2016 Edgecore Networks BMF virtual LAB

1. Edgecore Networks Big Monitoring Fabric Virtual Lab Phil Huang <phil_huang@edge-core.com> Open Networking Division
2. Integrate with BMF and Firewall Integrate with BMF and SPAN Hands-On Lab Overview © 2016 Edgecore Networks. All rights reserved. Subject to errors and misprints. | www.edge-core.com Big Monitoring Fabric Overview 01 04 05 02 Setting BMF Environment 03
3. Big Monitoring Fabric Overview 3 LEGACY Trusted Untrusted FIREWALL IPS INTERNET DMZ Complex & Expensive Limited Tool Optimization Operational Challenges ✗ ✗ ✗ INLINE TOOLS Simple & Economical Enhanced Tool Optimization Clear Role Separation between network and security admins ü ü ü BIG MON: INLINE BIG MON INLINE Switches (1/10/40/100G) FIREWALL IPS WEB PROXY Untrusted Trusted INLINE TOOLS TRAFFIC DISTRIBUTION / LOAD SHARING BIG MONITORING FABRIC CONTROLLERS (HA PAIR) ACL-based SPAN OUT-OF-BAND TOOL FARM WEB PROXY © 2016 Edgecore Networks. All rights reserved. Subject to errors and misprints. | www.edge-core.com
4. Hands-On Lab Overview Provided by Big Switch & Edgecore Networks © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 4
5. BMF Inline Mode Hands-On Lab 5 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Learn the fundamental concepts of Big Monitoring Fabric inline § How to work in BMF inline mode? § Create service chain § Create service § Insert Firewall service instance in chain § Insert SPAN service in chain
6. Login BSN Labs & Edgecore Networks 6 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com http://labs.bigswitch.com/edgecore Type information that you are given
7. Launch Big Monitoring Fabric Module 1 7 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com Press “LAUNCH” button Choose “Big Monitoring Fabric”
8. Access Hands-On Lab 8 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com Lab Topology & options to access the BMF Controller
9. Lab Topology Overview 9 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 10.0.0.1
10. Introduction of Component 10 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 1 2 4 5 3 7 6 10.0.0.2 10.0.0.1 BMF Switch * switch name: sw11 BMF Controller * Control BMF Switch Firewall * Drop ICMP echo request Wireshark * Network traffic analyzer
11. Access Big Monitoring Fabric Controller 11 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Right click Big Monitoring Fabric (BMF) Controller icon 2. Select the “Controller GUI” § Default controller username/password is “admin/bsn123”
12. Deploy Switch in BMF Inline Mode Ready to ship from Edgecore Networks © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 12
13. Deploy Switch for Big Chain mode 13 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Setting deployment to Big Chain mode § Default deployment is Big Tap mode § Action 1. Navigate to Fabric -> Switches 2. Click 3. Choose Deploy for Big Chain Default deployment, Need to change to Big Chain mode 1 2 3
14. Test Traffic 14 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Traffic will be block if no chain is defined over the switch ports connecting the hosts § Action 1. Right click External host 2. Access the Web CLI 3. Ping the trusted host in internal network 1 2 3
15. Create a Chain Logical, Layer-1 and Bidirectional Wire © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 15
16. What is Chain? 16 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Logical, Layer-1, bidirectional wire that connects WAN (untrusted) device and LAN switch (trusted) § Multiple services may be assign to a chain § Firewalls § IPS § Web Proxy § Without services, the chain letting all traffic through in both directions, without modifying packets Chain IPS: Intrusion Prevention System
17. Devices Connection 17 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § View devices connected to ports of BMF inline switch § Firewall, IPS, Wireshark, Trusted and Untrusted networks § Action 1. Right click on the inline switch sw11 2. Use Device Information 1 2 Reminder: More clear topology at page 10 J Interface Devices Connect Ethernet1 Trusted Network Ethernet2 Untrusted Network Ethernet3 Wireshark Ethernet4 Firewall (In) Ethernet5 Firewall (Out) Ethernet6 IPS (In) Ethernet7 IPS (Out)
18. Create Internal/External Chain (1/2) 18 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Navigate to Big Chain -> Chains 2. Click on + to add chain 1 2
19. Create Internal/External Chain (2/2) 19 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com Chain name: Edgecore_Chain Select sw11 (00::00:0a) Ethernet1 connected to trusted network Ethernet2 connected to untrusted network Save configuration
20. Test Internal/External Chain 20 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Verify Edgecore_Chain is forwarding traffic § Action 1. Right click External host 2. Access the CLI Access 3. Ping the trusted host in internal network 1 2 3
