back to the slides and let's continue all these slides.
I am back to the slides and we have discussed this particular slide.
Let me go to the next.
And now it will become really easy to understand all these points here by default it will be in the
blacklist.
So if you go and you use the likeliest means by default you're blocking everything but you have to create
a rule for that so I suppose I can work towards this and then I have to create the rule how we are going
to create the rule will see that the DFW enables policy to be a state funeral stateless with policy
level granted by default.
This is a state full and that's the requirement.
We want a state full instruction but it can work as both in some of the scenarios where the application
has a less network activity the aspects sections may be appropriate to a wide connection risk due to
inactive time out of the DFW aspect full collection table.
How this rule look like you can see name so destination service provider applied to action some ground
setting and these status as well so the rule book or the rule will look like this.
You have to give the name of the rule or the source and destination.
You can go and define the group here.
You can go and create the services no services are big here because you'll find that we have four different
type of services.
So we have four options actually in the service fee.
We have predefined objects and services that we can use.
We can go and create our own custom made service so we have seen that we have option related to El for
Port application level Gateway IP protocol and few other criteria.
We have seen that list so we can go and create services like this also.
So for example we have created this service and we have chosen to see people 22 till 88 correct so we
can do like this then we can see that we have other option like when selecting the is you select supported
protocols for 80 and from the list 80 are only supporting the estate full more because this is related
to application.
If the section is a market is taken as the LG will not implement.
Additionally some LG Navy supported only on iOS 6 I am not giving up.
So be careful check there take note related to LG rules check the premium support side what they of
LG are supporting in E6 I am giving him then we have the customer service group Define a customer service
group in selecting from a single on my multiple services workflow is similar to adding the custom services
except you will be adding multiple service entries and these four options we have in the service we
then profile as we discuss this thing that profile is related to layer 7 application idea and if guilty
in white his profile this will be used for L7 base security rules then finally we can go and apply to
DFW we can apply to group so when group is used in applied to it need to be based on the known IP members
like VM and objects.
Finally you have to take the action.
So we have action like you want to accept we want to reject.
So you want to allow you want to reject you want to drop.
So we are dropping then block the traffic silently if are allowing you allow the traffic or accepting
the traffic and finally reject any that you have option that reset action will send back to initiator
the reset the DCP session are ICMP unreachable with network administrator or we could code for UDP ICMP
in that IP connection.
So we have these many options inside the firewall the rulebook.
So we are good to stop here let us stop.