diff --git a/ace_pro/docs/images/lab2-pingfails.png b/ace_pro/docs/images/lab2-pingfails.png new file mode 100644 index 00000000..555d32ed Binary files /dev/null and b/ace_pro/docs/images/lab2-pingfails.png differ diff --git a/ace_pro/docs/lab2.md b/ace_pro/docs/lab2.md index 3664f97d..2418027f 100644 --- a/ace_pro/docs/lab2.md +++ b/ace_pro/docs/lab2.md @@ -143,7 +143,7 @@ You can also access your instances using also their **Public IP addresses**! You 1) `Cloud Assets` 2) `Topology` -### 3.2.1 Cloud Assets (to retrieve IP addresses) +#### 3.2.1 Cloud Assets (to retrieve IP addresses) - Go to **CoPilot > Cloud Resources > Cloud Assets** and filer based on the keyword `"test"`. - Identify the instance **_aws-us-east-2-spoke1-test1_** and copy its public ip address and use it with your SSH client. @@ -178,7 +178,7 @@ align: center SSH with public IP address ``` -### 3.2.2 Topology (to retrieve IP addresses) +#### 3.2.2 Topology (to retrieve IP addresses) - Navigate to **CoPilot > Topology > Overview (Default Tab)** and enter **_aws-us-east-2-spoke1-test1_** in the search field located on the right-hand side. @@ -204,7 +204,9 @@ Topology In the Properties window under the Topology section of your CoPilot, you can also access the **Private IP addresses** for EAST-WEST traffic. ``` -Now that you have logged in to the **_aws-us-east-2-spoke1-test1_** successfully, you can issue your ping commands towards the private IP address of the other instances! +## 3.3 Verification Using Uour SSH Client + +Now that you have logged in to the **_aws-us-east-2-spoke1-test1_** successfully, you can issue your ping commands towards the **Private IP address** of the other instances! ```{figure} images/lab2-sshclient00.png --- @@ -213,7 +215,18 @@ align: center --- SSH client ``` - + +```{figure} images/lab2-pingfails.png +--- +height: 400px +align: center +--- +Ping outcomes +``` + +```{tip} +Verify also the **SSH** protocol +``` ## 4. Aviatrix CoPilot diff --git a/docs/ace-pro/_images/lab2-pingfails.png b/docs/ace-pro/_images/lab2-pingfails.png new file mode 100644 index 00000000..555d32ed Binary files /dev/null and b/docs/ace-pro/_images/lab2-pingfails.png differ diff --git a/docs/ace-pro/_sources/docs/lab2.md b/docs/ace-pro/_sources/docs/lab2.md index 3664f97d..2418027f 100644 --- a/docs/ace-pro/_sources/docs/lab2.md +++ b/docs/ace-pro/_sources/docs/lab2.md @@ -143,7 +143,7 @@ You can also access your instances using also their **Public IP addresses**! You 1) `Cloud Assets` 2) `Topology` -### 3.2.1 Cloud Assets (to retrieve IP addresses) +#### 3.2.1 Cloud Assets (to retrieve IP addresses) - Go to **CoPilot > Cloud Resources > Cloud Assets** and filer based on the keyword `"test"`. - Identify the instance **_aws-us-east-2-spoke1-test1_** and copy its public ip address and use it with your SSH client. @@ -178,7 +178,7 @@ align: center SSH with public IP address ``` -### 3.2.2 Topology (to retrieve IP addresses) +#### 3.2.2 Topology (to retrieve IP addresses) - Navigate to **CoPilot > Topology > Overview (Default Tab)** and enter **_aws-us-east-2-spoke1-test1_** in the search field located on the right-hand side. @@ -204,7 +204,9 @@ Topology In the Properties window under the Topology section of your CoPilot, you can also access the **Private IP addresses** for EAST-WEST traffic. ``` -Now that you have logged in to the **_aws-us-east-2-spoke1-test1_** successfully, you can issue your ping commands towards the private IP address of the other instances! +## 3.3 Verification Using Uour SSH Client + +Now that you have logged in to the **_aws-us-east-2-spoke1-test1_** successfully, you can issue your ping commands towards the **Private IP address** of the other instances! ```{figure} images/lab2-sshclient00.png --- @@ -213,7 +215,18 @@ align: center --- SSH client ``` - + +```{figure} images/lab2-pingfails.png +--- +height: 400px +align: center +--- +Ping outcomes +``` + +```{tip} +Verify also the **SSH** protocol +``` ## 4. Aviatrix CoPilot diff --git a/docs/ace-pro/docs/lab10.html b/docs/ace-pro/docs/lab10.html index 15f3acb5..9768037b 100644 --- a/docs/ace-pro/docs/lab10.html +++ b/docs/ace-pro/docs/lab10.html @@ -385,46 +385,46 @@

2.1 Enable CostIQ ../_images/lab9-costiq.png
-

Fig. 372 Enable CostIQ#

+

Fig. 373 Enable CostIQ#

../_images/lab9-costiq001.png
-

Fig. 373 Enable CostIQ#

+

Fig. 374 Enable CostIQ#

Now click on "+ Cost Center" and create the AWS Cost Center aforementioned.

../_images/lab9-costiq02.png
-

Fig. 374 “+ Cost Center”#

+

Fig. 375 “+ Cost Center”#

../_images/lab9-costiq03.png
-

Fig. 375 AWS#

+

Fig. 376 AWS#

Repeat the action creating the remaining two Cost Centers: GCP and Azure, associating the corresponing Application VPCs/VNets.

../_images/lab9-costiq04.png
-

Fig. 376 GCP#

+

Fig. 377 GCP#

../_images/lab9-costiq05.png
-

Fig. 377 AZURE#

+

Fig. 378 AZURE#

You should immediately get insights on how they have been utilized.

../_images/lab9-costiq06.png
-

Fig. 378 Cost Centers Overview#

+

Fig. 379 Cost Centers Overview#

@@ -438,48 +438,48 @@

3. New York DC is the Shared Services ../_images/lab9-costiq10.png
-

Fig. 379 Show BGP Learned Routes#

+

Fig. 380 Show BGP Learned Routes#

You will find out that all the local subnets advertised by the DC belong to the cidr 10.40.0.0/16.

../_images/lab9-cidr.png
-

Fig. 380 CIDR#

+

Fig. 381 CIDR#

Let’s move on the Shared Services tab and click on "+ Shared Service".

../_images/lab9-costiq12.png
-

Fig. 381 “+ Shared Service”#

+

Fig. 382 “+ Shared Service”#

Create the Shared Service based on the aforementioned requirements.

../_images/lab9-costiq13.png
-

Fig. 382 “+ Shared Service”#

+

Fig. 383 “+ Shared Service”#

If you kept running the ping on the Workstation Edge’s terminal, then you should see both the relative traffic and the absolute one from any Cost Centers towards the Shared Service.

../_images/lab9-ping.png
-

Fig. 383 Ping from the Wortkstation “Edge”#

+

Fig. 384 Ping from the Wortkstation “Edge”#

../_images/lab9-counter.png
-

Fig. 384 From the Cost Center towards the Shared Service#

+

Fig. 385 From the Cost Center towards the Shared Service#

After this lab, this is how the overall topology would look like:

../_images/lab9-final.png
-

Fig. 385 Final topology for Lab 10#

+

Fig. 386 Final topology for Lab 10#

diff --git a/docs/ace-pro/docs/lab11.html b/docs/ace-pro/docs/lab11.html index d99ac696..79e04394 100644 --- a/docs/ace-pro/docs/lab11.html +++ b/docs/ace-pro/docs/lab11.html @@ -411,7 +411,7 @@

2. Distributed Cloud Firewall Overview ../_images/lab10-initial.png
-

Fig. 386 Initial Topology Lab 11#

+

Fig. 387 Initial Topology Lab 11#

@@ -428,7 +428,7 @@

3.1. Smart Group “bu1” ../_images/lab10-smart2.png
-

Fig. 387 SmartGroup#

+

Fig. 388 SmartGroup#

Ensure these parameters are entered in the pop-up window "Create SmartGroup":

@@ -441,7 +441,7 @@

3.1. Smart Group “bu1” ../_images/lab10-smart3.png
-

Fig. 388 Resource Selection#

+

Fig. 389 Resource Selection#

The CoPilot shows that there are two instances that perfectly match the condition:

@@ -452,7 +452,7 @@

3.1. Smart Group “bu1” ../_images/lab10-smart4.png
-

Fig. 389 Resources that match the condition#

+

Fig. 390 Resources that match the condition#

@@ -462,7 +462,7 @@

3.2. Smart Group “bu2” ../_images/lab10-smart5.png
-

Fig. 390 New Smart Group#

+

Fig. 391 New Smart Group#

Ensure these parameters are entered in the pop-up window "Create SmartGroup":

@@ -475,7 +475,7 @@

3.2. Smart Group “bu2” ../_images/lab10-smart6.png
-

Fig. 391 Resource Selection#

+

Fig. 392 Resource Selection#

The CoPilot shows that there are three instances that match the condition:

@@ -487,7 +487,7 @@

3.2. Smart Group “bu2” ../_images/lab10-smart7.png
-

Fig. 392 Resources that match the condition#

+

Fig. 393 Resources that match the condition#

At this point, you have only created logical containers that do not affect the existing routing domain (thanks to the Connetion Policy applied on Lab3). It’s time to define DCF rules that can govern the East-West traffic, thoroughly.

@@ -495,7 +495,7 @@

3.2. Smart Group “bu2” ../_images/lab10-newone2.png
-

Fig. 393 Complete DCF Rules List#

+

Fig. 394 Complete DCF Rules List#

@@ -509,19 +509,19 @@

3.3. Connectivity verification (ICMP) ../_images/lab10-newone.png
-

Fig. 394 SSH#

+

Fig. 395 SSH#

../_images/lab10-newone3.png
-

Fig. 395 Ping#

+

Fig. 396 Ping#

../_images/lab10-newone43.png
-

Fig. 396 Ping#

+

Fig. 397 Ping#

@@ -540,13 +540,13 @@

3.4. Connectivity verification (SSH) ../_images/lab10-sshtoaws.png
-

Fig. 397 SSH to test2 in AWS US-East-2–> OK#

+

Fig. 398 SSH to test2 in AWS US-East-2–> OK#

../_images/lab10-sshnew2.png
-

Fig. 398 SSH fails towards the other instances#

+

Fig. 399 SSH fails towards the other instances#

The previous outcomes confirm undoubtedly that the connectivity is broken. Only the intra-vpc traffic is permitted.

@@ -564,7 +564,7 @@

4.1. Create an intra-rule that allows ICMP inside bu1 ../_images/lab10-newrule.png
-

Fig. 399 New Rule#

+

Fig. 400 New Rule#

Insert the following parameters:

@@ -580,14 +580,14 @@

4.1. Create an intra-rule that allows ICMP inside bu1 ../_images/lab10-rule1.png
-

Fig. 400 Create Rule#

+

Fig. 401 Create Rule#

Click on Commit.

../_images/lab10-rule2.png
-

Fig. 401 Current list of rules#

+

Fig. 402 Current list of rules#

@@ -597,7 +597,7 @@

4.2. Create an intra-rule that allows ICMP inside bu2 ../_images/lab10-rule3.png
-

Fig. 402 New rule#

+

Fig. 403 New rule#

Ensure these parameters are entered in the pop-up window "Create Rule":

@@ -618,14 +618,14 @@

4.2. Create an intra-rule that allows ICMP inside bu2 ../_images/lab10-intrabu2.png
-

Fig. 403 intra-icmp-bu2#

+

Fig. 404 intra-icmp-bu2#

Now proceed and click on the Commit button.

../_images/lab10-intrabu2345.png
-

Fig. 404 Commit#

+

Fig. 405 Commit#

@@ -636,7 +636,7 @@

5. Verification ../_images/lab10-topology2.png
-

Fig. 405 New Topology#

+

Fig. 406 New Topology#

@@ -645,7 +645,7 @@

5.1. Verify SSH traffic from your laptop to bu1 ../_images/lab10-sshpod.png
-

Fig. 406 SSH from your laptop#

+

Fig. 407 SSH from your laptop#

@@ -665,7 +665,7 @@

5.2. Verify ICMP within bu1 and from bu1 towards bu2 ../_images/lab10-pingcheck.png
-

Fig. 407 Ping#

+

Fig. 408 Ping#

Let’s investigate the logs:

@@ -676,14 +676,14 @@

5.2. Verify ICMP within bu1 and from bu1 towards bu2 ../_images/lab10-monitor100.png
-

Fig. 408 Filter#

+

Fig. 409 Filter#

../_images/lab10-monitor.png
-

Fig. 409 Outcomes#

+

Fig. 410 Outcomes#

Now, let’s try to ping the instance aws-us-east-2-spoke1-test2 from aws-us-east-2-spoke1-test1.

@@ -694,28 +694,28 @@

5.2. Verify ICMP within bu1 and from bu1 towards bu2 ../_images/lab10-pingtotest2.png
-

Fig. 410 Ping#

+

Fig. 411 Ping#

Go to CoPilot > Security > Distributed Cloud Firewall > Settings and click on the "Manage" button, inside the "Security Group (SG) Orchestration" field.

../_images/lab10-orchestration.png
-

Fig. 411 SG Orchestration#

+

Fig. 412 SG Orchestration#

Enable the SG orchestration feature on the aws-us-east-2-spoke1 VPC, flag the checkbox "I understand the network impact of the changes" and then click on Save.

../_images/lab10-orchestration2.png
-

Fig. 412 Manage SG Orchestration#

+

Fig. 413 Manage SG Orchestration#

Relaunch the ping from aws-us-east-2-spoke1-test1 towards aws-us-east-2-spoke1-test2.

