Micro-segmentation on VXLAN-EVPN fabric with Nexus Dashboard

Hello, hello? Good morning to everyone.00:11So we are getting started with our session. So in the last minute before we actually get started, this is all of the expert inside series we are going to have this quarter. You can just scan the QR code.00:18To check all of them out?00:38If any of those are interesting to you, feel free to join for us is an immense pleasure to actually have you guys over. Okay, so my name is Diego Olivereda. I am a customer success specialist at Cisco.00:40And today I have my colleague and friend Nico that will help us out and show a very nice demonstration for a session today. As I mentioned in the chat.00:58All Q and A and everything is going to be done via Slido. So feel free to go ahead and join us@Slido.com. The session ID is vxlan-G GPO, the passcode is VXLAN. You can just scan the QR code that you see on the screen to join.01:13We are going to have a few poll questions over there to make sure we get some back and forth and understand you guys. And we're also going to have a survey at the end of our session today that is going to be done via there.01:35Okay? So just one more second for everyone to be able to join Slido. Once again, all Q and A is going to be done via Slido, and I will launch our very 1st poll question.01:52In there, right? So the 1st one is, are you currently using Cisco Nexus dashboard in your environment? So, let's get a few answer.02:08It's in and thus far we are in the process. Some of you are running version four, some of you are running version three but most of you are still evaluating it, right? Yeah, that's perfectly fine.02:24We are going to have some insights, a very extensive lab used to demonstrate how to do micro segmentation and so on and so forth. Hope this helps you guys, but you are also free to let us know.02:41If you want to have a more dedicated session with one of our specialists to help you guys better evaluate Cisco Nexus dashboard, and see if it fits your own environment, right? So.02:57Let's get started with our session today. A session is going to be divided into three parts. In the 1st section, we're going to go over the more theoretical approach. What is micro segmentation, how does the works with.03:13Within the NXOS/Nexus dashboard environment and how would a packet flow.03:33Within that infrastructure. Then we are going to have a live live demonstration in where Nico is going to show us some aspects of how to implement, how does it work, how do we check if everything is working and so on and so forth?03:43And of course we have a Slido for all questions and answers. You don't have to wait until the end of the session. Feel free to go on right now if you want to and ask questions that myself, Nicole and another colleague are on the background answering.04:01All of those questions. At the end of the session, we are going to have also a small period of time for Q and A.04:21And at the end of the session, you're going to be able to let us know if you want, one on one consultation with one of our customer success specialists that might help you out with the solution, ok? So without further ado, let's go.04:30Go ahead and get started.04:50The 1st part, as I mentioned, is the theoretical one. And the 1st question that we are going to try to answer is what is exactly micro segmentation? What exactly do we mean by micro segmentation when we are talking in the context of VX line?04:53Right? So everyone knows segmentation, right? No normally we put the firo in the middle and that's it. However, micro segmentation is a technique that allows us to create security segments similar to what the FIRO does.05:12In which we are strictly constrained in which we are not strictly constrained by networks or VLANs in general, right? While firo's exists and they are and will continue to be a part of securing our network and workloads.05:30Micro segmentation allow us to bring security focused and enforcement much closer to our individual workloads or applications, right? So it's a way more granular control. So we have.05:50Smaller groupings, and we can normally offload or or the main effectiveness of micro segmentation is when we deal with east to west traffic, right? So we have a smaller attack surface.06:10Which by nature improves our security posture within our infrastructure, right? We have a better way to guarantee security in the east to west traffic format because we are applying those policies at the very edge where we actually.06:29Event unnecessary traffic to transversing the network especially in those scenarios where we have the firewall in the middle is very common that we have to steer the traffic towards the fire firewall for it to be policed and then out of the firewall towards where the destination is.06:48And for traffic, sometimes this format can be inefficient. So when we talk about micro segmentation using the, the excellent environment.07:07We do have a few requirements regarding platform and software versions, right? So the concept of GPU was introduced into an XOS starting in version ten four and thus we need at least for.07:24Version ten four for it to be supported. There are latest hardware that is already supporting this, but those are the quote unquote older hardware that do support the the excellent GPO.07:44Right, so continue on how exactly does this work, right? So what is that? How does it work?08:02So in the traditional policy, we have similar concepts, right? 