vVMworld 2013: Deploying, Troubleshooting, and Monitoring VMware NSX Distributed Firewall

Deploying, Troubleshooting, and Monitoring VMware

NSX Distributed Firewall

Srinivas Nimmagadda, VMware

Shadab Shah, VMware

SEC5894

#SEC5894

2

Agenda

Introduce NSX Firewall

Architecture and Packet Path for NSX Firewall

Demonstrate powerful provisioning paradigms of NSX Firewall

• 3-Tier Application – (3 VXLANs) or (1 VXLAN)

• Multi-Tenant Scenario

Troubleshooting NSX Firewall

Deployment of NSX Firewall (RBAC, Audit Logging, …)

Monitoring NSX Firewall

3

Hypervisor Kernel Embedded Firewall

Benefits… • Is built right in to the Hypervisor

• “Line Rate” Performance (15Gbps+ per host)

• No VM can circumvent Firewall

• Better compliance model

4

Distributed Virtual Firewall

VM

VM

VM VM

VM

VM

VM

VM

VM

VM

VM

VM

VM

VM

VM

Benefits… • No “Choke Point”

• Scale Out

• Enforcement closest to VM

5

Flexible Access Control Mechanisms

Benefits… • IP/VLAN: Support physical infrastructure based rules

• Security Groups: Logical grouping of VMs

• VM Asset Tags: Dynamic VM attributes

• Rules follow the VMs

VM

VM

VM VM

VM VM

VM

VM

VM VM

VM

VM

VM

VM

VM VM VM

VM VM VM VM

VM VM

VM VM VM

VM

VM

VM

VM

VM

VM

VM VM

VM VM

VM

VM

VM VM

VM

VM

VM

VM

VM VM VM

VM VM VM VM

VM VM

VM VM VM

VM

VM

VM

VM

6

Identity Based Access Control

Active Directory

Eric Frost

User AD Group App Name Originating VM

Name

Destination

VM Name

Source IP Destination IP

Eric Frost Engineering SPDesigner.exe Eric-Win7 Ent-Sharepoint 192.168.10.75 192.168.10.78

IP: 192.168.10.75

Source Destination Services Action

Engineering Ent-Sharepoint http Permit, Log

Rule Table

Logs

8 8 | ©2012, Palo Alto Networks. Confidential and Proprietary.

Packet Path – Source & Destination on same Host

External Network

Source Destination

vSwitch

Traffic between two VMs on the

same host does not hit the

physical switch

Firewalling enforced close to

the source VM

Firewalling also done as traffic

enters the Destination VM’s

vNIC

9 9 | ©2012, Palo Alto Networks. Confidential and Proprietary.

Packet Path – Traffic across Hosts

External Network

Source Destination

vSwitch vSwitch

Traffic between two

VMs on different hosts

hit the physical switches

Firewalling enforced at

source and destination

VM vNICs

Similar flow for Virtual to

Physical Traffic

10

Firewall Management Life Cycle

Prepare Deploy firewall on hosts

Enable Logging

VMTools for VMs, Activity Monitoring

Policy vCenter Objects

Configure Access Rules

Sections

Troubleshoot Logs with Rule IDs

Rule Hit Count

Enforced Rules on a Host

Packet Captures

Monitor Flow Monitoring

Activity Monitoring

Operations Audit Tracking

Role Based Access Control

Import/Export of Configutations

11

Prepare Deploy Firewall

Enable Logging

Deploy VMTools

12

Deploy NSX Firewall

13

Network Setup

14

Enable Firewall Logging

Syslog.global.logHost tcp://10.24.131.189:514

15

Enable VMTools

16

Policy Policy Objects

Access Control Rules

17

Editable Text Here

External

Networks Single Logical

Switch

Vxlan-5004

Web-

sv-02a

App-sv-

02a

Db-sv-

02a

Client

Logical Switch

Vxlan-5000

Client-

01

Client-

02

Web Services

Logical Switch

Vxlan-5002

App Services

Logical Switch

Vxlan-5003

DB Services

Logical Switch

Vxlan-5001

Web-

sv-01a App-sv-

01a Db-sv-

01a

3-Tier Application Deployment

18

Create Security Groups (Static VM Assignment)

19

Create Security TAGs for PCI & DevTest Zones

20

Define AD Domain (for IDFW Rules)

21

Create User Based Access Rules

22

Multi-Tenancy With NSX Firewall

External

Networks

Tenant 2

Logical Switch

Tenant 1

Logical Switch

VM

VM

VM

VM

VM

VM

Routing, VPN, NAT

Tenant Specific

Micro-segmentation

Tenant 2

Logical Switch

23

Tenant-01 Access Rules

Objects

ALL-CUST-VXLANS

Tenant01-VXLAN Tenant02-VXLAN

Tenan01-Services (192.168.10.0/24) Tenant02-FIN-Apps (192.168.10.0/24)