../_images/lab10-pingtotest2fail.png
-

Fig. 413 Ping fails#

+

Fig. 414 Ping fails#

@@ -729,7 +729,7 @@

5.3. Verify SSH within bu1 ../_images/lab10-sshfail.png
-

Fig. 414 SSH fails#

+

Fig. 415 SSH fails#

@@ -739,7 +739,7 @@

5.4. Add a rule that allows SSH in bu1 ../_images/lab10-newrule2.png
-

Fig. 415 New rule#

+

Fig. 416 New rule#

Ensure these parameters are entered in the pop-up window "Create Rule":

@@ -761,14 +761,14 @@

5.4. Add a rule that allows SSH in bu1 ../_images/lab10-sshbu1.png
-

Fig. 416 Create rule#

+

Fig. 417 Create rule#

Click on "Commit" to enforce the new rule into the Data Plane.

../_images/lab10-commitsshbu1.png
-

Fig. 417 Commit#

+

Fig. 418 Commit#

    @@ -778,7 +778,7 @@

    5.4. Add a rule that allows SSH in bu1 ../_images/lab10-sshbu1ok.png
    -

    Fig. 418 SSH ok#

    +

    Fig. 419 SSH ok#

    Let’s investigate the logs once again.

    @@ -786,7 +786,7 @@

    5.4. Add a rule that allows SSH in bu1 ../_images/lab10-logsshbu1.png
    -

    Fig. 419 Logs#

    +

    Fig. 420 Logs#

    From the log above is quite evident that the "intra-ssh-bu1” rule is permitting SSH traffic within the Smart Group bu1, successfully.

    @@ -794,7 +794,7 @@

    5.4. Add a rule that allows SSH in bu1 ../_images/lab10-topologynew.png
    -

    Fig. 420 New Topology#

    +

    Fig. 421 New Topology#

    @@ -804,7 +804,7 @@

    5.4. SSH to VM in bu2 ../_images/lab10-sshtocentral.png
    -

    Fig. 421 SSH to gcp-us-central1-spoke1-test1#

    +

    Fig. 422 SSH to gcp-us-central1-spoke1-test1#

    @@ -821,7 +821,7 @@

    5.5. Verify ICMP traffic within bu2 ../_images/lab10-pingtestgcp.png
    -

    Fig. 422 Ping#

    +

    Fig. 423 Ping#

    Let’s investigate the logs once again.

    @@ -829,7 +829,7 @@

    5.5. Verify ICMP traffic within bu2 ../_images/lab10-bu2monitor.png
    -

    Fig. 423 Monitor#

    +

    Fig. 424 Monitor#

    The logs above confirm that the ICMP protocol is permitted within the Smart Group bu2.

    @@ -841,7 +841,7 @@

    5.6. Inter-rule from bu2 to bu1 ../_images/lab10-newrule4.png
    -

    Fig. 424 New Rule#

    +

    Fig. 425 New Rule#

    Ensure these parameters are entered in the pop-up window "Create New Rule":

    @@ -862,14 +862,14 @@

    5.6. Inter-rule from bu2 to bu1 ../_images/lab10-interssh.png
    -

    Fig. 425 Create Rule#

    +

    Fig. 426 Create Rule#

    Enforce this new rule into the Data Plane clicking on the "Commit" button.

    ../_images/lab10-newcommit2.png
    -

    Fig. 426 Commit#

    +

    Fig. 427 Commit#

    SSH to the Public IP of the instance azure-west-us-spoke2-test1.

    @@ -884,7 +884,7 @@

    5.6. Inter-rule from bu2 to bu1 ../_images/lab10-pingallok.png
    -

    Fig. 427 Ping ok#

    +

    Fig. 428 Ping ok#

    Let’s investigate the logs once again.

    @@ -893,7 +893,7 @@

    5.6. Inter-rule from bu2 to bu1 ../_images/lab10-monitorfresh.png
    -

    Fig. 428 Monitor#

    +

    Fig. 429 Monitor#

    The logs clearly demonstrate that the inter-rule is successfully permitting ICMP traffic from bu2 to bu1.

    @@ -901,7 +901,7 @@

    5.6. Inter-rule from bu2 to bu1 ../_images/lab10-lastdrawing2.png
    -

    Fig. 429 New Topology with the DCF rules#

    +

    Fig. 430 New Topology with the DCF rules#

    @@ -911,7 +911,7 @@

    5.6. Inter-rule from bu2 to bu1 ../_images/lab10-direction.png
    -

    Fig. 430 From-To#

    +

    Fig. 431 From-To#

    The inter-rule is Stateful in the sense that it will permit the echo-reply generated from the bu1 to reach the instance in bu2.

    @@ -926,7 +926,7 @@

    6.1 Activation of the MTT ../_images/lab10-newtopology3.png
    -

    Fig. 431 New Topology#

    +

    Fig. 432 New Topology#

    SSH to the Public IP of the instance azure-west-us-spoke2-test1.

    @@ -937,7 +937,7 @@

    6.1 Activation of the MTT ../_images/lab10-pingfails10.png
    -

    Fig. 432 Ping#

    +

    Fig. 433 Ping#

    The ping fails, therefore, let’s check the routing table of the Spoke Gateway azure-west-us-spoke2.

    @@ -945,20 +945,20 @@

    6.1 Activation of the MTT ../_images/lab10-spoke2azure.png
    -

    Fig. 433 azure-west-us-spoke2#

    +

    Fig. 434 azure-west-us-spoke2#

    Then click on the "Gateway Routes" tab and check whether the destination route is present in the routing table or not.

    ../_images/lab10-gatewayroutes.png
    -

    Fig. 434 Gateway Routes#

    +

    Fig. 435 Gateway Routes#

    ../_images/lab10-newjoe20.png
    -

    Fig. 435 10.0.12.0#

    +

    Fig. 436 10.0.12.0#

    @@ -976,14 +976,14 @@

    6.1 Activation of the MTT ../_images/lab10-mtt.png
    -

    Fig. 436 aws-us-east-1-transit#

    +

    Fig. 437 aws-us-east-1-transit#

    Go to "Settings" tab and expand the "“Border Gateway Protocol (BGP)” section and insert the AS number 64512 on the empty field related to the "“Local AS Number”, then click on Save.

    ../_images/lab10-mtt2.png
    -

    Fig. 437 Border Gateway Protocol (BGP)#

    +

    Fig. 438 Border Gateway Protocol (BGP)#

    Repeat the previous action for the last Transit Gateway still without a BGP ASN configured properly:

    @@ -993,7 +993,7 @@

    6.1 Activation of the MTT ../_images/lab10-newlab.png
    -

    Fig. 438 azure-west-us-transit#

    +

    Fig. 439 azure-west-us-transit#

    @@ -1004,7 +1004,7 @@

    6.1 Activation of the MTT ../_images/lab10-mtt3.png
    -

    Fig. 439 aws-us-east-2-transit#

    +

    Fig. 440 aws-us-east-2-transit#

    Go to "Settings" tab and expand the "General" section and activate the "Multi-Tier Transit", turning on the corresponding knob.

    @@ -1012,7 +1012,7 @@

    6.1 Activation of the MTT ../_images/lab10-mtt4.png
    -

    Fig. 440 Multi-Tier Transit#

    +

    Fig. 441 Multi-Tier Transit#

    Let’s verify once again the routing table of the Spoke Gateway in azure-west-us-spoke2.

    @@ -1020,14 +1020,14 @@

    6.1 Activation of the MTT ../_images/lab10-mtt5.png
    -

    Fig. 441 azure-west-us-spoke2#

    +

    Fig. 442 azure-west-us-spoke2#

    This time if you click on the "Gateway Routes" tab, you will be able to see the destination route, 10.0.12.0/23, in aws-us-east1-spoke1 VPC.

    ../_images/lab10-mtt6.png
    -

    Fig. 442 10.0.12.0/23#

    +

    Fig. 443 10.0.12.0/23#

      @@ -1040,7 +1040,7 @@

      6.1 Activation of the MTT ../_images/lab10-mtt7.png
      -

      Fig. 443 Ping#

      +

      Fig. 444 Ping#

      Although this time there is a valid route to the destination, thanks to the MTT feature, the pings still fails.

      @@ -1056,7 +1056,7 @@

      6.2 Smart Group “east1” ../_images/lab10-mttnew.png
      -

      Fig. 444 New Smart Group#

      +

      Fig. 445 New Smart Group#

      Ensure these parameters are entered in the pop-up window "Create SmartGroup":

      @@ -1068,7 +1068,7 @@

      6.2 Smart Group “east1” ../_images/lab10-mtt9.png
      -

      Fig. 445 Resource Selection#

      +

      Fig. 446 Resource Selection#

      The CoPilot shows that there is just one single instance that matches the condition:

      @@ -1083,7 +1083,7 @@

      6.3 Create an inter-rule that allows ICMP from bu2 towards east1 ../_images/lab10-mtt8.png
      -

      Fig. 446 New Rule#

      +

      Fig. 447 New Rule#

      Ensure these parameters are entered in the pop-up window "Create Rule":

      @@ -1104,14 +1104,14 @@

      6.3 Create an inter-rule that allows ICMP from bu2 towards east1 ../_images/lab10-lastrule.png
      -

      Fig. 447 The Last Rule…#

      +

      Fig. 448 The Last Rule…#

      Now you can carry on with the last commit!

      ../_images/lab10-lastcommit.png
      -

      Fig. 448 Commit#

      +

      Fig. 449 Commit#

      @@ -1123,7 +1123,7 @@

      6.4 Verify connectivity between bu2 and east1 ../_images/lab10-lastping.png
      -

      Fig. 449 Ping#

      +

      Fig. 450 Ping#

      This time the ping will be successful!

      @@ -1132,14 +1132,14 @@

      6.4 Verify connectivity between bu2 and east1 ../_images/lab10-reallylast.png
      -

      Fig. 450 inter-icmp-bu2-east1 Logs#

      +

      Fig. 451 inter-icmp-bu2-east1 Logs#

      After the creation of both the previous inter-rule and the additional Smart Group, this is how the topology with all the permitted protocols should look like.

      ../_images/lab10-newjoe.png
      -

      Fig. 451 Final Topology#

      +

      Fig. 452 Final Topology#

      @@ -1150,7 +1150,7 @@

      7. Spoke to Spoke Attachment ../_images/lab10-spoke2spoke01.png
      -

      Fig. 452 No More NGFW#

      +

      Fig. 453 No More NGFW#

      @@ -1159,20 +1159,20 @@

      7.1 Creating a Spoke to Spoke Attachment ../_images/lab10-spoke2spoke02.png
      -

      Fig. 453 Manage Gateway Attachments#

      +

      Fig. 454 Manage Gateway Attachments#

      Select the Spoke Gateway tab, click on the "+ Attachment" button and then choose the azure-west-us-spoke1 GW from the drop-down window.

      ../_images/lab10-spoke2spoke03.png
      -

      Fig. 454 azure-west-us-spoke2#

      +

      Fig. 455 azure-west-us-spoke2#

      ../_images/lab10-newspokeatt.png
      -

      Fig. 455 Save#

      +

      Fig. 456 Save#

      Do not forget to click on Save.

      @@ -1180,7 +1180,7 @@

      7.1 Creating a Spoke to Spoke Attachment ../_images/lab10-spoke2spoke04.png
      -

      Fig. 456 Spoke to Spoke Attachment#

      +

      Fig. 457 Spoke to Spoke Attachment#

      @@ -1192,14 +1192,14 @@

      7.1 Creating a Spoke to Spoke Attachment ../_images/lab10-spoke2spoke05.png
      -

      Fig. 457 azure-west-us-spoke2#

      +

      Fig. 458 azure-west-us-spoke2#

      You will notice that the destination is now reachable with a lower metric (50)!

      ../_images/lab10-spoke2spoke06.png
      -

      Fig. 458 Metric 50#

      +

      Fig. 459 Metric 50#

      The traffic generated from the azure-west-us-spoke2-test1 VM will now prefer going through the Spoke-to-Spoke Attachment, for the communication with the Spoke1 VNet.

      @@ -1210,14 +1210,14 @@

      7.1 Creating a Spoke to Spoke Attachment ../_images/lab10-spoke2spoke07.png
      -

      Fig. 459 Spoke to Spoke#

      +

      Fig. 460 Spoke to Spoke#

      After this lab, this is how the overall topology would look like:

      ../_images/lab10-lastdrawing.png
      -

      Fig. 460 Full-Blown Aviatrix Solution#

      +

      Fig. 461 Full-Blown Aviatrix Solution#

      diff --git a/docs/ace-pro/docs/lab12.html b/docs/ace-pro/docs/lab12.html index 56e0fb93..bbc6fecf 100644 --- a/docs/ace-pro/docs/lab12.html +++ b/docs/ace-pro/docs/lab12.html @@ -373,14 +373,14 @@

      2. Provision through Terraform ../_images/lab11-edge.png
      -

      Fig. 461 Lab 11 section on the POD Portal#

      +

      Fig. 462 Lab 11 section on the POD Portal#

      Insert the corresponding credentials, available on the POD Portal, to log in to the remote “edge” Workstation.