1st, we have to identify the endpoint, and in here we have several options when we are doing so.08:19We can, we are going to create, we are going to use a feature that is already old that has been a few years of implementation into the catalyst side or into the campus side, which is the SGT tags or security groups, right?08:34And we are going to use the security groups in order to group our endpoints. This grouping can be done via the network characteristics, so VLAN, IP, MAC address.08:52Or we can do that if we have the nexus dashboard integrated with our VMM manager, we can do that based into the VM attributes. It can be OS, name of the VM, labels or tags and so on and so forth.09:07If we have the integration with DNS, we can do that via DNS and so on and so forth. Then we have to apply our policy, right? This is what we have the basically we are going to use security group access lists.09:25Which pairs with the security group of this SGT tags for us to be able to define here an action what is that we wanna do? Do we want to deny the traffic? Do we want to redirect? Do you want just to do a policy simulation, compare this with something.09:43Else is steered the traffic to where we needed to do or just allow specific protocols or specific ports or so on and so forth.10:03And of course we have the last but one of the most important which is the ability to verify and refine so that we have continuous enforcement of this. And Nexus dashboard is the key piece over here because it allows us to have some visibility of what is going on.10:12And as well as the capability of go back and implement changes into it with these.10:32So, those are the main features that allow this to work, right? We have the security groups, as I mentioned, and we have the security groups access lists that are going to be the ones where we actually use to implement the policies in the middle. Those combined.10:42It will allow us to have the group policy implemented into our VXLAN.11:02So how does this actually work, right? So, once we have our classification/grouping done, right, our security groups implemented into our fabric and so on and so forth, we're going to create those groups.11:11They can be as as small as one host, they can be as big as an entire sub network. It depends on the way that we want to apply the policy, right? So once we have defined our groups, we are going to then create.11:28The protocol association and the contract basically is defining the security group access lists, what is the actions that we want to do, and then putting this in the middle in between the two, at least two security groups.11:46Yeah, so while we talk about applying this policy, right? We have an extra layer which is.12:05Already existing if you are familiar with the ACI infrastructure, but is somewhat new to the traditional networking or format, right? Or even the excellent format. By default.12:22Our vrfs are in any enforced mode. This is the default for any VRF, right? Again, outside of ACI, where we don't have actual policy being applied or NO default behavior in it. The default behavior is we allow the communication.12:37When we are talking about micro segmentation, Nexus dashboard allows us to have an extra layer in here, which is we can put this VRF in something that we call enforced mode.12:56And the enforced mode have two defaults. One is the permit, so we have enforced mode, meaning we are enforcing the GPOs into the VRF level. However, if, if something doesn't.13:12Not match a security group access list.13:32It is going to be permitted at the end, right? So at least we have information logging that we can go back and apply this or a more zero trust approach, which is an enforced mode and with a default being towards a deny action.13:35Yeah, what this means is if something does not match a security group access list, it will be denied by default. So this way we can actually in natively.13:55So at the VRF level, implement a zero trust, topology or infrastructure, right? So this is just another view of how would those two modes work. So the.14:11Enforced default will basically have the security group access lists being applied. However, if something does not match over here, right, the communication will still be allowed, but we are going to have documentation of what is.14:28That was passing by.14:48And the default deny mode, with the action being in deny, we actually have the policy being enforced, but if something does not match, it will be automatically dropped and this is sort of the more zero trust approach, right?14:50So, ok, I understood the micro segmentation part, but why vxlan then? What is the benefit of using those in combination, right? So we already know why we use VXLAN on the side, but what are the benefits of combining the two, right?15:09So, and in here one of the main benefits besides of course being able to segment something within AVXLAN environment is that we can leverage the already existing MPBGP EVPN to propagate information about our security.15:30Groups, right?15:50And this allows us to actually implement the policing or do the policing at both source and destination. Of course, the default behavior is to enforce it at the source. But if for whatever reason or something happens, it is not.15:51Able to apply that in the source, you will also have the capability to apply that at the egress leaf level.16:11And this is just to give us some example of how would this work. So here we have two hosts, right? Those hosts are in different security groups, and we have a layer two VNI and a layer three VNI.16:22And in here we have exactly the layer two VNI advertisement that is going to be done, right? And the layer three VNI