21. Create a Firewall Service Services instances and Services © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 21
22. Big Chain Service Instances and Services 22 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Service instance § A pair of switch ports that are connected to an inline tool (FW, IPS…etc) § Services § Include one or more service instances § Apply to specific subsets of chains, for enhanced tool performance § Configure with Health Check to alert for tool failure
23. Create a Firewall Service (1/2) 23 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Navigate to Fabric -> Switches 2. Click Switch DPID 3. Click to add a services 1 2 3
24. Create a Firewall Service (2/2) 24 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 4. Naming Firewall_Service 5. For action choose Use Service, and For traffic type All 6. Click submit to finish 4 5
25. Create a Firewall Service Instance (1/2) 25 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Select Firewall_Service in Service list 2. Click New service instance 1 2
26. Create a Firewall Service Instance (2/2) 26 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com Ethernet4 connected to Firewall input interface Ethernet5 connected to Firewall output interface
27. Verify Firewall Service 27 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Show connected graph by BMF WEB GUI
28. Insert Firewall Service Instance Drop ICMP by firewall within BMF chain © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 28
29. Insert Firewall Service Instance (1/2) 29 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Select Edgecore_Chain under Chains 2. Click Insert service to begin 1 2
30. Insert Firewall Service Instance (2/2) 30 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Select Firewall_Service and Instance 1 for Service instance 2. Click Submit 1 2
31. What does it look like? 31 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 1 2 4 5 2 1 4 5 Hands-on Lab Topology View BMF Controller View
32. Verify Traffic Drop on Chain Edgecore_Chain 32 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § By default, the Firewall will drop all ICMP echo requests (type 8) § Action 1. Right click External host 2. Access the Web CLI 3. Ping the trusted host in internal network § PING should fail in either direction § Firewall drops ICMP echo requests 1 3
33. Drop Firewall Service Instance Remove instance easily if you want © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 33
34. Drop Firewall Service Instance 34 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Click and drag to remove 2. Click Summit 2 1
35. Verify Traffic Drop on Chain Edgecore_Chain 35 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Real time response § Action 1. Right click External host 2. Access the Web CLI 3. Ping the trusted host in internal network 1 2 3
36. Create a SPAN Service © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 36
37. Create a SPAN Service (1/2) 37 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Navigate to Fabric -> Switches 2. Click Switch DPID 3. Click to add a SPAN services 1 2 3
38. Create a SPAN Service (2/2) 38 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 4. Naming Wireshark, and click Next 5. Click to add rules 6. Select all traffic with Match All Traffic, click Append then Submit to finish 5 4 6
39. Create a SPAN Service Instance (1/2) 39 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Select Wireshark in Span Services 2. Click New span service instance 1 2
40. Create a SPAN Service Instance (2/2) 40 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 3. Choose ethernet3, and click Submit 4. Show WEB GUI on BMF 3 4
41. Insert SPAN Service Instance Simple and easy to monitor your network © 2016 Edgecore Networks. All rights reserved | www.edge-core.com 41
42. Insert SPAN Service Instance (1/2) 42 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Click Edgecore_Chain in Chains list 2. Insert SPAN service instance at Endpoint 2 1 2
43. Insert SPAN Service Instance (2/2) 43 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 3. Select Wireshark, Instance 1 4. Click Submit 3 4
44. Trace SPAN Traffic 44 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § All ingress traffic at ethernet2 is copied to Wireshark § External-to-Internal direction 1 2 3
45. Verify SPAN Traffic 45 © 2016 Edgecore Networks. All rights reserved | www.edge-core.com § Action 1. Right click External host 2. Access the Web CLI 3. Ping the trusted host in internal network 4. Right click the Wireshark icon and choose Real-time Capture 4 3 Wireshark Output Result
46. 46 Open Networking from Freedom Control Innovation © 2016 Edgecore Networks. All rights reserved | www.edge-core.com
47. © 2015 Edgecore Networks. All rights reserved. Subject to errors and misprints. | www.edge-core.com