      ../_images/lab11-edge2.png
      -

      Fig. 462 Edge Workstation credentials#

      +

      Fig. 463 Edge Workstation credentials#

        @@ -389,7 +389,7 @@

        2. Provision through Terraform ../_images/lab11-edge3.png
        -

        Fig. 463 VS Studio#

        +

        Fig. 464 VS Studio#

          @@ -402,19 +402,19 @@

          2. Provision through Terraform ../_images/lab11-edge4.png
          -

          Fig. 464 terraform-lab folder#

          +

          Fig. 465 terraform-lab folder#

          ../_images/lab11-newedge2.png
          -

          Fig. 465 Click “Open”#

          +

          Fig. 466 Click “Open”#

          ../_images/lab11-newedge.png
          -

          Fig. 466 Yes, I trust the authors#

          +

          Fig. 467 Yes, I trust the authors#

            @@ -427,7 +427,7 @@

            2. Provision through Terraform ../_images/lab11-terraform2.png
            -

            Fig. 467 Manifest#

            +

            Fig. 468 Manifest#

            @@ -448,7 +448,7 @@

            2. Provision through Terraform ../_images/lab11-terraform.png
            -

            Fig. 468 Visual Studio Code#

            +

            Fig. 469 Visual Studio Code#

              @@ -466,7 +466,7 @@

              2.1 Expected Results ../_images/lab11-terraform-topology.png
              -

              Fig. 469 Topology#

              +

              Fig. 470 Topology#

              @@ -487,13 +487,13 @@

              3.2 Provision through Terraform ../_images/lab11-newfile.png
              -

              Fig. 470 New File#

              +

              Fig. 471 New File#

              ../_images/lab11-peering.png
              -

              Fig. 471 peering.tf#

              +

              Fig. 472 peering.tf#

                @@ -517,25 +517,25 @@

                3.2 Provision through Terraform ../_images/lab11-clip1.png
                -

                Fig. 472 Hidden Clipboard#

                +

                Fig. 473 Hidden Clipboard#

                ../_images/lab11-clip2.png
                -

                Fig. 473 Copy the statemets from the Lab Guides and paste them#

                +

                Fig. 474 Copy the statemets from the Lab Guides and paste them#

                ../_images/lab11-clip3.png
                -

                Fig. 474 Copy from the hidden clipboard and paste them inside the peering.tf#

                +

                Fig. 475 Copy from the hidden clipboard and paste them inside the peering.tf#

                ../_images/lab11-clip4.png
                -

                Fig. 475 Close the Clipboard and save!#

                +

                Fig. 476 Close the Clipboard and save!#

                  @@ -545,7 +545,7 @@

                  3.2 Provision through Terraform ../_images/lab11-clip5.png
                  -

                  Fig. 476 Once again “terraform init”#

                  +

                  Fig. 477 Once again “terraform init”#

                    @@ -554,7 +554,7 @@

                    3.2 Provision through Terraform ../_images/lab11-clip6.png
                    -

                    Fig. 477 Once again “terraform plan”#

                    +

                    Fig. 478 Once again “terraform plan”#

                    -
                    +
                    ../_images/lab2-transitbutton.png
                    -

                    Fig. 59 +Transit Gateway#

                    +

                    Fig. 60 +Transit Gateway#

                    Deploy Aviatrix Transit Gateways in AWS East-2 region. To save time, Aviatrix Transit Gateways in Azure, GCP and AWS east-1 region have already been pre-deployed in pairs for this lab.

                    @@ -729,10 +744,10 @@

                    4.1.1.Transit Gateway in AWS US-EAST-2 +
                    ../_images/lab2-transitcreation.png
                    -

                    Fig. 60 Create Transit Gateway#

                    +

                    Fig. 61 Create Transit Gateway#

                    @@ -740,17 +755,17 @@

                    4.1.1.Transit Gateway in AWS US-EAST-2 +
                    ../_images/lab2-gwmessage.png
                    -

                    Fig. 61 Gateway deployment in progress#

                    +

                    Fig. 62 Gateway deployment in progress#

                    You may check the status of the gateway creation in the top right corner by expanding the task icon.

                    -
                    +
                    ../_images/lab2-taskicon.png
                    -

                    Fig. 62 Task icon#

                    +

                    Fig. 63 Task icon#

                    This action will instantiate the Transit Gateway with the following name:

                    @@ -763,10 +778,10 @@

                    4.1.1.Transit Gateway in AWS US-EAST-2#

                    Navigate to the tab immediately to the right, which is Spoke Gateways.

                    This is CoPilot > Cloud Fabric > Gateways > Spoke Gateways > + Spoke Gateway.

                    -
                    +
                    ../_images/lab2-spokecreate.png
                    -

                    Fig. 63 +Spoke Gateway#

                    +

                    Fig. 64 +Spoke Gateway#

                    @@ -789,10 +804,10 @@

                    4.2.1. Spoke Gateway in AWS +
                    ../_images/lab2-spokeinaws.png
                    -

                    Fig. 64 Create Spoke Gateway in AWS#

                    +

                    Fig. 65 Create Spoke Gateway in AWS#

                    While the gateway is being created, you may proceed to the next section.

                    @@ -819,17 +834,17 @@

                    4.2.2. Spoke Gateway in AzureWarning

                    Make sure you do not select the subnets that begins with az-1, az-2, or az-3. It is Aviatrix’s recommended practice to deploy gateways in subnets with ‘gateway’ in their name, whereas workloads in subnets that do not have ‘gateway’ in their name).

                    -
                    +
                    ../_images/lab2-rightsubnet.png
                    -

                    Fig. 65 Subnet selection#

                    +

                    Fig. 66 Subnet selection#

                    Do not forget to click on SAVE.

                    -
                    +
                    ../_images/lab2-spokeinazure.png
                    -

                    Fig. 66 Spoke GW in Azure#

                    +

                    Fig. 67 Spoke GW in Azure#

                    While the gateway is being created, you may proceed to the next section.

                    @@ -853,10 +868,10 @@

                    4.2.3. Spoke Gateway in GCP +
                    ../_images/lab2-spokeingcp.png
                    -

                    Fig. 67 Spoke GW in GCP#

                    +

                    Fig. 68 Spoke GW in GCP#

                    @@ -864,24 +879,24 @@

                    4.2.3. Spoke Gateway in GCP +
                    ../_images/lab2-inprogress2.png
                    -

                    Fig. 68 Deployment in progress#

                    +

                    Fig. 69 Deployment in progress#

                    Once all gateways have been created, confirm from CoPilot > Cloud Fabric > Gateways > Overview (default TAB) the presence of a total of nine GWs Clusters!

                    -
                    +
                    ../_images/lab2-14gws.png
                    -

                    Fig. 69 Dashboard#

                    +

                    Fig. 70 Dashboard#

                    After created the Transit gateway in AWS US-EAST-1 region and the single Spoke gateways in each cloud, this is how the topology would look like.

                    -
                    +
                    ../_images/lab2-temptopology.png
                    -

                    Fig. 70 Overview of the new topology#

                    +

                    Fig. 71 Overview of the new topology#

                    @@ -889,10 +904,10 @@

                    4.2.3. Spoke Gateway in GCP

                    4.3. Explore the Cloud Fabric#

                    Go to CoPilot > Cloud Fabric > Topology > Overview (default tab), then click on the "Managed" button to only showing the Managed VPCs!

                    -
                    +
                    ../_images/lab2-newuitopo.png
                    -

                    Fig. 71 Managed VPCs and Unmanaged VPCs#

                    +

                    Fig. 72 Managed VPCs and Unmanaged VPCs#

                    @@ -901,16 +916,16 @@

                    4.3. Explore the Cloud Fabric"Collapse all VPC/VNets" button on the bottom right-hand side, as depicted below.

                    -
                    +
                    ../_images/lab2-collapse.png
                    -

                    Fig. 72 Collapse button#

                    +

                    Fig. 73 Collapse button#

                    -
                    +
                    ../_images/lab2-topologyoverview.png
                    -

                    Fig. 73 VPC circles#

                    +

                    Fig. 74 VPC circles#

                    @@ -926,24 +941,24 @@

                    4.4 Aviatrix Spoke to Transit Gateways Attachments

                    4.4.1. Spoke to Transit Attachment in AWS#

                    Go to CoPilot > Cloud Fabric > Gateways > Spoke Gateways and edit the Spoke Gateway aws-us-east-2-spoke1, clicking on the pencil icon:

                    -
                    +
                    ../_images/lab2-spokeinawstotransit.png
                    -

                    Fig. 74 Attachment for AWS#

                    +

                    Fig. 75 Attachment for AWS#

                    Select the Transit Gateway aws-us-east-2-transit (do not select the aws-us-east-1-transit) from the drop-down window "Attach To Transit Gateway", and then click on Save.

                    -
                    +
                    ../_images/lab2-editspokeinaws.png
                    -

                    Fig. 75 Edit Spoke in AWS#

                    +

                    Fig. 76 Edit Spoke in AWS#

                    You will see immediately a message informing that the updating is in progress.

                    -
                    +
                    ../_images/lab2-immediatemessage.png
                    -

                    Fig. 76 Update in progress#

                    +

                    Fig. 77 Update in progress#

                    @@ -953,17 +968,17 @@

                    4.4.2 Spoke to Transit Attachment in Azure +
                    ../_images/lab2-editspokeinazure.png
                    -

                    Fig. 77 Edit spoke in Azure#

                    +

                    Fig. 78 Edit spoke in Azure#

                    Select the Transit Gateway azure-west-us-transit from the drop-down window "Attach To Transit Gateway", and then click on Save.

                    -
                    +
                    ../_images/lab2-editazure.png
                    -

                    Fig. 78 Attachment in Azure#

                    +

                    Fig. 79 Attachment in Azure#

                    @@ -973,31 +988,31 @@

                    4.4.3. Spoke to Transit Attachment in GCP +
                    ../_images/lab2-editspokeingcp.png
                    -

                    Fig. 79 Edit spoke in GCP#

                    +

                    Fig. 80 Edit spoke in GCP#

                    Select the Transit Gateway gcp-us-central1-transit from the drop-down window "Attach To Transit Gateway", and then click on Save.

                    -
                    +
                    ../_images/lab2-editgcp.png
                    -

                    Fig. 80 Attachment in GCP#

                    +

                    Fig. 81 Attachment in GCP#

                    Look for these three confirmations through the task icon, before proceeding.

                    -
                    +
                    ../_images/lab2-confirmation.png
                    -

                    Fig. 81 Confirmations#

                    +

                    Fig. 82 Confirmations#

                    At this point, after attaching Spoke Gateways to their respective Transit Gateways, this is what the overall topology would look like.

                    -
                    +
                    ../_images/lab2-topologywithattachments.png
                    -

                    Fig. 82 New state of the Dynamic Topology#

                    +

                    Fig. 83 New state of the Dynamic Topology#

                    @@ -1014,16 +1029,16 @@

                    4.5. CoPilot Verification of Spoke-Transit AttachmentsTip

                    Be patient, it will take some minutes before seeing the changes reflected into the topology. Refresh the web page to see the change reflected on the map!

                    -
                    +
                    ../_images/lab2-attachment.png
                    -

                    Fig. 83 Attachments#

                    +

                    Fig. 84 Attachments#

                    -
                    +
                    ../_images/lab2-expandedtopology1.png
                    -

                    Fig. 84 Expanded Topology#

                    +

                    Fig. 85 Expanded Topology#

                    Click on the "Legend" button to figure out what those icons represent.

                    @@ -1032,10 +1047,10 @@

                    4.5. CoPilot Verification of Spoke-Transit AttachmentsDashed line = Default IPSec tunnel

                    Solid line = HPE IPSec tunnel

                    -
                    +
                    ../_images/lab2-hpe.png
                    -

                    Fig. 85 Legend#

                    +

                    Fig. 86 Legend#

                    @@ -1054,17 +1069,17 @@

                    4.6.1. AWS and Azure +
                    ../_images/lab2-edittransitinaws.png
                    -

                    Fig. 86 Edit Transit in AWS#

                    +

                    Fig. 87 Edit Transit in AWS#

                    Select the Transit Gateway azure-west-us-transit from the drop-down window "Peer To Transit Gateways", and then click on Save.

                    -
                    +
                    ../_images/lab2-peeringawsazure.png
                    -

                    Fig. 87 Peering AWS-Azure#

                    +

                    Fig. 88 Peering AWS-Azure#

                    @@ -1074,17 +1089,17 @@

                    4.6.2 Azure and GCP +
                    ../_images/lab2-edittransitinazure.png
                    -

                    Fig. 88 Edit Transit in Azure#

                    +

                    Fig. 89 Edit Transit in Azure#

                    Select the Transit Gateway gcp-us-central1-transit from the drop-down window "Peer To Transit Gateways", and then click on Save.

                    -
                    +
                    ../_images/lab2-peeringazuregcp.png
                    -

                    Fig. 89 Peering Azure-GCP#

                    +

                    Fig. 90 Peering Azure-GCP#

                    @@ -1094,24 +1109,24 @@

                    4.6.3. GCP and AWS +
                    ../_images/lab2-editgcp2.png
                    -

                    Fig. 90 Edit Transit in GCP#

                    +

                    Fig. 91 Edit Transit in GCP#

                    Select the Transit Gateway aws-us-east-2-transit (not the east-1 !) from the drop-down window "Peer To Transit Gateways", and then click on Save.

                    -
                    +
                    ../_images/lab2-peeringgcpaws.png
                    -

                    Fig. 91 Peering GCP-AWS#

                    +

                    Fig. 92 Peering GCP-AWS#

                    At this point, this is what the overall topology would look like:

                    -
                    +
                    ../_images/lab2-peeringtopology.png
                    -

                    Fig. 92 New Topopology state after Peerings deployment#

                    +

                    Fig. 93 New Topopology state after Peerings deployment#

                    @@ -1131,10 +1146,10 @@

                    5. Verification

                    5.1. Verification of Transit Peerings on CoPilot (Cloud Fabric)#

                    Go to CoPilot > Cloud Fabric > Gateways > Transit Gateways, select the Transit Gateway aws-us-east-2-transit, then select the Attachments" tab and finally select the "Transit-Transit Peering" tab: you will see one connection per each peering, that correspond to the two IPSec tunnels.

                    -
                    +
                    ../_images/lab2-verification.png
                    -

                    Fig. 93 Verification#

                    +

                    Fig. 94 Verification#

                    @@ -1146,16 +1161,16 @@

                    5.2. Verification of Transit Peerings on CoPilot (Topology) +
                    ../_images/lab2-peering.png
                    -

                    Fig. 94 Peerings#

                    +

                    Fig. 95 Peerings#

                    -
                    +
                    ../_images/lab2-expanded2.png
                    -

                    Fig. 95 Expanded Topology#

                    +

                    Fig. 96 Expanded Topology#

                    @@ -1163,18 +1178,18 @@

                    5.2. Verification of Transit Peerings on CoPilot (Topology)#

                    Route Info DB is akin to the Routing Information Base (RIB). It will provide the overall routing information of a Transit Gateway known by the CoPilot.

