WEBVTT 00:00:00.940 --> 00:00:02.980 Hello, my name is Paolo Cruschelli. 00:00:03.500 --> 00:00:06.630 I am an enterprise cloud architect working for a 00:00:06.630 --> 00:00:08.660 cloud service provider in Italy. 00:00:09.240 --> 00:00:12.300 In this course named Identity Management, 00:00:12.310 --> 00:00:15.770 Authentication, and Access Control with VyOS, 00:00:15.770 --> 00:00:19.060 we will learn what is VyOS platform, 00:00:19.440 --> 00:00:23.250 how it fits within a NIST cyber security framework, 00:00:23.740 --> 00:00:27.150 and what are the main features provided by VyOS. 00:00:27.150 --> 00:00:32.759 Then we'll have four different labs to understand how VyOS can be deployed, 00:00:32.950 --> 00:00:37.750 configured, and operated in a real‑world enterprise environment. 00:00:38.240 --> 00:00:38.860 Let's go. 00:00:40.740 --> 00:00:42.700 What is VyOS? 00:00:42.700 --> 00:00:46.760 VyOS is an open‑source network operating system. 00:00:47.600 --> 00:00:52.060 VyOS is a flexible platform suitable for cloud deployments. 00:00:52.840 --> 00:00:59.480 What is the story behind the VyOS? After Brocade Communications stopped 00:00:59.490 --> 00:01:04.810 development of Vyatta Core edition of the Vyatta Routing software, a 00:01:04.810 --> 00:01:10.760 small group of people in 2013 took the last Community Edition, operated a 00:01:10.760 --> 00:01:16.090 fork, and started building on it. The company which sits behind the 00:01:16.090 --> 00:01:23.100 development of VyOS solution is named Sentrium S.L., and is led by those 00:01:23.100 --> 00:01:30.330 three guys I have marked as VyOS creators. Let me provide you some more 00:01:30.330 --> 00:01:36.560 details on VyOS. VyOS is a virtual platform with a wide range of features. 00:01:37.040 --> 00:01:42.860 We have most common routing protocols (BGP, OSPF, policy‑based routing). 00:01:43.180 --> 00:01:47.780 We have firewall features. We have a VPN in many flavors, 00:01:48.560 --> 00:01:54.170 IPSEC, OpenVPN, GRE, L2TP. Current release is Long Term 00:01:54.170 --> 00:01:59.110 Stable 1.3 release, which is a commercial product for which 00:01:59.110 --> 00:02:01.060 you need to pay a subscription. 00:02:01.540 --> 00:02:05.950 Otherwise, you can build from code or you can download a rolling 00:02:05.950 --> 00:02:12.720 release or a pre LTS snapshot. Please take note that all the demos are 00:02:12.720 --> 00:02:19.520 based on a full feature free version R1.3. VyOS is a very flexible 00:02:19.520 --> 00:02:23.920 solution that you can deploy in a wide range of scenarios from bare 00:02:23.920 --> 00:02:26.160 metal to virtual deployments. 00:02:26.640 --> 00:02:31.530 Also take note that the VyOS R1.3 is available on major 00:02:31.530 --> 00:02:35.760 public clouds (AWS, Azure, Google Cloud). 00:02:36.840 --> 00:02:37.460 Finally, 00:02:37.700 --> 00:02:42.320 I strongly recommend having a look to the public site, which is very 00:02:42.320 --> 00:02:46.700 well maintained and user friendly. There you can find plenty of 00:02:46.700 --> 00:02:52.320 information from licensing to admin documentation and knowledge base. 00:02:54.440 --> 00:03:00.080 How VyOS fits to NIST cyber security framework? Let me try to explain 00:03:00.080 --> 00:03:06.360 with a diagram. NIST is articulated in five main functions, namely, 00:03:06.390 --> 00:03:07.830 Identify, Protect, 00:03:07.840 --> 00:03:12.100 Detect, Respond, and Recover. The Protect function 00:03:12.100 --> 00:03:14.150 is composed by many categories. 00:03:15.140 --> 00:03:18.820 Let's focus for the moment on the Identity Management 00:03:18.820 --> 00:03:23.090 Authentication and Access Control category, which in turn 00:03:23.090 --> 00:03:25.860 is composed by many subcategories. 00:03:26.340 --> 00:03:34.590 The one we are targeting here is PR.AC‑5, which is titled Network integrity is 00:03:34.590 --> 00:03:41.570 protected. VyOS is a network platform which can act as the cornerstone for a 00:03:41.570 --> 00:03:47.120 network segmentation and segregation strategy, thanks to its enhanced feature 00:03:47.120 --> 00:03:50.660 set, its performances, and its flexibility. 00:03:52.740 --> 00:03:57.450 One of the most typical attacks is called lateral movement attack. 00:03:57.840 --> 00:04:00.060 Let's have a look on how it works. 00:04:01.240 --> 00:04:05.770 Most common infrastructure design, I should say legacy design, is 00:04:05.770 --> 00:04:10.400 made up of servers built around a flat network with a perimeter 00:04:10.400 --> 00:04:13.260 firewall to protect against attackers. 00:04:13.840 --> 00:04:15.460 What is lateral movement? 00:04:15.840 --> 00:04:20.500 It is the ability of an attacker, once is able to compromise a single 00:04:20.500 --> 00:04:25.200 server, to attack other servers leveraging on the poor security 00:04:25.200 --> 00:04:29.060 policy, which rules the east to west traffic. 00:04:29.640 --> 00:04:33.850 How we can prevent this scenario? By deploying a well‑designed 00:04:34.060 --> 00:04:37.260 network segmentation and segregation strategy. 00:04:39.140 --> 00:04:43.850 Let me provide some more details on network segmentation and segregation. 00:04:44.240 --> 00:04:47.290 Network segmentation is the capability to partition 00:04:47.290 --> 00:04:49.320 the network in smaller segments. 00:04:49.940 --> 00:04:56.160 The first and most important effect is that the exposed surface is reduced, 00:04:56.350 --> 00:05:00.050 being a single segment not visible to the other ones. 00:05:00.540 --> 00:05:05.040 And typically, network segmentation can be realized with several approaches. 00:05:05.150 --> 00:05:11.120 I mean VLAN, VRFs, VPNs, according if your goal is to 00:05:11.120 --> 00:05:14.080 operate segmentation at layer 2, layer 3, 00:05:14.320 --> 00:05:19.930 or at overlay layer. Apart from the protocol, the most critical part when 00:05:19.930 --> 00:05:25.950 implementing a network segmentation is the design phase. On the other end, 00:05:25.950 --> 00:05:31.170 network segregation is the capability to enforce a ruleset to control traffic 00:05:31.170 --> 00:05:34.070 flows between endpoints. As a consequence, 00:05:34.080 --> 00:05:37.940 a security policy is applied to traffic flows within your 00:05:37.940 --> 00:05:42.380 infrastructure, and typically, this is implemented by means of a 00:05:42.380 --> 00:05:47.480 wide range of firewall types and access control list. And now 00:05:47.480 --> 00:05:49.260 it's time to run some demos.