Tenant-01 Section

Source Destination Services Action Apply To

Tenant01-VXLAN Tenant01-Services Any Permit Tenant01-VXLAN

… … … … Tenant01-VXLAN

Tenant01-VXLAN Tenant01-VXLAN Any Deny Tenant01-VXLAN

SP Tenant-01 Section

Source Destination Services Action Apply To

ALL-CUST-VXLANS Tenant01-VXLAN Any Deny

Tenant01-VXLAN ALL-CUST-VXLANS Any Deny

24

Tenant-02 Access Rules

Tenant-02 Section

Source Destination Services Action Apply To

Tenant02-FINANCE Tenant02-FIN-Apps http, https Permit, log Tenant02-VXLAN

… … … … Tenant02-VXLAN

Tenant02-VXLAN Tenant02-VXLAN Any Deny Tenant02-VXLAN

SP Tenant-02 Section

Source Destination Services Action Apply To

ALL-CUST-VXLANS Tenant02-VXLAN Any Deny

Tenant02-VXLAN ALL-CUST-VXLANS Any Deny

25

Host And Network Security Services

Anti Virus

Vulnerability Scanner

DLP

IPS

NGFW

26

Dynamic Security Group Membership

Firewall Rule Table

27

Troubleshooting Log Policy

Rule Hit Count

Enforced Per Host Rules

Packet Capture

28

vCenter Host Kernel Log

29

Log Insight

Source Dest SPORT DPORT Action Rule ID

10.113.132.192 172.25.40.101 62517 3389 DROP 1011

30

Lookup Rules By ID

31

Rule Statistics

32

Per VM Rules

> summarize-dvfilter

> vsipioctl getrules -f nic-1000942032-eth0-vmware-sfw.2

ruleset domain-c7 {

# Filter rules

rule 1024 at 1 inout protocol tcp from addrset ip-securitygroup-34 to

addrset ip-securitygroup-29 port 80 accept with log;

rule 1024 at 2 inout protocol tcp from addrset ip-securitygroup-34 to

addrset ip-securitygroup-29 port 443 accept with log;

rule 1002 at 11 inout protocol any from any to any accept with log;

}

ruleset domain-c7_L2 {

rule 1001 at 1 inout ethertype any from any to any accept;

}

33

Packet Capture

summarize-dvfilter

pktcap-uw --dvfilter nic-1000942032-eth0-vmware-sfw.2 --outfile

test.pcap

34

Monitoring Flow Monitor

Activity Monitor

35

Flow Monitoring

• All flows from the VMs accumulated on NSX Manager

• Provides aggregated historic data for dropped, active and inactive flows

36

Flow Monitoring, Details

37

Live Flows

38

Enable Activity Monitoring for VMs

39

Activity Monitoring

40

Operations Audit Log

Users & RBAC

Config Backup/Restore

41

Audit Log

42

User Management & RBAC

43

Firewall Config Backup/Restore

44

Summary

NSX Firewall

East/West Traffic Control

Identity & VM Awareness

High Performance & Scale-out

Operational Workflows

Policy Management

Troubleshooting

Monitoring

RBAC

REST API & Automation

Take Aways Enables Business Agility

Delivers Superior Performance & Scale

Simplifies Firewall Management

45

Other VMware Activities Related to This Session

HOL:

HOL-SDC-1303

VMware NSX Network Virtualization Platform

Group Discussions:

SEC1000-GD

Distributed Virtual Firewall - Management, Architecture, Scalability and

Performance with Serge Maskalik

SEC5894

THANK YOU

Deploying, Troubleshooting, and Monitoring VMware

NSX Distributed Firewall

Srinivas Nimmagadda, VMware

Shadab Shah, VMware

SEC5894

#SEC5894

62

The Transformative Value of Network Virtualization

Labor/OPEX Savings

Innovation Speed & New Business

83%

Reduction*

88%

Reduction*

93%

Reduction*

Increase in Business Velocity

* Projected savings off current baseline spend, steady

state 75% reduction in IT infrastructure spending.

Source: Large US-based Financial Services company

• Valuable labor moves to SDDC architects, away from high-cost siloed orgs

• Manual design, config & deploy moves to automated / self service provisioning

• Complex / custom hardware configuration moves to simplified IP forwarding

• Box-based net security moves to centrally defined, scale-out security policies

• Physical Infra labor moves to “rack-n-stack” with limited “operator” functions

• Adds/moves/changes no longer require full manual re-provisioning effort

63

Introducing VMware NSX

2013

vCNS v5.1

vCloud Suite (Network & Security) v5.1

vCloud Suite (Network & Security) v5.5

2014

vCloud Network & Security