                    Go to CoPilot > Cloud Fabric > Gateways > Transit Gateways and select the Transit Gateway aws-us-east-2-transit:

                    -
                    +
                    ../_images/lab2-transitaws.png
                    -

                    Fig. 96 Explore Transit in AWS#

                    +

                    Fig. 97 Explore Transit in AWS#

                    Then select the "Route DB" tab. Pay special attention to “Best Routes”, its prefixes, type and metric value:

                    -
                    +
                    ../_images/lab2-rib.png
                    -

                    Fig. 97 Route DB#

                    +

                    Fig. 98 Route DB#

                    @@ -1193,10 +1208,10 @@

                    5.4. Connectivity tests through GatusNote

                    POD PORTAL:

                    Both public DNS names and private IP addresses of the test instances are retrievable from your personal portal.

                    -
                    +
                    ../_images/lab2-newpic.png
                    -

                    Fig. 98 POD Portal info#

                    +

                    Fig. 99 POD Portal info#

                    @@ -1204,10 +1219,10 @@

                    5.4. Connectivity tests through GatusNote

                    TOPOLOGY (CoPilot > Cloud Fabric > Topology):

                    Explore the aws-us-east-2-spoke1 VPC and select the instance aws-us-east-2-spoke1-test1 with the EC2 instance logo, then check its properties: you will be able to fetch both Public and Private IP addresses.

                    -
                    +
                    ../_images/lab2-newpic3.png
                    -

                    Fig. 99 Test Instance Properties#

                    +

                    Fig. 100 Test Instance Properties#

                    @@ -1215,10 +1230,10 @@

                    5.4. Connectivity tests through GatusNote

                    Do not select the instance with the Aviatrix logo!

                    You can’t SSH to any Aviatrix GWs !

                    -
                    +
                    ../_images/lab2-newpic2.png
                    -

                    Fig. 100 Different Logos#

                    +

                    Fig. 101 Different Logos#

                    @@ -1228,24 +1243,24 @@

                    5.4. Connectivity tests through Gatus +
                    ../_images/lab2-pingfromaws.png
                    -

                    Fig. 101 Ping from AWS#

                    +

                    Fig. 102 Ping from AWS#

                    Run ping from Azure VM to verify connectivity to AWS and GCP:

                    -
                    +
                    ../_images/lab2-pingfromazure.png
                    -

                    Fig. 102 Ping from Azure#

                    +

                    Fig. 103 Ping from Azure#

                    Run ping from GCP VM to verify connectivity to Azure and AWS:

                    -
                    +
                    ../_images/lab2-pingfromgcp.png
                    -

                    Fig. 103 Ping from GCP#

                    +

                    Fig. 104 Ping from GCP#

                    @@ -1320,11 +1335,14 @@

                    5.4. Connectivity tests through Gatus2. Multicloud Connectivity Overview
                  • 3. Topology
                    • +
                  • 3.3 Verification Using Uour SSH Client
                  • 4. Aviatrix CoPilot
                  • 4. Initial configuration
                    • 4.1. Aviatrix Transit Gateways
                      • diff --git a/docs/ace-pro/docs/lab3.html b/docs/ace-pro/docs/lab3.html index 12fc0f5f..b929e135 100644 --- a/docs/ace-pro/docs/lab3.html +++ b/docs/ace-pro/docs/lab3.html @@ -380,7 +380,7 @@

                      3. Topology ../_images/lab3-topology.png
                      -

                      Fig. 104 Topology for Lab 3#

                      +

                      Fig. 105 Topology for Lab 3#

                    • @@ -392,14 +392,14 @@

                    4.1. Aviatrix Transit Gateways ../_images/lab3-enabletransit.png
                    -

                    Fig. 105 Enable the feature#

                    +

                    Fig. 106 Enable the feature#

                    Enable all three Aviatrix Transit Gateways in Azure, GCP and AWS (us-east-2 only for now) for network segmentation as shown below:

                    ../_images/lab3-enabletransit2.png
                    -

                    Fig. 106 Enable Segmentation on the relevant Transit GWs#

                    +

                    Fig. 107 Enable Segmentation on the relevant Transit GWs#

                    @@ -410,7 +410,7 @@

                    4.2 Network Domains ../_images/lab3-networkdomain.png
                    -

                    Fig. 107 Network Domain Creation#

                    +

                    Fig. 108 Network Domain Creation#

                    Create two network domains (Green and Blue) and associate them to their respective Spokes as follows:

                    @@ -423,20 +423,20 @@

                    4.2 Network Domains ../_images/lab3-green.png
                    -

                    Fig. 108 Green network domain#

                    +

                    Fig. 109 Green network domain#

                    ../_images/lab3-blue.png
                    -

                    Fig. 109 Blue network domain#

                    +

                    Fig. 110 Blue network domain#

                    This is what the lab topology looks like after enabling network segmentation:

                    ../_images/lab3-topologywithnd.png
                    -

                    Fig. 110 Topology with Network Domains#

                    +

                    Fig. 111 Topology with Network Domains#

                    @@ -449,27 +449,27 @@

                    5.1. CoPilot Verification ../_images/lab3-verification.png
                    -

                    Fig. 111 Associations verification#

                    +

                    Fig. 112 Associations verification#

                    Go to CoPilot > Cloud Fabric > Gateways > Transit Gateways and select the Transit Gateway aws-us-east-2-transit:

                    ../_images/lab3-exploretransit.png
                    -

                    Fig. 112 Select Transit in US-East-2#

                    +

                    Fig. 113 Select Transit in US-East-2#

                    Then select the "Gateway Routes" tab and inspect the routing table of the network domain Green, likewise the routing table of the network domain Blue:

                    ../_images/lab3-exploregreen.png
                    -

                    Fig. 113 Explore Green#

                    +

                    Fig. 114 Explore Green#

                    ../_images/lab3-exploreblue.png
                    -

                    Fig. 114 Explore Blue#

                    +

                    Fig. 115 Explore Blue#

                    Go to CoPilot > Networking > Network Segmentation > Overview > Logical View

                    @@ -477,7 +477,7 @@

                    5.1. CoPilot Verification ../_images/lab3-logicalview.png
                    -

                    Fig. 115 Logical View#

                    +

                    Fig. 116 Logical View#

                    Open three terminal windows and SSH to the test instances/VMs in each cloud and ping the private IPs of each other to test the Multicloud connectivity (Refer to pod info).

                    @@ -487,7 +487,7 @@

                    5.1. CoPilot Verification ../_images/lab3-ping1.png
                    -

                    Fig. 116 Ping test from AWS#

                    +

                    Fig. 117 Ping test from AWS#

                    Azure:

                    @@ -495,7 +495,7 @@

                    5.1. CoPilot Verification ../_images/lab3-ping2.png
                    -

                    Fig. 117 Ping test from Azure#

                    +

                    Fig. 118 Ping test from Azure#

                    GCP:

                    @@ -503,7 +503,7 @@

                    5.1. CoPilot Verification ../_images/lab3-ping3.png
                    -

                    Fig. 118 Ping test from GCP#

                    +

                    Fig. 119 Ping test from GCP#

                    @@ -519,14 +519,14 @@

                    6. Connection Policy ../_images/lab3-editnd.png
                    -

                    Fig. 119 Edit Blue#

                    +

                    Fig. 120 Edit Blue#

                    Select the appropriate option from the "Connect to Network Domain" pull-down menu (Green shown here). Then click Save:

                    ../_images/lab3-applycp.png
                    -

                    Fig. 120 Apply the Connection Policy#

                    +

                    Fig. 121 Apply the Connection Policy#

                    @@ -536,7 +536,7 @@

                    6.1. Verification of Connection Policy ../_images/lab3-cpnew.png
                    -

                    Fig. 121 Logical View with the connection policy#

                    +

                    Fig. 122 Logical View with the connection policy#

                    Retest the connectivity; now you will have end-to-end connectivity across the multicloud environment.

                    @@ -545,7 +545,7 @@

                    6.1. Verification of Connection Policy ../_images/lab3-newtest.png
                    -

                    Fig. 122 New Test from AWS#

                    +

                    Fig. 123 New Test from AWS#

                    Azure:

                    @@ -553,7 +553,7 @@

                    6.1. Verification of Connection Policy ../_images/lab3-newtest2.png
                    -

                    Fig. 123 New Test from Azure#

                    +

                    Fig. 124 New Test from Azure#

                    GCP:

                    @@ -561,14 +561,14 @@

                    6.1. Verification of Connection Policy ../_images/lab3-newtest3.png
                    -

                    Fig. 124 New Test from GCP#

                    +

                    Fig. 125 New Test from GCP#

                    After this lab, this is how the overall topology would look like:

                    ../_images/lab3-finaltopology.png
                    -

                    Fig. 125 Final topology for Lab 3#

                    +

                    Fig. 126 Final topology for Lab 3#

                    diff --git a/docs/ace-pro/docs/lab4.html b/docs/ace-pro/docs/lab4.html index afcbf510..799373a2 100644 --- a/docs/ace-pro/docs/lab4.html +++ b/docs/ace-pro/docs/lab4.html @@ -392,7 +392,7 @@

                    3. Topology ../_images/lab5-topology.png
                    -

                    Fig. 126 Lab 5 Topology#

                    +

                    Fig. 127 Lab 5 Topology#

                    @@ -412,7 +412,7 @@

                    4.1. CoPilot View before starting ../_images/lab5-topologycopilot.png
                    -

                    Fig. 127 CoPilot view#

                    +

                    Fig. 128 CoPilot view#

                    @@ -422,14 +422,14 @@

                    4.2. Transit-Spoke Attachment ../_images/lab5-editspoke.png
                    -

                    Fig. 128 Edit Spoke US-East-1#

                    +

                    Fig. 129 Edit Spoke US-East-1#

                    Select the Transit Gateway aws-us-east-1-transit from the drop-down window "Attach To Transit Gateway", and then click on Save.

                    ../_images/lab5-editspoke2.png
                    -

                    Fig. 129 Attachment#

                    +

                    Fig. 130 Attachment#

                    @@ -445,7 +445,7 @@

                    4.3. CoPilot View after Transit-Spoke Attachment ../_images/lab5-copilotview.png
                    -

                    Fig. 130 Attachment on the CoPilot#

                    +

                    Fig. 131 Attachment on the CoPilot#

                    @@ -465,14 +465,14 @@

                    4.4. Transit Peerings Configuration ../_images/lab5-peering.png
                    -

                    Fig. 131 Edit Transit in US-EAST-1#

                    +

                    Fig. 132 Edit Transit in US-EAST-1#

                    Select the Transit Gateway aws-us-east-2-transit from the drop-down window "Peer To Transit Gateways", and then click on Save.

                    ../_images/lab5-peering2.png
                    -

                    Fig. 132 Peering#

                    +

                    Fig. 133 Peering#

                    @@ -486,7 +486,7 @@

                    4.4.1. Transit Peerings Verification ../_images/lab5-hpe.png
                    -

                    Fig. 133 HPE in action#

                    +

                    Fig. 134 HPE in action#

                    @@ -497,14 +497,14 @@

                    4.4.1. Transit Peerings Verification ../_images/lab5-topologyview.png
                    -

                    Fig. 134 Logical Topology View#

                    +

                    Fig. 135 Logical Topology View#

                    This is the topology view from CoPilot at this stage:

                    ../_images/lab5-peeringdrawing.png
                    -

                    Fig. 135 CoPilot Topology View#

                    +

                    Fig. 136 CoPilot Topology View#

                    @@ -522,14 +522,14 @@

                    5.1. CoPilot Verification of the VPC Peerings(Transit-Transit and Spoke-Tran
                    ../_images/lab5-native0.png
                    -

                    Fig. 136 Native Peerings#

                    +

                    Fig. 137 Native Peerings#

                    Click on any VPC peerings to expand its properties on the right side.

                    ../_images/lab5-native.png
                    -

                    Fig. 137 Native Peerings Properties#

                    +

                    Fig. 138 Native Peerings Properties#

                    @@ -541,7 +541,7 @@

                    5.2. CoPilot Verification of HPE ../_images/lab5-ipip.png
                    -

                    Fig. 138 Interface Stats#

                    +

                    Fig. 139 Interface Stats#

                    @@ -558,13 +558,13 @@

                    6.1. CoPilot Verification of ActiveMesh ../_images/lab5-filter.png
                    -

                    Fig. 139 Filter#

                    +

                    Fig. 140 Filter#

                    ../_images/lab5-summary.png
                    -

                    Fig. 140 RFC1918 routes pointing towards the First Spoke GW#

                    +

                    Fig. 141 RFC1918 routes pointing towards the First Spoke GW#

                    Now remove the previous filter and select aws-us-east-1-spoke1-Public-2-us-east-1b-rtb.

                    @@ -575,13 +575,13 @@

                    6.1. CoPilot Verification of ActiveMesh ../_images/lab5-filter2.png
                    -

                    Fig. 141 Filter#

                    +

                    Fig. 142 Filter#

                    ../_images/lab5-summary2.png
                    -

                    Fig. 142 RFC1918 routes pointing towards the Second Spoke GW#

                    +

                    Fig. 143 RFC1918 routes pointing towards the Second Spoke GW#

                    As you can see, Active/Active is achieved within a VPC as well. Each gateway is active on the Availability Zone where it resides.

                    @@ -591,7 +591,7 @@

                    6.1. CoPilot Verification of ActiveMesh ../_images/lab4-removefilter.png
                    -

                    Fig. 143 Remove the filter#

                    +

                    Fig. 144 Remove the filter#

                    @@ -606,7 +606,7 @@

                    6.2. Connectivity test of ActiveMesh (Pt.1) ../_images/lab5-new8.png
                    -

                    Fig. 144 From US-EAST-1 to US-EAST-2#

                    +

                    Fig. 145 From US-EAST-1 to US-EAST-2#

                    It will fail. WHY? Because we didn’t enable segmentation on aws-us-east-1-transit and associate aws-us-east-1-spoke1 with the transit gateway in the appropriate network domain.