advertisement that is going to be done. And this over here.16:38Is exactly what we are referring to as we are then transmitting this information which will allow one for all leafs to identify the security groups in which they have to send traffic to.16:53And apply the policy in there if needed be, ok? How does the packets actually flow? So this is something for us to be able to understand.17:11Within our infrastructure, how would that actually happens? Alrighty. So in this scenario, we have host one and host two. They are in different subnets in different layer two vni's. Both leaves have learned the hosts, right?17:28So we've learned the hosts and we've learned the GPO, the security group tags, because we are receiving the AVPN type two routes advertisement, so every leaf knows exactly what is the G the security group for the source and what is the security.17:47To group for the destination, right? So when the packet comes into leaf number one, it has information about the two groups, so it will be able to actually check the policy.18:07And apply or enforce the policy as soon as the packet enters the switch, right? After it has applied the policy, the leaf is going to change two bits into the header.18:25To let everyone know or to let the leaf into the, the egress side know that one, it has already verified and two it has already implemented the policy, right? So it has already enforced the policy.18:42In this case, we have a contract that allows communication, right? Allows HTTP, so the leaf is going to encapsulate everything, close up, prepare the head, the excellent header with the information I just mentioned, send it and it will reach the leaf on the other side.19:00On the other side, it will read the VX header because it has to decapsulate it, of course, and it will see that both bits, the G and A bits, are already tagged.19:18Which basically says G is the number of the group for the source and A is saying policing was already enforced, right? So leaf four doesn't have to do anything. You just have to forward the traffic downwards.19:33And this is a second scenario. Everything is pretty much the same. The only difference now is that leaf one does not know, even though the default behavior or the typical scenario is for everyone to receive the updates.19:53And knows all of the security groups. This is just to show that the infrastructure and the devices have already a built in way to deal with the situations in which they did not learn, right?20:11This can also happen for external sources, so if our host wanted to talk to something outside, so something behind L three out, so behind another router or something like that, similar behavior could happen, right?20:27So same logic gets into the 1st leaf. This time the leaf doesn't have the ability to apply the policy, right? So it will just put on the G field, set it to number one and populate the field with information about this security group.20:43The A bit on the header is going to be set to zero saying policing was not enforced. And when the packet gets to leaf four, it will check and say, ok, policy was not enforced.21:03Okay, so I have to check policy to see if this allowed, right? So you do check on the header, the source group, now it knows both source and destination group. You then perform a, check to verify if the policy allows for the communication.21:18Checking policy allows for the communication, then it is delivered to the destination, right? Okey dokie. So before we move on to our demonstration section.21:41We have one more slider for you. So what is your primary driver for segmentation on the excellent? So why are we considering this, right? So have a look there. There are a few options. This will allow us to actually.21:56Actually understand better and adjust our next sessions to see to to make sure it is more relevant for you guys.22:16Right? Okey dokie. So most of you are having zero trust mandates to be implemented, so this is something very useful for us and for you guys as well. So now I will hand the ball over to my colleague Nico for us to go over a demonstration.22:26To you Nico. Thanks Diego. So I will be having the demonstration in two phases. We will be 1st enabling the VXLAN group policy object feature, and then we will be creating an actual.22:47Contract and actual end for security contract. So let's go 1st and enable the the VXLAN group policy object, and for this 1st part, I'm using Cisco modeling labs. And if you're also using Cisco modeling labs, then it's not fully.23:02Networking with the group policy object, it doesn't do the enforcement. I will have a hardware lab for 2nd part.23:22But we can see, the enabling of the feature here. So here we have two leaves and a spine and it's the leaf switches that are the most interesting parts here. The spine actually doesn't do, it is a regular spine, it doesn't do any.23:29Anything with the group policy object?23:49And, we are currently in a clean slate config. There is nothing on the, on the leaves yet, and we can check show run and we can grab security. It's a convenient word, the config lines will all have the word security in them so we can just see that.23:51This which is they don't currently have anything that is required for that enabling of the micro segmentation feature or the group policy option. And.24:11Then we can go into the, we will go into the nexus dashboard and we will be changing the settings for the fabric. And we will go to edit fabric.24:27And fabric management and security, we can click enable security groups, we can keep the default group name and the group tags