شبکه‌های بدون اعتماد با VMware NSX: ساخت معماری‌های شبکه‌ای بسیار امن برای مراکز داده شما

Front Matter ....Pages i-xviii Network Defense Architecture (Sreejith Keeriyattil)....Pages 1-16 Microsegmentation and Zero Trust: Introduction (Sreejith Keeriyattil)....Pages 17-31 Zero Trust Networks with VMware NSX: Getting Started (Sreejith Keeriyattil)....Pages 33-57 NSX Service Composer and Third-Party Integration (Sreejith Keeriyattil)....Pages 59-79 Bird’s-Eye View of a Zero Trust Network (Sreejith Keeriyattil)....Pages 81-118 The NSX REST API and PowerNSX (Sreejith Keeriyattil)....Pages 119-143 NSX Log Insight and Network Insight (Sreejith Keeriyattil)....Pages 145-172 VMware NSX/AirWatch and Conclusion (Sreejith Keeriyattil)....Pages 173-177 Back Matter ....Pages 179-183 Table of Contents 5 About the Author 11 About the Technical Reviewer 12 Acknowledgments 13 Introduction 14 Chapter 1: Network Defense Architecture 16 Malware that Shocked the World 16 SamSam Ransomware 19 Common Themes of Attack 20 Reconnaissance 21 Port Scanning and Access 21 The Castle Wall Analogy 22 The Perimeter Model Defense Architecture 23 Zone Defense 23 Centralized Security Control 24 IP-Based Traffic Filtering 24 Centralized Source for All Traffic Flow Logs 25 IDS/IPS Use Cases 25 Problems with the Perimeter Model 26 Single Point of Attack/Failure 26 Protects North-South Traffic 27 Firewall Rule Management Is Not Automated 27 Expensive and Appliance Based 28 Why Now and What Has Changed? 28 Virtual Machines and Containers 30 Changes in the Cloud and the Need for End-to-End Automation 30 Summary 31 Chapter 2: Microsegmentation and Zero Trust: Introduction 32 Host-Based Firewalls 33 How Zero Trust Can Be Deployed 34 Prerequisites of Zero Trust 35 Scalable Infrastructure 35 Application Dependency Mapping 36 Ports and Services 36 Current Perimeter Firewall Policies 37 Monitoring Logs 37 Tools for Log Analysis 37 Auditing Purpose and Log Backup 38 Adding a New Application to an Existing Infrastructure 38 VMware NSX 39 Overlay: VXLAN 40 VXLAN Headers 41 Distributed Router 42 VMware NSX Distributed Firewall 43 DFW Packet Flow 45 Summary 46 Chapter 3: Zero Trust Networks with VMware NSX: Getting Started 47 NSX Manager Installation 48 Prerequisites 48 NSX Manager Installation 49 Firewall Policy Update Process 52 NSX Manager RabbitMQ Server Process 52 ESXi Host VSFW (RabbitMQ Client) 54 Firewall Rule Creation 54 Adding Sections 55 Adding Firewall Rules 57 Name and ID 57 Source and Destination 58 Security Groups 59 Security Tags 59 Negate Destination 60 Services 60 Applied To 61 Action 62 Log 62 Saving Firewall Rules 62 Exclusion List 63 Configuring DFW on a Live Network 63 The Application Rule Manager (ARM) 68 NSX Perimeter Gateway 69 Summary 71 Chapter 4: NSX Service Composer and Third-Party Integration 72 Service Composer 73 Security Policies 74 Guest Introspection Services 75 Configuration Flow 77 Configuring Trend Micro with VMware NSX 77 Configuring Security Groups 79 Quarantine Group 81 Verify the Trend Micro Integration and Setup 82 Infecting the Windows 10 VM 84 Firewall Rules 89 Network Introspection 90 Summary 92 Chapter 5: Bird’s-Eye View of a Zero Trust Network 93 Introduction 93 Stakeholder Meetings 95 Application Architecture 95 Layered Architecture 96 Layered Architecture Security Modeling Approach 98 Event-Driven Architecture 98 Event-Driven Architecture Security Modeling Approach 99 Microservices Architecture 99 Microservices Architecture Security Model Approach 100 Managing and Monitoring Servers 100 Application Grouping 102 Security Groups 102 The T-Shirt Company Example 103 Infrastructure for the T-Shirt Company 105 Load Balancer 112 Edge Firewall Rules 114 Frontend Webserver Pool 115 Catalog Application Server 117 Cart Application Server 118 User Application Server 119 Order Application Server 120 Payment Application Server 121 Shipping Application 122 Database and O&M Servers 