                    @@ -617,7 +617,7 @@

                    6.2.1 Enable Segmentation ../_images/lab5-enable.png
                    -

                    Fig. 145 Enable Segmentation#

                    +

                    Fig. 146 Enable Segmentation#

                    @@ -628,14 +628,14 @@

                    6.2.2. Associate Aviatrix Spoke to the Network Domain ../_images/lab5-green.png
                    -

                    Fig. 146 Association#

                    +

                    Fig. 147 Association#

                    At this point, this is how the overall topology would look like:

                    ../_images/lab5-topologyview22.png
                    -

                    Fig. 147 New Logical Topology View#

                    +

                    Fig. 148 New Logical Topology View#

                    @@ -646,26 +646,26 @@

                    6.3. Connectivity test of ActiveMesh (Pt.2) ../_images/lab5-new.png
                    -

                    Fig. 148 Instances are now in the same Segment!#

                    +

                    Fig. 149 Instances are now in the same Segment!#

                    ../_images/lab5-ping1.png
                    -

                    Fig. 149 ping from aws-us-east-1-spoke1-test1#

                    +

                    Fig. 150 ping from aws-us-east-1-spoke1-test1#

                    Repeat the ping from the aws-us-east-1-spoke1-test2 in AWS US-East1 towards aws-us-east-2-spoke1-test1 in AWS US-East2.

                    ../_images/lab5-new2.png
                    -

                    Fig. 150 Second ping#

                    +

                    Fig. 151 Second ping#

                    ../_images/lab5-ping2.png
                    -

                    Fig. 151 ping from aws-us-east-1-spoke1-test2#

                    +

                    Fig. 152 ping from aws-us-east-1-spoke1-test2#

                    @@ -680,7 +680,7 @@

                    6.3. Connectivity test of ActiveMesh (Pt.2) ../_images/lab5-activemeshha.png
                    -

                    Fig. 152 Disable “Gateway Single AZ HA +

                    Fig. 153 Disable “Gateway Single AZ HA “#

                    @@ -694,41 +694,41 @@

                    6.3. Connectivity test of ActiveMesh (Pt.2) ../_images/lab5-newone.png
                    -

                    Fig. 153 AWS URL and credentials#

                    +

                    Fig. 154 AWS URL and credentials#

                    ../_images/lab5-awsconsole.png
                    -

                    Fig. 154 AWS console#

                    +

                    Fig. 155 AWS console#

                    Change the region to N. Virginia and invoke EC2 service.

                    ../_images/lab5-region.png
                    -

                    Fig. 155 Change the Region#

                    +

                    Fig. 156 Change the Region#

                    Click on Instances (running):

                    ../_images/lab5-running.png
                    -

                    Fig. 156 Instances running#

                    +

                    Fig. 157 Instances running#

                    Search for aviatrix-aws-us-east-1-spoke1, select the instance and then choose Instance state > Stop instance

                    ../_images/lab5-stop.png
                    -

                    Fig. 157 Stop the Instance#

                    +

                    Fig. 158 Stop the Instance#

                    Confirm by clicking on Stop, one more time.

                    ../_images/lab5-stop2.png
                    -

                    Fig. 158 Confirm the stop#

                    +

                    Fig. 159 Confirm the stop#

                    You will notice ping drops solely from aws-us-east-1-spoke1-test1. The traffic will reconverge to the spoke gateway in the other AZ, in about 1 minute and 30 seconds to 2 minutes.

                    @@ -736,21 +736,21 @@

                    6.3. Connectivity test of ActiveMesh (Pt.2) ../_images/lab5-drop.png
                    -

                    Fig. 159 Temporary disruption with FAST keepalive!#

                    +

                    Fig. 160 Temporary disruption with FAST keepalive!#

                    Bonus Step: Restart the Gateway from the AWS console and reverify the traffic flow. This time you will notice any kind of disruption: the traffic flow fill switch back to the aviatrix-aws-us-east-1-spoke1 GW.

                    ../_images/lab5-restart.png
                    -

                    Fig. 160 Restart#

                    +

                    Fig. 161 Restart#

                    After this lab, this is how the overall topology would look like:

                    ../_images/lab5-finaltopo.png
                    -

                    Fig. 161 Final Topology for Lab 5#

                    +

                    Fig. 162 Final Topology for Lab 5#

                    @@ -768,7 +768,7 @@

                    7. FlightPath ../_images/lab5-flightpath.png
                    -

                    Fig. 162 FlightPath config#

                    +

                    Fig. 163 FlightPath config#

                    This will provide an AppIQ report of how aws-us-east-1-spoke1-test1 is connected with aws-us-east-2-spoke1-test1 and display the path along with end-to-end latency.

                    @@ -779,7 +779,7 @@

                    7. FlightPath ../_images/lab5-flight2.png
                    -

                    Fig. 163 FlightPath Report#

                    +

                    Fig. 164 FlightPath Report#

                    Scroll down to get more details about:

                    @@ -795,7 +795,7 @@

                    7. FlightPath ../_images/lab5-download.png
                    -

                    Fig. 164 FlightPath Report PDF#

                    +

                    Fig. 165 FlightPath Report PDF#

                    @@ -812,7 +812,7 @@

                    Gateway Keepalive Templates ../_images/lab5-keepalive.png
                    -

                    Fig. 165 Keep Alive Speed#

                    +

                    Fig. 166 Keep Alive Speed#

                    diff --git a/docs/ace-pro/docs/lab5.html b/docs/ace-pro/docs/lab5.html index 275a47cd..6ccb2366 100644 --- a/docs/ace-pro/docs/lab5.html +++ b/docs/ace-pro/docs/lab5.html @@ -384,7 +384,7 @@

                    2. Topology ../_images/lab6-initialtopology.png
                    -

                    Fig. 166 Lab 6 Initial Topology#

                    +

                    Fig. 167 Lab 6 Initial Topology#

                    The VPC aws-us-east-2-spoke1 has a private subnet in its environment, whereby the Egress Control can be activated in this specific VPC.

                    @@ -398,13 +398,13 @@

                    2. Topology ../_images/lab6-spokegw.png
                    -

                    Fig. 167 Select the Spoke GW in US-EAST-2#

                    +

                    Fig. 168 Select the Spoke GW in US-EAST-2#

                    ../_images/lab6-vpc.png
                    -

                    Fig. 168 Check the private RTB#

                    +

                    Fig. 169 Check the private RTB#

                    You will notice that any private RTBs has its own CIDR pointing to local and the three RFC1918 routes pointing to the Aviatrix Spoke Gateway.

                    @@ -418,7 +418,7 @@

                    3. SSH to the EC2 instance in the Private Subnet ../_images/lab6-publicip.png
                    -

                    Fig. 169 SSH to aws-us-east-2-spoke1-test1#

                    +

                    Fig. 170 SSH to aws-us-east-2-spoke1-test1#

                      @@ -427,7 +427,7 @@

                      3. SSH to the EC2 instance in the Private Subnet ../_images/lab6-ssh.png
                      -

                      Fig. 170 From test1 to test2#

                      +

                      Fig. 171 From test1 to test2#

                      @@ -441,7 +441,7 @@

                      3. SSH to the EC2 instance in the Private Subnet ../_images/lab6-retrieve.png
                      -

                      Fig. 171 Retrieve the private IP#

                      +

                      Fig. 172 Retrieve the private IP#

                      @@ -457,13 +457,13 @@

                      4.1 Enable the Egress Control ../_images/lab6-egress.png
                      -

                      Fig. 172 Enable Local Egress#

                      +

                      Fig. 173 Enable Local Egress#

                      ../_images/lab6-vpcegress.png
                      -

                      Fig. 173 Choose the correct VPC#

                      +

                      Fig. 174 Choose the correct VPC#

                      @@ -485,7 +485,7 @@

                      4.2 Inspect the Private RTB ../_images/lab6-defaultroute.png
                      -

                      Fig. 174 Default route has been injected#

                      +

                      Fig. 175 Default route has been injected#

                      @@ -511,7 +511,7 @@

                      4.3 Generate Traffic ../_images/lab6-generatetraffic.png
                      -

                      Fig. 175 Generate traffic#

                      +

                      Fig. 176 Generate traffic#

                      Let’s now check whether the Spoke Gateway could gather NetFlow data after generating the aforementioned curl commands, or not.

                      @@ -519,7 +519,7 @@

                      4.3 Generate Traffic ../_images/lab6-nodatafound.png
                      -

                      Fig. 176 No Data Found#

                      +

                      Fig. 177 No Data Found#

                      You will notice the Message "No Data Found". You have successfully activated your egress control without disrupting anything that is sitting on the private subnet, nevertheless, if you want to get the NetFlow information, you need to apply a Distributed Cloud Firewall RULE, such that you can start evaluate the behaviour of the Private Subnet and get a good understanding of what domains have been reached out from the private subnet.

                      @@ -537,19 +537,19 @@

                      4.4 Enable DCF ../_images/lab6-activate.png
                      -

                      Fig. 177 Enable Distributed Cloud Firewall#

                      +

                      Fig. 178 Enable Distributed Cloud Firewall#

                      ../_images/lab6-newjoe.png
                      -

                      Fig. 178 Begin using Distributed Cloud Firewall#

                      +

                      Fig. 179 Begin using Distributed Cloud Firewall#

                      ../_images/lab6-newjoe2.png
                      -

                      Fig. 179 Begin#

                      +

                      Fig. 180 Begin#

                      After having enabled the DCF, two Rules will get generated, automatically:

                      @@ -561,7 +561,7 @@

                      4.4 Enable DCF ../_images/lab6-greenfield.png
                      -

                      Fig. 180 Automatic rules injected by the Controller#

                      +

                      Fig. 181 Automatic rules injected by the Controller#

                      @@ -570,7 +570,7 @@

                      4.4.1 Identify the subnet where the private workload resides ../_images/lab6-greenfieldneww.png
                      -

                      Fig. 181 Private Subnet#

                      +

                      Fig. 182 Private Subnet#

                      Go to CoPilot > Cloud Resources > Cloud Assets > Virtual Machines and search for the aws-us-east-2-spoke1-test2 instance on the search field on the right-hand side.

                      @@ -578,7 +578,7 @@

                      4.4.1 Identify the subnet where the private workload resides ../_images/lab6-greenfieldneww2.png
                      -

                      Fig. 182 AZ#

                      +

                      Fig. 183 AZ#

                      Now that you know in what Availability Zone the private workload resides, you need to select the VPC/VNets & Subnets TAB and filter out based on the aws-us-east-2-spoke1 VPC.

                      @@ -586,7 +586,7 @@

                      4.4.1 Identify the subnet where the private workload resides ../_images/lab6-greenfieldneww3.png
                      -

                      Fig. 183 Private Subnet#

                      +

                      Fig. 184 Private Subnet#

                      @@ -596,14 +596,14 @@

                      4.4.2 Create an Ad-Hoc SmartGroup ../_images/lab6-newsg.png
                      -

                      Fig. 184 SmartGroup#

                      +

                      Fig. 185 SmartGroup#

                      Afterwards, click on the arrow icon inside the "+ Resource Type" button and select "IP / CIDRs".

                      ../_images/lab6-greenfieldneww4.png
                      -

                      Fig. 185 Private Subnet#

                      +

                      Fig. 186 Private Subnet#

                      Ensure these parameters are entered in the pop-up window "Create SmartGroup":

                      @@ -615,7 +615,7 @@

                      4.4.2 Create an Ad-Hoc SmartGroup ../_images/lab6-greenfieldneww45.png
                      -

                      Fig. 186 New SG#

                      +

                      Fig. 187 New SG#

                      @@ -625,7 +625,7 @@

                      4.4.3 Create a new Rule ../_images/lab6-newrule10.png
                      -

                      Fig. 187 New Rule#

                      +

                      Fig. 188 New Rule#

                      Insert the following parameters

                      @@ -643,7 +643,7 @@

                      4.4.3 Create a new Rule ../_images/lab6-new.png
                      -

                      Fig. 188 Saving the new Rule#

                      +

                      Fig. 189 Saving the new Rule#

                      Click on the Commit button and the rule previously created will work in watch/test mode due to the fact that the enforcement was turn off.

                      @@ -654,7 +654,7 @@

                      4.4.3 Create a new Rule ../_images/lab6-newrule11.png
                      -

                      Fig. 189 Egress-Rule#

                      +

                      Fig. 190 Egress-Rule#

                      Now delete the Greenfield-Rule:

                      @@ -669,13 +669,13 @@

                      4.4.3 Create a new Rule ../_images/lab6-newruledelete.png
                      -

                      Fig. 190 Deletion of the Greenfield-Rule#

                      +

                      Fig. 191 Deletion of the Greenfield-Rule#

                      ../_images/lab6-newruledeleted.png
                      -

                      Fig. 191 Egress-Rule solely#

                      +

                      Fig. 192 Egress-Rule solely#

                        @@ -697,7 +697,7 @@

                        4.4.3 Create a new Rule ../_images/lab6-monitorpermit.png
                        -

                        Fig. 192 Monitor#

                        +

                        Fig. 193 Monitor#

                        @@ -707,7 +707,7 @@

                        4.4.3 Create a new Rule ../_images/lab6-monitorpermit22.png
                        -

                        Fig. 193 SSH client outputs#

                        +

                        Fig. 194 SSH client outputs#

                        Go to CoPilot > Security > Egress > Overview (default)

                        @@ -715,14 +715,14 @@

                        4.4.3 Create a new Rule ../_images/lab6-newrul12.png
                        -

                        Fig. 194 Overview#

                        +

                        Fig. 195 Overview#

                        Furthermore, go to CoPilot > Security > Egress > Monitor and from the "VPC/VNets" drop-down window, select the aws-us-east-2-spoke1 VPC.

