nexus

The video introduces you to the concepts behind Cisco VSG and VNMC. We will help you understand how VSG works with other components such as VNMC, VSM and VEM to provide policy-based security within an IP subnet. This video serves as a prerequisite to our future VSG labs. Since this is an introduction-to-technology video, there will be no lab.

• VSG
• VNMC
• VSM
• VEM
• vPath

The video looks into Virtual Extension LAN (VXLAN) support on Cisco Nexus 1000V. VXLAN allows VLAN ID to be extended to 24 bits, or in other words, essentially increases number of available VLAN from 4096 to more than 16 million VLAN. We will configure VXLAN on port-profile. In this lab, we intentionally have VEM control interfaces separated by layer 3 to demonstrate MAC-in-IP encapsulation provided by VXLAN to extend an isolated layer 2 domain across a routable and multicast-enabled network.

The video looks into Cisco TrustSec feature on Cisco Nexus 1000V. We will configure port-profiles to assign SGT to hosts, and have SGT-to-IP mapping sent to an ASA firewall over a SXP connection for policy enforcement. We will see how we can construct an ACL on the ASA to permit or deny traffic based on SGT value using a object-group-security. 

The video looks at how we can achieve network separation at layer 2 with private vlan on Cisco Nexus 1000V. We will go through the concept of Primary, Secondary, Isolated and Community VLANs, and experiment with server communication by placing the servers on different vlan. At the end of the video, we will also go through a scenario where we have two sets of private vlan. Private VLAN allows hosts to remain segregated on the same IP subnet. 

The video presents three main QoS building blocks on Cisco Nexus 1000V: Marking, Policing, and Queuing. We will be applying QoS to Port-Profile to mark RDP traffic, and enforcing policing based on matching DSCP value. Any traffic exceeding allowable rate will be either drop or marked down. We will attempt to provide guaranteed bandwidth to both Nexus and VMware control traffic. DSCP values will be analyzed using Wireshark packet capture.

The video looks into three advanced security features on Cisco Nexus 1000V: DHCP Snooping, Dynamic ARP Inspection, and IP Source Guard. We will be testing each of the features with security audit tools, and we will be able to see how these features protect us from DHCP, ARP and source IP spoofing attacks.

The video walks you through two basic security features on Cisco Nexus 1000V: Access Control List (ACL) and Port-Security. We will configure ACL on a host-facing port-profile and have any denied traffic being logged and sent to a Syslog server. We will enable Port-Security to limit the number of MAC address and test our configuration by performing MAC flooding attack.

• Access Control List (ACL)
• Port-Security
• Errdisable Recovery
• MAC Flooding (Macof Tool)

The video demonstrates how to enable Netflow on Cisco Nexus 1000V to collect network traffic information. We will configure Netflow at vEthernet interfaces, run FTP and RDP as our test applications, and review information displayed on Netflow collector. We will also perform packet capture and analyze Netflow version 9 packets.

• Netflow v9
• Netflow Collector
• Netflow Packet Analysis