and we can enable the Mac segmentation for the Mac based security groups.24:42And then the deployments of the, of the feature or it comes in two stages. We will be having 1st with system routing templates, some TCAM changes, so we need to 1st do a recalculate.25:02And deploy, and after that we will have the 1st 1st line of config that requires a reboot of the leaf switches. So we can see here nothing on spine.25:20Only the leaf switches are having config lines, and then the 1st one, the system routing template is going to require a reboot. And only after that 1st reboot we can then complete the lines, the feature security group, and then.25:35The max segmentation line, so we can, we can deploy the 1st line of the conflicts and we will be getting information, ok, the reload is required for the leaf switches.25:52So we can go into, the inventory and we can select the leaf switches and actions, maintenance and.26:12Reload the switches. So, the switches will now be unavailable. I will skip some time here and once the switches are back after the 1st reload.26:28We can then, we can then see the 1st line of the conflicts added So just logging in again after the reboot and we can check.26:46Now what lines lines appeared, so the system routing template security groups is applied. So that was the line that was requiring the reboot, and then we can go ahead, we can do 2nd recalculate and deploy.27:03Which is now having the remaining two lines and this will be much faster deploy. It doesn't require any second reloads. So we have the security group.27:21And then the security group Mac segmentation here, and we can just deploy it and and it's done. And we can confirm that, ok, now all the three lines are there, the feature, the Mac segmentation as well as the.27:381st one was the system routing template security groups. Then one more thing we can then confirm after enabling the the GPO feature is we can check show NVE peers detail and we can see the the the VXLAN peers having the group policy capable.27:55Yes here and that's what we wanted to see for enabling the feature. I mentioned something about the modeling labs that it doesn't currently have the full enforcement support. It may come in the future, but at the moment it wasn't there.28:15But I think we are good with enabling the feature. Let's go ahead and we can create our 1st actual security contract. With the components, we have 1st the security groups like we saw Diego was showing how we can do the.28:35Like assignment of the security groups, we will then have protocol definition and security contract and finally how do we push the config into leaf switches is the association. And we have.28:55A lab where we have currently two networks in one VRF and we have one workload connected to each. We have SVI gateway here.fifty.one for the network one, and then we have.29:11Sixty.one for 2nd network and we have the VRF in default permit mode. So it's like as if the GPO micro segmentation is not yet deployed at all. So it's like the basic.29:27Eh, there is NO enforcement yet. In this lab, the leaf switches are individual, they're not connected in VPC, and we can see there are border gateways. Well, the lab is part of multi site domain. We are really only focusing on the on the leaf switches here.29:43Let's take a look what we have currently in this lab, so we can check Mac address table, and we can see the 1st workload VM, the virtual machine here.30:02On the leaf switch one, then on 2nd leaf switch, we can check the MAC address table and we can see 2nd workload here connected on the port and VLAN. And one more check we could do now is like we can check.30:20The VRF enforcement mode and we can see that the VRF we are using this in default permit mode currently. So how do we get from here the basic vxlan setting into enforcing some segmentation?30:38So we are going to do, eh, we are 1st adding the security groups and we will use an IP selector/twenty four so that we will have, all the workloads.30:55Virtual machines in the 1st, network, they will fall into the security group in a one here. And then we have 2nd security group with the/twenty four IP match for 2nd network.31:11And after that, we will be adding a permit and log contract so that we can verify that the traffic that we are having is matching our contracts and we are, we are we are still in the default.31:27Unenforced mode, we are default permits mode. So we are yet not yet enforcing any contracts here, but we can check that if they work, and then we are flipping the VRF into the enforced denied mode, and then.31:45Anything else in the fabric will be, will be denied. So let's go and let's start creating the, the security contracts, the security groups and the contracts. And we can briefly see that we have.31:59In our fabric, we have the VRF configured. We saw that already on the command line here. We can quickly see that we have the networks, we have here in Latin one network and network two. So those were already deployed, all good.32:17So let's take a look at the security groups and the security groups one and SG and Latina two are here. And if you're looking at the security groups, we can see then the the IP match here, how the endpoints fall into the security group.32:33And it says deployed. So I saved a little bit time we don't reload, we don't do the recalculate and deploy as many times. So we can just take take a look at the current status, so we can do show security group.32:51And we can see the security group one here with our IP match/twenty four subnet here and we can see 2nd security group here as well. So