                        ../_images/lab6-monitor.png
                        -

                        Fig. 195 Monitor#

                        +

                        Fig. 196 Monitor#

                        You will get a granular Layer 7 visibility that allows you to get a good understanding of how the egress traffic has been consumed and also allows you to help make decisions on how to potentially optimize that.

                        @@ -738,7 +738,7 @@

                        5.1 Create a New WebGroup ../_images/lab6-webgroup.png
                        -

                        Fig. 196 +WebGroup#

                        +

                        Fig. 197 +WebGroup#

                        Create a WebGroup with the following parameters:

                        @@ -752,7 +752,7 @@

                        5.1 Create a New WebGroup ../_images/lab6-webgroup2.png
                        -

                        Fig. 197 WebGroup creation#

                        +

                        Fig. 198 WebGroup creation#

                        @@ -773,13 +773,13 @@

                        5.2.1 Enforce the Egress-Rule ../_images/lab6-webgroup234.png
                        -

                        Fig. 198 Editing the Egress-Rule#

                        +

                        Fig. 199 Editing the Egress-Rule#

                        ../_images/lab6-webgroup2345.png
                        -

                        Fig. 199 Commit the changes#

                        +

                        Fig. 200 Commit the changes#

                        @@ -793,14 +793,14 @@

                        5.2.1 Enforce the Egress-Rule ../_images/lab6-webgroup23456.png
                        -

                        Fig. 200 Egress-Rule + DefaultDenyAll#

                        +

                        Fig. 201 Egress-Rule + DefaultDenyAll#

                        However, this rule is NOT editable, therefore any matches against the DefaultDenyRule will not generate any logs.

                        ../_images/lab6-defaultdenyall01.png
                        -

                        Fig. 201 Not editable#

                        +

                        Fig. 202 Not editable#

                        @@ -810,7 +810,7 @@

                        5.2.2 Create an ad-hoc Explicit-Deny-Rule ../_images/lab6-defaultdenyall02.png
                        -

                        Fig. 202 Not editable#

                        +

                        Fig. 203 Not editable#

                        Insert the following parameters

                        @@ -833,14 +833,14 @@

                        5.2.2 Create an ad-hoc Explicit-Deny-Rule ../_images/lab6-defaultdenyall03.png
                        -

                        Fig. 203 Editable Explicit-Deny-Rule#

                        +

                        Fig. 204 Editable Explicit-Deny-Rule#

                        Do not forget to click on Commit.

                        ../_images/lab6-defaultdenyall04.png
                        -

                        Fig. 204 Commit your changes#

                        +

                        Fig. 205 Commit your changes#

                        Now you have effectively activated the ZTNA approach.

                        @@ -853,7 +853,7 @@

                        5.3 Test the modified rule ../_images/lab6-defaultdenyall06.png
                        -

                        Fig. 205 Auto Refresh#

                        +

                        Fig. 206 Auto Refresh#

                        @@ -941,14 +941,14 @@

                        6.2 Prepare the simulator ../_images/lab6-sudo.png
                        -

                        Fig. 211 Commands issued#

                        +

                        Fig. 212 Commands issued#

                        The last command will show up a simulator from whom you will be able to launch an attack for testing the "Suricata IDS".

                        ../_images/lab6-suricata.png
                        -

                        Fig. 212 Simulator#

                        +

                        Fig. 213 Simulator#

                        @@ -960,7 +960,7 @@

                        6.3 Test the New Rule and the IDS feature ../_images/lab6-suricataedit.png
                        -

                        Fig. 213 Edit existing rule#

                        +

                        Fig. 214 Edit existing rule#

                        Insert the following parameters and do not forget to click on Save In Drafts:

                        @@ -971,21 +971,21 @@

                        6.3 Test the New Rule and the IDS feature ../_images/lab6-dns.png
                        -

                        Fig. 214 Modify the rule#

                        +

                        Fig. 215 Modify the rule#

                        Now click on the Commit button.

                        ../_images/lab6-commit3.png
                        -

                        Fig. 215 Commit#

                        +

                        Fig. 216 Commit#

                        From the EC2 instance aws-us-east-2-spoke1-test2, type 5 and click enter for launching a malicious attack, specifically the attack will try to establish a connection towards a TOR server.

                        ../_images/lab6-5.png
                        -

                        Fig. 216 Malicious known attack#

                        +

                        Fig. 217 Malicious known attack#

                        Now go to CoPilot > Security > Distributed Cloud Firewall > Detected Intrusions, and you will be able to find indicators that detected that attempt to contact a TOR server, through a DNS request.

                        @@ -996,14 +996,14 @@

                        6.3 Test the New Rule and the IDS feature ../_images/lab6-refresh.png
                        -

                        Fig. 217 Detected Intrusions#

                        +

                        Fig. 218 Detected Intrusions#

                        Click on any Timestamps to get additional insight on that specific attack.

                        ../_images/lab6-final.png
                        -

                        Fig. 218 Additional insights#

                        +

                        Fig. 219 Additional insights#

                        @@ -1014,7 +1014,7 @@

                        6.3 Test the New Rule and the IDS feature ../_images/lab6-finaltopo.png
                        -

                        Fig. 219 Final Topology for Lab 5#

                        +

                        Fig. 220 Final Topology for Lab 5#

                        diff --git a/docs/ace-pro/docs/lab6.html b/docs/ace-pro/docs/lab6.html index 367b19dc..5d0e688a 100644 --- a/docs/ace-pro/docs/lab6.html +++ b/docs/ace-pro/docs/lab6.html @@ -377,7 +377,7 @@

                        3. Topology ../_images/lab7-topology.png
                        -

                        Fig. 220 Lab 7 Initial Topology#

                        +

                        Fig. 221 Lab 7 Initial Topology#

                        @@ -390,7 +390,7 @@

                        4.1. Azure Transit to Spoke Peering ../_images/lab7-spoke.png
                        -

                        Fig. 221 Edit Spoke GW#

                        +

                        Fig. 222 Edit Spoke GW#

                        Attach azure-west-us-spoke2 (pre-configured VNet) to azure-west-us-transit as shown below. @@ -398,7 +398,7 @@

                        4.1. Azure Transit to Spoke Peering ../_images/lab7-attachment.png
                        -

                        Fig. 222 Attachment#

                        +

                        Fig. 223 Attachment#

                        @@ -421,7 +421,7 @@

                        4.2. PAN Firewall Deployment ../_images/lab7-firenetbutton.png
                        -

                        Fig. 223 FireNet#

                        +

                        Fig. 224 FireNet#

                        Deploy a Firewall by entering these settings within the Deploy Firewall window:

                        @@ -437,7 +437,7 @@

                        4.2. PAN Firewall Deployment ../_images/lab7-marketplace.png
                        -

                        Fig. 224 Marketplace contact under loading#

                        +

                        Fig. 225 Marketplace contact under loading#

                          @@ -457,13 +457,13 @@

                          4.2. PAN Firewall Deployment ../_images/lab7-newone.png
                          -

                          Fig. 225 POD Portal: lab 7 section#

                          +

                          Fig. 226 POD Portal: lab 7 section#

                          ../_images/lab7-firenetcfg.png
                          -

                          Fig. 226 Firenet Deployment Template#

                          +

                          Fig. 227 Firenet Deployment Template#

                          @@ -473,7 +473,7 @@

                          4.2. PAN Firewall Deployment ../_images/lab7-inprogress.png
                          -

                          Fig. 227 Deployment in progress#

                          +

                          Fig. 228 Deployment in progress#

                          At this time, the interface mapping, security policy configuration, and RFC1918 static route creation are all being handled. The Aviatrix Controller does a lot of magic in orchestrating and manipulating route tables.

                          @@ -481,7 +481,7 @@

                          4.2. PAN Firewall Deployment ../_images/lab7-url.png
                          -

                          Fig. 228 Deployment completed#

                          +

                          Fig. 229 Deployment completed#

                          Even after that message, it doesn’t mean you can access the firewall (i.e. URL). Within 5-10 minutes after you receive confirmation about the firewall being created, you should be able to access it.

                          @@ -494,7 +494,7 @@

                          4.3. Firewall Configuration ../_images/lab7-paloalto.png
                          -

                          Fig. 229 PaloAlto Welcome page#

                          +

                          Fig. 230 PaloAlto Welcome page#

                          Dismiss the Welcome splash screen. This is an indication that the firewall is ready.

                          @@ -506,7 +506,7 @@

                          4.4. Firewall Vendor Integration ../_images/lab7-vendor.png
                          -

                          Fig. 230 Vendor Integration#

                          +

                          Fig. 231 Vendor Integration#

                          Insert the following paramenters in the "Vendor Integration" pop-up window.

                          @@ -520,7 +520,7 @@

                          4.4. Firewall Vendor Integration ../_images/lab7-vendor2.png
                          -

                          Fig. 231 Vendor Integration template#

                          +

                          Fig. 232 Vendor Integration template#

                          @@ -530,28 +530,28 @@

                          4.4. Firewall Vendor Integration ../_images/lab7-message.png
                          -

                          Fig. 232 Possible error message#

                          +

                          Fig. 233 Possible error message#

                          ../_images/lab7-vendor3.png
                          -

                          Fig. 233 Vendor Integration accomplished successfully#

                          +

                          Fig. 234 Vendor Integration accomplished successfully#

                          Go to CoPilot > Security > FireNet > Firewall and click on the azure-west-us-pan firewall

                          ../_images/lab7-vendor4.png
                          -

                          Fig. 234 Click on the Firewall#

                          +

                          Fig. 235 Click on the Firewall#

                          You will see the RFC 1918 routes that the Controller automatically programmed on the Firewall, through the "Vendor Integration". Notice how each RFC1918 route has a prefix of "AVX-" to show that it is programmed by Aviatrix.

                          ../_images/lab7-vendor5.png
                          -

                          Fig. 235 Vendor Integration outcome#

                          +

                          Fig. 236 Vendor Integration outcome#

                          @@ -566,14 +566,14 @@

                          4.5. Verify Routes Installed on Firewall ../_images/lab7-palo1.png
                          -

                          Fig. 236 PaloAlto dashboard#

                          +

                          Fig. 237 PaloAlto dashboard#

                          Click on "Static Routes" tab. You should be able to see the same RFC 1918 routes with "AVX-" prefixes that were programmed by the Aviatrix Controller.

                          ../_images/lab7-palo2.png
                          -

                          Fig. 237 Static Routes (RFC1918 routes)#

                          +

                          Fig. 238 Static Routes (RFC1918 routes)#

                          @@ -587,20 +587,20 @@

                          4.6. FireNet Policy ../_images/lab7-inspection2.png
                          -

                          Fig. 238 Policy tab#

                          +

                          Fig. 239 Policy tab#

                          Then select each Azure spoke gateway one by one, click on "Actions" and choose "Add" in order to add a specific VPC inside the Inspection Policy.

                          ../_images/lab7-inspection3.png
                          -

                          Fig. 239 Inspection Policy assignment#

                          +

                          Fig. 240 Inspection Policy assignment#

                          ../_images/lab7-inspection4.png
                          -

                          Fig. 240 Inspection Policy accomplished#

                          +

                          Fig. 241 Inspection Policy accomplished#

                          @@ -610,7 +610,7 @@

                          5. Verification ../_images/lab7-topology2.png
                          -

                          Fig. 241 Lab 7 Topology with FW deployed and the Inspection Policy applied!#

                          +

                          Fig. 242 Lab 7 Topology with FW deployed and the Inspection Policy applied!#

                          @@ -622,7 +622,7 @@

                          5.1. Inside Azure ../_images/lab7-editnd.png
                          -

                          Fig. 242 Edit Green#

                          +

                          Fig. 243 Edit Green#

                          Select the gateway azure-west-us-spoke2 from the drop-down window, selecting the "Associations" field.

                          @@ -630,14 +630,14 @@

                          5.1. Inside Azure ../_images/lab7-nd2.png
                          -

                          Fig. 243 Association#

                          +

                          Fig. 244 Association#

                          After this step, this is how the topology should look like:

                          ../_images/lab7-finaltopology.png
                          -

                          Fig. 244 Lab 7 Final Topology#

                          +

                          Fig. 245 Lab 7 Final Topology#

                          @@ -654,7 +654,7 @@

                          5.1. Inside Azure ../_images/lab7-dcfrule.png
                          -

                          Fig. 245 DCF rules#

                          +

                          Fig. 246 DCF rules#

                            @@ -667,7 +667,7 @@

                            5.1. Inside Azure ../_images/lab7-top.png
                            -

                            Fig. 246 New Rule#

                            +

                            Fig. 247 New Rule#

                            Insert the following parameters

                            @@ -684,14 +684,14 @@

                            5.1. Inside Azure ../_images/lab7-edit.png
                            -

                            Fig. 247 Greenfield-Rule#

                            +

                            Fig. 248 Greenfield-Rule#

                            Once again do not forget to Commit your rule.

                            ../_images/lab7-newone2.png
                            -

                            Fig. 248 Commit the Greenfield-Rule#

                            +

                            Fig. 249 Commit the Greenfield-Rule#

                            @@ -700,7 +700,7 @@

                            5.1.1 Launch connectivity test ../_images/lab7-ping.png
                            -

                            Fig. 249 Ping is successful#

                            +

                            Fig. 250 Ping is successful#

                            @@ -714,7 +714,7 @@

                            5.1.1 Launch connectivity test ../_images/lab7-monitor2.png
                            -

                            Fig. 250 Monitor on the PaloAlto#

                            +

                            Fig. 251 Monitor on the PaloAlto#

                            Traffic is passing through firewall because azure-west-us-spoke1 and azure-west-us-spoke2 both are in the Inspection Policy.

                            @@ -725,7 +725,7 @@

                            5.1.1 Launch connectivity test ../_images/lab7-smallrefresh.png
                            -

                            Fig. 251 Ping GCP#

                            +

                            Fig. 252 Ping GCP#

                            @@ -736,7 +736,7 @@

                            5.2. Azure to GCP ../_images/lab7-pinggcp.png
                            -

                            Fig. 252 Ping GCP#

                            +

                            Fig. 253 Ping GCP#

                            This still matches the Allow-all firewall rule. Moreover, it works because of the Connection Policy we had configured in the Network Segmentation Lab.