124 Horizon VDI 124 Handling Scalability 125 Brownfield Setup 126 Understanding the Current Architecture 126 How Zero Trust Helps: An Example 127 Without Zero Trust 128 Summary 130 Chapter 6: The NSX REST API and PowerNSX 131 Returning to the T-Shirt Company Example 133 The NSX REST API 134 Updating Syslog Server Details Using the REST API 137 NTP Configuration Using the REST API 139 Request Body 139 GET Request 140 Using POSTMAN 140 Python Code Snippet 141 Creating Firewall Rules in DFW Using the REST API 143 Creating New Security Groups Using the REST API 144 Using Curl 145 Using POSTMAN 145 Adding Members to Security Groups Using the REST API 146 Creating a New Firewall Section Using the REST API 147 Renaming a Firewall Section 149 Creating Firewall Rules in the Section 150 Using PowerNSX 152 Summary 155 Chapter 7: NSX Log Insight and Network Insight 156 Introduction 156 Why Central Log Management? 157 Log Sources 157 VMware Log Insight 158 Sizing Requirements 160 VMware Log Insight Dashboard 163 Administration and Statistics 166 Content Packs 167 Using VMware Log Insight for Firewall Security Log Analysis 168 VMware Network Insight 173 VMware Network Insight Deployment 174 Network Insight GUI Overview 175 Network Insight for Zero Trust Planning 179 Sample Queries Against NI 181 Summary 183 Chapter 8: VMware NSX/AirWatch and Conclusion 184 AirWatch Scenario 185 T-Shirt Application 185 Creating Security Groups 187 Managing a Zero Trust Network 188 Summary 188 Index 189 Secure your VMware infrastructure against distrusted networks using VMware NSX. This book shows you why current security firewall architecture cannot protect against new threats to your network and how to build a secure architecture for your data center.Author Sreerjith Keeriyattil teaches you how micro-segmentation can be used to protect east-west traffic. Insight is provided into working with Service Composer and using NSX REST API to automate firewalls. You will analyze flow and security threats to monitor firewalls using VMware Log and see how Packet Flow works with VMware NSX micro-segmentation. The information presented in **__Zero Trust Networks with VMware NSX__** allows you to study numerous attack scenarios and strategies to stop these attacks, and know how VMware Air Watch can further improve your architecture.**What You Will Learn** * Know how micro-segmentation works and its benefits * Implement VMware-distributed firewalls * Automate security policies * Integrate IPS/IDS with VMware NSX * Analyze your firewall's configurations, rules, and policies **Who This Book Is For**Experienced VMware administrators and security administrators who have an understanding of data center architecture and operations Secure your VMware infrastructure against distrusted networks using VMware NSX. This book shows you why current security firewall architecture cannot protect against new threats to your network and how to build a secure architecture for your data center. Author Sreerjith Keeriyattil teaches you how micro-segmentation can be used to protect east-west traffic. Insight is provided into working with Service Composer and using NSX REST API to automate firewalls. You will analyze flow and security threats to monitor firewalls using VMware Log and see how Packet Flow works with VMware NSX micro-segmentation. The information presented in Zero Trust Networks with VMware NSX allows you to study numerous attack scenarios and strategies to stop these attacks, and know how VMware Air Watch can further improve your architecture. What You Will Learn Know how micro-segmentation works and its benefits Implement VMware-distributed firewalls Automate security policies Integrate IPS/IDS with VMware NSX Analyze your firewall's configurations, rules, and policies Who This Book Is For Experienced VMware administrators and security administrators who have an understanding of data center architecture and operations