how do we know if any of the endpoints yet fall into these security groups? So we can use here.33:07A verification we can do show L two route, L two route Mac IP all, and we can see that our workload IPs and Macs, they are already tagged with the security group tags here.33:26So the workloads aren't the security groups. It's only the unenforced or the default permit, sorry. It's not unenforced, we are in the default permit mode. So that's how between the security groups we have the traffic.33:46Allowed. But let's let's also check the contracts. Show contracts and we don't yet see anything for our own VRF, so these are just different vrfs, so the contracts are not yet there.34:01The next thing we need to add the contracts. And what we saw with Diego how we are using BGP to distribute the security group tags. So I'm going to show one more command for checking checking something around the security group tag. So show BGP.34:17L two VPN EVPN and we can add our 1st workload address here and we can see that in the BGP community string, we also have the policy control tag, the security group tag.34:35Included. But ok, that's enough for now, and now we need to go and create the contracts and what we need 1st is a protocol definition, and we can see here ICMP protocol.34:53And then we have the TCP 5432 another protocol definition. I'm going to show, the settings we can choose here for the protocol. So I'm just going to edit and we can see that for the protocol we select.35:08IP, then, here we have a selected TCP, and then for the destination port range, we have now 54321 port selected here. So I can just close this one and we can then go to the contracts.35:25And we have already here the contract and we can again go to the edits and we can see what does it have. So we have our protocol definitions TCP 5432 and ICMP here, but we have also important part we have the actions here. So we have permit log.35:43And in this case, the log is important because we want to see the verification that we are capturing or we are, we are getting hits on our contract and we want to verify before we switch to enforced deny the VRF.36:03So permit log, then bi directional here means that the server can respond back from the port 5432. So all good here, I'm closing the contract and how do we push the contract finally to the leaf switches? That's happening with the security association.36:18So we can see that we have already here association created, but it's currently in NA status. It's not yet pushed into the switches. So I'm going to show the association here and we can see now that.36:39We have our contracts that we already saw with the protocols and the actions, but we are now binding it into the source and destination group. We have also our VRF selected and then the source group is the source group one, and the destination group is the sec security.36:56We have the security group two as the destination group. So we are binding the contract between the security groups and now we can go ahead and we can push that. So I'm going to attach the association.37:14And I'm going to also click deploy so that the association is being pushed onto the switches. The least which is as well as there are other border gateways, they really only focus on the leaf switches here. I can show it's the same 17 lines both leaves and the.37:31Border gateways, and we have here, we have our protocol definition, we have our contract lines, and then we have the contract association with the source and destination. So we are going to deploy.37:51And once we are getting the deploy done, we have our permits log contracts and we our VRF is still in the full permit mode. So we are next going to check some hits on the contracts before we can go and and flip.38:10The enforcement mode into denied. So ok, now we got the contracts pushed, we can check show contracts and we can now see that we have the new contract lines where we have the ICMP and TCP 5432 with the permit log enabled.38:29So now we can go ahead and we can generate some traffic. So I'm going on to our 1st workload and this is IP address 192168 fifty.five and I can ping 2nd workload machine which is 192168 sixty.six.38:48In 2nd network, a couple of things here and I'm also doing netcats 192168 sixty.645432, so I'm generating a little bit TCP, one TCP packet as well. And now we can go after generating some traffic.39:09We can go and check the logs. The logging, we do on the leaf switch show logging, IP access list cache, and we can see here that we have our source to destination.39:28The ping hits as well as we have from the source to the destination we have also the TCP port 54321 packet that we sent with the heat. So this is a nice way to verify that the contract that we just did.39:43That is getting some hits. And it's cached, so sometimes it maybe also flushed so then you want to try it again. And, and this time I'm doing this very quickly in the real production you would probably use a longer time to verify that the contracts are full.39:59Only working before you do the deny. But now this is good for us. We can go then and change the VRF to into the deny mode. So let's go to the VRF and.40:15I'm going to edit and change the permit mode into enforce denied and we are going to deploy that change and once.40:31We are getting ok it says seven lines but actually it's only having one thing changing from from the permits to deny. Usually it's a good thing to check those lines, but I'm I'm now skipping it. I know it's only one, one thing being changed there.40:49And once we have the changes pushed, we can just