                            @@ -744,7 +744,7 @@

                            5.2. Azure to GCP ../_images/lab7-finalmonitor.png
                            -

                            Fig. 253 Monitoring traffic towards GCP#

                            +

                            Fig. 254 Monitoring traffic towards GCP#

                            Now, let’s check the DCF Monitor section:

                            @@ -754,14 +754,14 @@

                            5.2. Azure to GCP ../_images/lab7-finalmonitor00.png
                            -

                            Fig. 254 Filter#

                            +

                            Fig. 255 Filter#

                            You will immediately notice the logs that have successfully matched the Greenfield-Rule.

                            ../_images/lab7-finalmonitor01.png
                            -

                            Fig. 255 Logs#

                            +

                            Fig. 256 Logs#

                            @@ -773,7 +773,7 @@

                            5.2. Azure to GCP ../_images/lab7-finaltopology2.png
                            -

                            Fig. 256 Final Topology for Lab 6#

                            +

                            Fig. 257 Final Topology for Lab 6#

                            diff --git a/docs/ace-pro/docs/lab7.html b/docs/ace-pro/docs/lab7.html index dd4fc923..95fa6a77 100644 --- a/docs/ace-pro/docs/lab7.html +++ b/docs/ace-pro/docs/lab7.html @@ -369,7 +369,7 @@

                            3. Topology ../_images/lab8-topology.png
                            -

                            Fig. 257 Lab 8 Initial Topology#

                            +

                            Fig. 258 Lab 8 Initial Topology#

                            @@ -382,13 +382,13 @@

                            4.1. Site2Cloud Connection (Cloud to On-Prem) ../_images/lab8-edge1.png
                            -

                            Fig. 258 Existing S2C connection#

                            +

                            Fig. 259 Existing S2C connection#

                            ../_images/lab8-edge2.png
                            -

                            Fig. 259 BGPoverLAN#

                            +

                            Fig. 260 BGPoverLAN#

                            The S2C connection with Edge will be configured on the subsequent task.

                            @@ -396,7 +396,7 @@

                            4.1. Site2Cloud Connection (Cloud to On-Prem) ../_images/lab8-partner.png
                            -

                            Fig. 260 S2C between Partner and GCP#

                            +

                            Fig. 261 S2C between Partner and GCP#

                            Click on the "+ External Connection to" button and let’s create a new connection from scratch.

                            @@ -404,7 +404,7 @@

                            4.1. Site2Cloud Connection (Cloud to On-Prem) ../_images/lab8-s2c.png
                            -

                            Fig. 261 S2C creation#

                            +

                            Fig. 262 S2C creation#

                            Create a connection from Cloud (GCP) to an on-prem Partner site, using the following settings on the "Add External Connection" window:

                            @@ -428,7 +428,7 @@

                            4.1. Site2Cloud Connection (Cloud to On-Prem) ../_images/lab8-newone.png
                            -

                            Fig. 262 DNS Name of the StrongSwan router#

                            +

                            Fig. 263 DNS Name of the StrongSwan router#

                            @@ -440,7 +440,7 @@

                            4.1. Site2Cloud Connection (Cloud to On-Prem) ../_images/lab8-newdns.png
                            -

                            Fig. 263 Dig command in action#

                            +

                            Fig. 264 Dig command in action#

                            @@ -450,7 +450,7 @@

                            4.1. Site2Cloud Connection (Cloud to On-Prem) ../_images/lab8-nslookup.png
                            -

                            Fig. 264 Nslookup#

                            +

                            Fig. 265 Nslookup#

                            @@ -458,7 +458,7 @@

                            4.1. Site2Cloud Connection (Cloud to On-Prem) ../_images/lab8-s2ctemplate.png
                            -

                            Fig. 265 S2C template#

                            +

                            Fig. 266 S2C template#

                            @@ -481,13 +481,13 @@

                            4.2 Site2Cloud Connection - StrongSwan’s configuration ../_images/lab8-personalpod.png
                            -

                            Fig. 266 StrongSwan’s DNS name#

                            +

                            Fig. 267 StrongSwan’s DNS name#

                            ../_images/lab8-strong.png
                            -

                            Fig. 267 SSH#

                            +

                            Fig. 268 SSH#

                              @@ -502,7 +502,7 @@

                              4.2 Site2Cloud Connection - StrongSwan’s configuration ../_images/lab8-replace.png
                              -

                              Fig. 268 cfg file#

                              +

                              Fig. 269 cfg file#

                              Let’s retrieve the Public IP address assigned to the GCP Spoke Gateway.

                              @@ -510,7 +510,7 @@

                              4.2 Site2Cloud Connection - StrongSwan’s configuration ../_images/lab8-gcppublic.png
                              -

                              Fig. 269 Public IP address#

                              +

                              Fig. 270 Public IP address#

                              Now go back on the SSH session established with the StrongSwan router and instead of editig the cfg file manually, you are going to use a script for automatically updating the content of the coonfiguration file!

                              @@ -527,7 +527,7 @@

                              4.2 Site2Cloud Connection - StrongSwan’s configuration ../_images/lab8-bash.png
                              -

                              Fig. 270 sudo bash script#

                              +

                              Fig. 271 sudo bash script#

                              @@ -543,7 +543,7 @@

                              5. S2C - Verification ../_images/lab8-refresh.png
                              -

                              Fig. 271 Connection is up#

                              +

                              Fig. 272 Connection is up#

                              Go to CoPilot > Cloud Fabric > Topology > Overview (default TAB)

                              @@ -551,7 +551,7 @@

                              5. S2C - Verification ../_images/lab8-onprem.png
                              -

                              Fig. 272 OnPrem-Partner site#

                              +

                              Fig. 273 OnPrem-Partner site#

                              Now go back to your SSH terminal, and from the on-premises router’s console (i.e. StrongSwan), issue the following command to verify the connectivity with the gcp-us-central1-spoke1-test1:

                              @@ -565,28 +565,28 @@

                              5. S2C - Verification ../_images/lab8-pingok.png
                              -

                              Fig. 273 Ping ok#

                              +

                              Fig. 274 Ping ok#

                              Then go to CoPilot > Cloud Fabric > Topology > Overview (default TAB) and click on the icon of the Spoke Gateway gcp-us-central1-spoke1, click on the Tools button and then click on Gateway Diagnostics.

                              ../_images/lab8-diag.png
                              -

                              Fig. 274 Gateway Diagnostics#

                              +

                              Fig. 275 Gateway Diagnostics#

                              Choose the “Active Sessions” option and in the Search field type “icmp” and then click on Run. You will notice the subnets involved (i.e. real and virtual subnets) in the Mapped NAT.

                              ../_images/lab8-active2.png
                              -

                              Fig. 275 Active Sessions#

                              +

                              Fig. 276 Active Sessions#

                              After completing the S2C connection, this is what the overall lab topology would look like:

                              ../_images/lab8-finaltopology.png
                              -

                              Fig. 276 The Topology with the new S2C connection#

                              +

                              Fig. 277 The Topology with the new S2C connection#

                              diff --git a/docs/ace-pro/docs/lab8.html b/docs/ace-pro/docs/lab8.html index 427ab297..7f5660be 100644 --- a/docs/ace-pro/docs/lab8.html +++ b/docs/ace-pro/docs/lab8.html @@ -370,35 +370,35 @@

                              2. Initial set-up ../_images/lab8-edge3.png
                              -

                              Fig. 277 CoPilot BGP Map#

                              +

                              Fig. 278 CoPilot BGP Map#

                              You can notice both the AS numbers of each side of the connection and the /30 subnet used in the underlay.

                              ../_images/lab8-edge4.png
                              -

                              Fig. 278 BGPoverLAN inside the On-Prem DC#

                              +

                              Fig. 279 BGPoverLAN inside the On-Prem DC#

                              Close the BGP Map and then click again on the threee dots icon and this time select the "Show BGP Learned Routes".

                              ../_images/lab8-edge5.png
                              -

                              Fig. 279 Show BGP Learned Routes#

                              +

                              Fig. 280 Show BGP Learned Routes#

                              The LAN router is advertising 225 routes to the Aviatrix Edge.

                              ../_images/lab8-edge6.png
                              -

                              Fig. 280 225 Routes#

                              +

                              Fig. 281 225 Routes#

                              If you check also the "Show BGP Advertised Routes" outcome, you will notice that the Aviatrix Edge is not advertising any routes, because it is not connected to the MCNA yet!

                              ../_images/lab8-edge7.png
                              -

                              Fig. 281 No routes advertised by the Edge yet#

                              +

                              Fig. 282 No routes advertised by the Edge yet#

                              @@ -408,7 +408,7 @@

                              2.1. Attachment between Edge and the Transit ../_images/lab8-edge8.png
                              -

                              Fig. 282 Peerings not established yet!#

                              +

                              Fig. 283 Peerings not established yet!#

                              First and foremost, you have to configure a BGP ASN on the aws-us-east-2-transit GW!

                              @@ -416,14 +416,14 @@

                              2.1. Attachment between Edge and the Transit ../_images/lab8-edge12.png
                              -

                              Fig. 283 aws-us-east-2-transit#

                              +

                              Fig. 284 aws-us-east-2-transit#

                              Select the "Settings" tab and then expand the "Border Gateway Protocol (BGP)" section and insert the AS number 64513 on the empty field related to the “Local AS Number”, then click on Save.

                              ../_images/lab8-edge13.png
                              -

                              Fig. 284 BGP ASN#

                              +

                              Fig. 285 BGP ASN#

                              Now it’s time to establish the attachment!

                              @@ -431,14 +431,14 @@

                              2.1. Attachment between Edge and the Transit ../_images/lab8-edge9.png
                              -

                              Fig. 285 Manage Gateway Attachment#

                              +

                              Fig. 286 Manage Gateway Attachment#

                              Click on the "+Attachment" button.

                              ../_images/lab8-edge10.png
                              -

                              Fig. 286 Transit Gateway Attachment#

                              +

                              Fig. 287 Transit Gateway Attachment#

                              Fill in the attachment template using the following settings:

                              @@ -452,14 +452,14 @@

                              2.1. Attachment between Edge and the Transit ../_images/lab8-edge11.png
                              -

                              Fig. 287 Attachment creation template#

                              +

                              Fig. 288 Attachment creation template#

                              Wait for a bunch of seconds for the Aviatrix Controller to establish the attachment and then a message will pop up confirming that the operation has been accomplished, successfully!

                              ../_images/lab8-edge14.png
                              -

                              Fig. 288 Peering created#

                              +

                              Fig. 289 Peering created#

                              Let’s verify the presence of the attachment previously created on the Topology.

                              @@ -467,14 +467,14 @@

                              2.1. Attachment between Edge and the Transit ../_images/lab8-edge15.png
                              -

                              Fig. 289 New attachment#

                              +

                              Fig. 290 New attachment#

                              Go to CoPilot > Cloud Fabric > Gateways > Transit Gateways and click on the aws-us-east-2-transit cluster.

                              ../_images/lab8-edge16.png
                              -

                              Fig. 290 aws-us-east-2-transit#

                              +

                              Fig. 291 aws-us-east-2-transit#

                              Select the "Attachments" tab and then click on "Transit-Edge Peering".

                              @@ -482,14 +482,14 @@

                              2.1. Attachment between Edge and the Transit ../_images/lab8-edge17.png
                              -

                              Fig. 291 Transit-Edge Peering#

                              +

                              Fig. 292 Transit-Edge Peering#

                              This is how the Topology would look like after the creation of the attachment.

                              ../_images/lab8-edge18.png
                              -

                              Fig. 292 Attachment established!#

                              +

                              Fig. 293 Attachment established!#

                              @@ -505,14 +505,14 @@

                              3. Network Domain Association ../_images/lab8-edge19.png
                              -

                              Fig. 293 Network Domain Association#

                              +

                              Fig. 294 Network Domain Association#

                              You have successfully extended the Network Segmentation on top of the DC.

                              ../_images/lab8-newjoe.png
                              -

                              Fig. 294 The DC is now another VPC#

                              +

                              Fig. 295 The DC is now another VPC#

                              Let’s explore again the Cloud Routes section!

                              @@ -524,7 +524,7 @@

                              3. Network Domain Association ../_images/lab8-edge20.png
                              -

                              Fig. 295 BGP Advertised Routes#

                              +

                              Fig. 296 BGP Advertised Routes#

                              @@ -534,42 +534,42 @@

                              4. Edge: Connectivity Test ../_images/lab8-newjoe2.png
                              -

                              Fig. 296 BGP Advertised Routes#

                              +

                              Fig. 297 BGP Advertised Routes#

                              Go to your personal POD portal, scroll down untill your reach the Lab 8 section and click on the "Open Workstation" button.

                              ../_images/lab8-edgenew.png
                              -

                              Fig. 297 Workstation Edge access from the POD Portal#

                              +

                              Fig. 298 Workstation Edge access from the POD Portal#

                              Subsequently, insert the credentials available from the POD Portal.

                              ../_images/lab8-newjoe3.png
                              -

                              Fig. 298 Workstation Edge credentials#

                              +

                              Fig. 299 Workstation Edge credentials#

                              You will land on the Desktop of the Workstation Edge and from here launch the LX Terminal.

                              ../_images/lab8-newjoe4.png
                              -

                              Fig. 299 LX Terminal#

                              +

                              Fig. 300 LX Terminal#

                              Now execute the ping command towards the private IP address of the aws-us-east-2-spoke1-test1 instance (i.e. 10.0.1.100).

                              ../_images/lab8-edge22.png
                              -

                              Fig. 300 Target for the connectivity test#

                              +

                              Fig. 301 Target for the connectivity test#

                              The ping will be successful, this means that you have extended the Aviatrix MCNA to your on-prem DC, that ultimately can now be considered as just an additional VPC!