verify, I can use also 2nd list which they have the same conflicts, so i'll run VRF. And last in the VRF and we can see that our enforcement mode is now default denied.41:05Okay, so now it's interesting to verify that other contracts working as intended. So I'm going to generate some more traffic and let me do the ping again, and we can see the ping is going through. Now I want to be extra.41:23Detailed to see how the TCP port works. So I'm going to 2nd workload machine and I'm doing a net cat listener on the port 5432 so that we can more, more carefully verify that this communication actually works.41:39And then I'm going to the client side, the security group one side virtual machine, and I'm doing the netcat again on the port 5432. I'm adding the verbose so that we can see, ok, succeeded. So the traffic is going. We can even send something like a small message.41:56And we can see that this test message is coming through on 2nd side, like the, the listener side, the security group two, virtual machine. But what about any other ports? Are we still like in the full.42:15Kind of leaking a mode that nothing is being enforced or are we actually enforcing something? How do we know? So we can try, I'm going to reset the netcad and let's try it on a different port. Something that we did not open or permit.42:32So I'm doing the net cat and I'm changing the port to anything. Well, I'm just going to offset it by one. I'm putting 5431 and let's try now. We have 2nd virtual machine listening on the wrong port.42:49And we now want to verify that I'll be getting, getting something like is the security really being enforced? And we don't get any success here. Let me send also a message message here.43:04And we can verify, we can see that 2nd side is not not getting any connection through NO messages here. So this verifies that what we did with the default deny is actually being enforcing the contracts and we only enabled the ping as well as the TCP 5432.43:20So just a small recap, what we just did, we added the security groups with the IP selectors that were taking our virtual machines into the security groups. But we were still in the default permit mode.43:40We were adding the permit and log contracts to get the hits to verify that the contracts are matching our traffic, and after verifying the contract hits, we flip the VRF into the enforced deny mode and and then all the other traffic than the allowed contracts.43:55Were being enforced and blocked. So that's what I wanted to show, but there's one more thing we can check the flows in the nexus dashboard so we can just go into traffic analytics and we can find our workload, the server side.44:12With the ports being served here, 5432, we can click some details on it and we can see the clients connecting. So here we see the 50, the five client and we can see it's a healthy flow, NO issues here.44:30In the timeframe that we selected in the, in the traffic analytics, we can see some statistics here. We could also launch a flow collection for more detail information, a little bit extra detail. We also saw the wrong port 5431 here. And if, if you are seeing here.44:46Well, I can also click into it and and we can see the details that, ok, what other clients trying to connect here and we can see the warning and we can see the policy drops and well, we can, we can immediately see that, ok, there's a flow that is not being currently enabled and maybe this is also verification that if you want to still.45:06We'll check if the contracts are working as intended.45:26The the ICMP traffic is shown in the endpoint section. I can, I can show that. So here we can see the TCP ports and UDP ports in the traffic analytics, but we can go to the fabrics connectivity and endpoints, and once we call.45:32Click on our endpoint like here, the sixty.6I can go to traffic analytics here and I can see our the TCP ports here, but if i'm scrolling down I can also see the ICMP traffic here.45:50From the client to this endpoint that we selected. So a little bit of a visibility look also what we, we, we capture basically all the flows with the traffic analytics in the, in the fabric. So it's a good verification tool.46:07So, yeah, that's for the demo, back to you, Diego. Thank you very much, Nico. So, we still have a couple of slides.46:24And once again you guys are going to have the chance within our survey here in a minute to let us know if you guys want a one on one, it's free of charge, of course, one on one consultation with any of our experts, right?46:40Okay, so starting now on Slido, you guys have a poll, the post webinar survey, right? So you, in there you have a question which is, if you need further support from our experts and if you want that one on one consultation, just let us know in there.47:00Right? And while you guys go over and answer that, we are going to check once again Q and A So, we don't have any pending questions. If you guys have any pending questions or any questions at all, feel free to go over there and drop.47:20I noticed a couple of questions in the chat though well the idea was to use them in the Q and A but it doesn't matter. We have couple of them on the, on the chat.47:40We can answer some of those. Let me figure out the chat. I unfortunately cannot see it over here. Yeah, there is one is the enforcements enabled on the VRF or for the whole fabric. So while while I was delivering the demo I wasn't.47:52Fully sure at which point this came, but 1st we enabled the the feature and the enforcement mode is per VRF. So you have that granularity in the control. I hope that's, that's the right.48:08Question and answer and then there is another question, can we filter traffic within the same network like example sixty.six and 60 dots ten? And the answer to that is also yes. I was just using very simple/twenty four per network, this security groups, but there is NO limitation.48:23In that.48:43And also, well, we did not touch anything on the layer two, like the Mac segmentation, but there is a possibility also to like select based on Mac addresses as well, but you can freely select even the host addresses, e.g.. So it's not a limitation that you need to.48:44That's the same network SVI subnets. Yes. Yeah, so here in the slide, we also have a few late considerations, sort of a recap, we already touched some of those, right?49:03But basically a few things for us to consider, right? So the security group feature at least as of now is only supported with IPV four underlay fabrics, right? It's not yet there for IPv six underlay.49:22And it's it doesn't support the change control feature of the Nexus dashboard. The nexus dashboard has a feature which is change control that allows us to use the nexus dashboard sort of a for those customers that have a strict change management policy.49:39See that they want to from one person to create the configuration and to exist some sort of peer review.50:00Or sometimes a cab meeting to approve some of those changes, and security group does not work with that feature enabled into the nexus dashboard. Same goes for private VLAN, right? And here is something which is.50:08If we enable the security group feature into the fabric, we cannot import switches that are in a brownfield, right? So if you want to use your security groups, you're going to 1st have all of your switch running, everything working.50:26And everything perfectly fine and then you enable the security group, you will not be able to import the switches if you have the security group feature enabled at that fabric, right? And once more.50:46Are you leaving here? Why we check for more questions in both Slido and the Q and A is the QR code for the upcoming sessions that we are going to have, right?51:06And let me check. I see one more appeared question and there is is there is this stateful filtering like stateful firewall and the answer is NO. It has like we can define on the protocol definition, there is TCP.51:24Act and TCP flags available. So you can like basically each packet coming in, you can check for this TCP flag, but it doesn't really keep keep like a state. It's not, it's not a stateful firewall.51:43Yeah perfect. I see another message on the chat. Oops, which is regarding the smart switches, right?52:00Yes, I see. What's the matter of switches for micro segmentation? Yeah ok. I don't have it, but do you have Diego, do you have something on that? Yes, so the smart switches are, already publicly available, right?52:20And they are designed to be especially for like north south or deeper inspection within your infrastructure. So you can have or use them in combination, right? So you can use micro segmentation in which we are going to apply the policy.52:39Lower the the attack areas and at any point in which you need a deeper inspection, you can send that to the smart switches. The advantage of a smart switch versus a firewall is basically speed, right? So.52:58The cost of having a firewall with, I don't know, a hundred, 400 gigs interface would be very, very high while those switches can do deeper inspection at those speeds for a fraction of the cost, right?53:17So you can do your deeper inspection and this allow you to actually save your firing capacity for your perimeter environment where you don't need as much bandwidth, and it's the cost or or the necessity can be the your capacity can.53:32Be better used there, right? Your fire rolling capacity.53:52Is Microsoft hyper V supported with micro segmentation? I'm assuming the question is regarding the integration with Microsoft hyper V, right? Well, and we are doing everything currently in this demo and like it's like hardware based. So whatever.53:57Where is IP and Mac related, then it doesn't matter.54:16Like it doesn't require any integration so you can use this feature IPN Mac based segmentation with any any platform. Yes, so there is a integration with VMM, right? And you can have integrations onto the Nexus dashboard with.54:21VMware, OpenShift.54:40Kubernetes, there is now also integration with swarm, but there is NO native integration with hyper V So to expand on what Nico mentioned, for your specific use case, you can do segmentation based on the IP mechanism.54:43And so on and so forth, right?55:03DNS, you can have the DNS integration and then do that based on DNS as well yeah ok.55:05Dockey I will remind you guys that we have.55:25And the survey running, right? So if you can, please go ahead and give us your answers over there. This survey is mainly for two things. It's one for us to know where.55:29Can you improve which other topics you guys would like to see and to let us know if you need or want a one on one consultation with one of our csss, right? I know this one useful link.55:46Adding to the chat could have probably put it earlier, but there is the white paper which is a good reference if you need details about the.56:06The feature, the VXLAN micro segmentation using the the GPO, so that's a good good read. Yes. Okey dokie. So with that, we've reached the end of our session today.56:15Oops, we thank you guys very, very much for your time. Hopefully this session was useful for you and we'll catch you guys on to the next one.56:32