                              ../_images/lab8-edge30.png
                              -

                              Fig. 301 Ping#

                              +

                              Fig. 302 Ping#

                              @@ -586,13 +586,13 @@

                              5. Edge: FlowIQ ../_images/lab8-plus.png
                              -

                              Fig. 302 Create the filter#

                              +

                              Fig. 303 Create the filter#

                              ../_images/lab8-edge24.png
                              -

                              Fig. 303 FlowIQ Filter#

                              +

                              Fig. 304 FlowIQ Filter#

                              @@ -602,7 +602,7 @@

                              5. Edge: FlowIQ ../_images/lab8-refresh2.png
                              -

                              Fig. 304 Refresh#

                              +

                              Fig. 305 Refresh#

                              @@ -610,13 +610,13 @@

                              5. Edge: FlowIQ ../_images/lab8-newjoe6.png
                              -

                              Fig. 305 Widget#

                              +

                              Fig. 306 Widget#

                              ../_images/lab8-flowiq.png
                              -

                              Fig. 306 Aviatrix Gateway#

                              +

                              Fig. 307 Aviatrix Gateway#

                              @@ -631,7 +631,7 @@

                              6. Edge: “It’s more than a Spoke GW”” ../_images/lab8-edgedouble.png
                              -

                              Fig. 307 New Attachment towards GCP#

                              +

                              Fig. 308 New Attachment towards GCP#

                              Once again, you have to configure a BGP ASN on the gcp-us-central1-transit GW first, before deploying any new attachments.

                              @@ -639,14 +639,14 @@

                              6. Edge: “It’s more than a Spoke GW”” ../_images/lab8-edgedouble5.png
                              -

                              Fig. 308 gcp-us-central1-transit#

                              +

                              Fig. 309 gcp-us-central1-transit#

                              Select the "Settings" tab and then expand the "Border Gateway Protocol (BGP)" section and insert the AS number 64514 on the empty field related to the “Local AS Number”, then click on Save.

                              ../_images/lab8-edgedouble6.png
                              -

                              Fig. 309 BGP ASN#

                              +

                              Fig. 310 BGP ASN#

                              Now you are ready to proceed with the rest of the configuration on the Edge section!

                              @@ -654,7 +654,7 @@

                              6. Edge: “It’s more than a Spoke GW”” ../_images/lab8-edgedouble2.png
                              -

                              Fig. 310 Manage Gateway Attachment#

                              +

                              Fig. 311 Manage Gateway Attachment#

                              Now click on the "+ Attachment" button. @@ -662,7 +662,7 @@

                              6. Edge: “It’s more than a Spoke GW”” ../_images/lab8-edgedouble3.png
                              -

                              Fig. 311 New Attachment#

                              +

                              Fig. 312 New Attachment#

                              Fill in the attachment template using the following settings:

                              @@ -679,7 +679,7 @@

                              6. Edge: “It’s more than a Spoke GW”” ../_images/lab8-attachment01.png
                              -

                              Fig. 312 Edge Attachment Template#

                              +

                              Fig. 313 Edge Attachment Template#

                              Wait for 1 minute for the Aviatrix Controller to establish the attachment between the Edge and the GCP Transit Gateway.

                              @@ -687,7 +687,7 @@

                              6. Edge: “It’s more than a Spoke GW”” ../_images/lab8-edgedouble9.png
                              -

                              Fig. 313 Notification#

                              +

                              Fig. 314 Notification#

                              Let’s verify the presence of the new attachment previously created on the Topology.

                              @@ -695,7 +695,7 @@

                              6. Edge: “It’s more than a Spoke GW”” ../_images/lab8-edgedouble10.png
                              -

                              Fig. 314 Topology#

                              +

                              Fig. 315 Topology#

                              @@ -704,7 +704,7 @@

                              6.1 Edge: As-Path Prepend ../_images/lab8-edgedouble21.png
                              -

                              Fig. 315 aws-us-east-2-spoke1-test1#

                              +

                              Fig. 316 aws-us-east-2-spoke1-test1#

                                @@ -720,14 +720,14 @@

                                6.1 Edge: As-Path Prepend ../_images/lab8-edgedouble22.png
                                -

                                Fig. 316 inetutils-traceroute#

                                +

                                Fig. 317 inetutils-traceroute#

                                When you see this pop-up message, just click on the Enter button on your keyboard!

                                ../_images/lab8-popup.png
                                -

                                Fig. 317 confirm#

                                +

                                Fig. 318 confirm#

                                Now type the traceroute command towards the test VM in GCP:

                                @@ -737,14 +737,14 @@

                                6.1 Edge: As-Path Prepend ../_images/lab8-edgedouble23.png
                                -

                                Fig. 318 Traceroute#

                                +

                                Fig. 319 Traceroute#

                                The traceroute will reveal that the destination is exactly 5 hops away.

                                ../_images/lab8-edgedouble25.png
                                -

                                Fig. 319 5 hops#

                                +

                                Fig. 320 5 hops#

                                Let’s harness the as-path prepend feature for manipulating the traffic.

                                @@ -756,7 +756,7 @@

                                6.1 Edge: As-Path Prepend ../_images/lab8-primary.png
                                -

                                Fig. 320 Primary and Backup#

                                +

                                Fig. 321 Primary and Backup#

                                Let’s first check the Route DB of the aws-us-east-2-transit GW.

                                @@ -764,20 +764,20 @@

                                6.1 Edge: As-Path Prepend ../_images/lab8-primary01.png
                                -

                                Fig. 321 aws-us-east-2-transit#

                                +

                                Fig. 322 aws-us-east-2-transit#

                                Select the "Route DB" tab, then on right-hand side type 172.16.1.0 on the Search field.

                                ../_images/lab8-primary03.png
                                -

                                Fig. 322 Route DB#

                                +

                                Fig. 323 Route DB#

                                ../_images/lab8-primary02.png
                                -

                                Fig. 323 1 AS Path length#

                                +

                                Fig. 324 1 AS Path length#

                                From the aws-us-east-2-transit perspective, the destination route 172.16.1.0 is far just one single AS (i.e. 64514)

                                @@ -785,7 +785,7 @@

                                6.1 Edge: As-Path Prepend ../_images/lab8-edgedouble30.png
                                -

                                Fig. 324 aws-us-east-2-transit#

                                +

                                Fig. 325 aws-us-east-2-transit#

                                Select the "Settings" tab and then expand the "Border Gateway Protocol (BGP)" section, then under the AS Path Prepend widget, select the gcp-us-central1-transit-peering connection and type two times the AS number 64513.

                                @@ -793,7 +793,7 @@

                                6.1 Edge: As-Path Prepend ../_images/lab8-edgedouble31.png
                                -

                                Fig. 325 as-path prepend#

                                +

                                Fig. 326 as-path prepend#

                                Let’s repeat the same kind of configuration on the GCP Transit GW.

                                @@ -801,7 +801,7 @@

                                6.1 Edge: As-Path Prepend ../_images/lab8-edgedouble32.png
                                -

                                Fig. 326 gcp-us-central1-transit#

                                +

                                Fig. 327 gcp-us-central1-transit#

                                Select the "Settings" tab and then expand the "Border Gateway Protocol (BGP)" section, then under the AS Path Prepend widget select the aws-us-east-2-transit-peering connection and type two times the AS number 64514.

                                @@ -809,21 +809,21 @@

                                6.1 Edge: As-Path Prepend ../_images/lab8-edgedouble33.png
                                -

                                Fig. 327 as-path prepend#

                                +

                                Fig. 328 as-path prepend#

                                Now go to CoPilot > Cloud Fabric > Gateways > Transit Gateways and click on the aws-us-east-2-transit GW, then select the "Route DB" tab and then once again, on the right-hand side, type 172.16.1.0/24 inside the Search field. This time the AS Path Length will turn out being equal to 3, due to to the route manipulation that harnessed the as-path prepend feature.

                                ../_images/lab8-path.png
                                -

                                Fig. 328 As path length = 3#

                                +

                                Fig. 329 As path length = 3#

                                Now, let’s launch again the traceroute towards 172.16.1.100 from the aws-us-east-2-spoke1-test1.

                                ../_images/lab8-almostdone.png
                                -

                                Fig. 329 traceroute#

                                +

                                Fig. 330 traceroute#

                                The traceroute is still showing the Transit peering between AWS and GCP as the preferred path, although the as-path prepend was correctly applied earlier.

                                @@ -832,14 +832,14 @@

                                6.1 Edge: As-Path Prepend ../_images/lab8-almostdone02.png
                                -

                                Fig. 330 Edge#

                                +

                                Fig. 331 Edge#

                                Select the "Settings" Tab and then expand the "Routing" section, afterwards turn on the knob Transitive Routing and do not forget to click on Save.

                                ../_images/lab8-almostdone03.png
                                -

                                Fig. 331 edge#

                                +

                                Fig. 332 edge#

                              @@ -850,13 +850,13 @@

                              7. Final verification ../_images/lab8-almostdone04.png
                              -

                              Fig. 332 traceroute#

                              +

                              Fig. 333 traceroute#

                              ../_images/lab8-almostdone05.png
                              -

                              Fig. 333 6 Hops#

                              +

                              Fig. 334 6 Hops#

                              Now go back to CoPilot > Cloud Fabric > Gateways > Transit Gateways and click on the aws-us-east-2-transit GW, then select the "Route DB" tab and then once again, on the right-hand side, type 172.16.1.0 inside the Search field.

                              @@ -865,14 +865,14 @@

                              7. Final verification ../_images/lab8-2path.png
                              -

                              Fig. 334 As path length = 2#

                              +

                              Fig. 335 As path length = 2#

                              After this lab, this is how the overall topology would look like:

                              ../_images/lab8-edge25.png
                              -

                              Fig. 335 Final Topology for Lab 8#

                              +

                              Fig. 336 Final Topology for Lab 8#

                              diff --git a/docs/ace-pro/docs/lab9.html b/docs/ace-pro/docs/lab9.html index 4c20bc28..d01e3df3 100644 --- a/docs/ace-pro/docs/lab9.html +++ b/docs/ace-pro/docs/lab9.html @@ -377,7 +377,7 @@

                              2. Topology ../_images/lab9-initialtopology.png
                              -

                              Fig. 336 Lab 9 Initial Topology#

                              +

                              Fig. 337 Lab 9 Initial Topology#

                              @@ -389,7 +389,7 @@

                              3.1 Deploy the PSF ../_images/lab9-psf.png
                              -

                              Fig. 337 PSF#

                              +

                              Fig. 338 PSF#

                              Insert the following parameters:

                              @@ -406,7 +406,7 @@

                              3.1 Deploy the PSF ../_images/lab9-new.png
                              -

                              Fig. 338 PSF template#

                              +

                              Fig. 339 PSF template#

                              @@ -416,7 +416,7 @@

                              3.1 Deploy the PSF ../_images/lab9-psfinprogress.png
                              -

                              Fig. 339 PSF deployment in progress#

                              +

                              Fig. 340 PSF deployment in progress#

                              @@ -428,13 +428,13 @@

                              3.2 RTB verification ../_images/lab9-psfclick.png
                              -

                              Fig. 340 PSF deployed#

                              +

                              Fig. 341 PSF deployed#

                              ../_images/lab9-routetablepsf.png
                              -

                              Fig. 341 PSF rtb#

                              +

                              Fig. 342 PSF rtb#

                              @@ -448,7 +448,7 @@

                              3.2 RTB verification ../_images/lab9-routetablepsf2.png
                              -

                              Fig. 342 aws-us-east1-spoke1-rtb-public-a#

                              +

                              Fig. 343 aws-us-east1-spoke1-rtb-public-a#

                              @@ -465,13 +465,13 @@

                              4.1 SSH to aws-us-east1-spoke1-test1 ../_images/lab9-newsg010.png
                              -

                              Fig. 343 Public IP address#

                              +

                              Fig. 344 Public IP address#

                              ../_images/lab9-newsg011.png
                              -

                              Fig. 344 SSH session#

                              +

                              Fig. 345 SSH session#

                              Wait for the instructor to provide a malicious IP.

                              @@ -489,7 +489,7 @@

                              4.1 SSH to aws-us-east1-spoke1-test1 ../_images/lab9-instancetest.png
                              -

                              Fig. 345 Curl towards the malicious IP#

                              +

                              Fig. 346 Curl towards the malicious IP#

                              The traffic will be permitted… Let’s now enforce the Threats detection mechanism!

                              @@ -506,14 +506,14 @@

                              5.0 Create a new SmartGroup ../_images/lab9-routetablepsf234.png
                              -

                              Fig. 346 aws-us-east-1-spoke1-Public-1-us-east-1a#

                              +

                              Fig. 347 aws-us-east-1-spoke1-Public-1-us-east-1a#

                              Go to CoPilot > Groups > SmartGroups and then click on the "+ SmartGroup" button.

                              ../_images/lab9-smart001.png
                              -

                              Fig. 347 New SmartGroup#

                              +

                              Fig. 348 New SmartGroup#

                              Ensure these parameters are entered in the pop-up window "Create SmartGroup":

                              @@ -525,14 +525,14 @@

                              5.0 Create a new SmartGroup ../_images/lab9-smart002.png
                              -

                              Fig. 348 aws-us-east-1-spoke1-test1 SmartGroup#

                              +

                              Fig. 349 aws-us-east-1-spoke1-test1 SmartGroup#

                              Do not forget to click on Save.

                              ../_images/lab9-smart003.png
                              -

                              Fig. 349 SmartGroups List#

                              +

                              Fig. 350 SmartGroups List#

                              @@ -542,7 +542,7 @@

                              6.0 Create two new DCF rules ../_images/lab9-newrule10.png
                              -

                              Fig. 350 New Rule#

                              +

                              Fig. 351 New Rule#

                              Insert the following parameters:

                              @@ -559,7 +559,7 @@

                              6.0 Create two new DCF rules ../_images/lab911-new.png
                              -

                              Fig. 351 Saving the new Rule#

                              +

                              Fig. 352 Saving the new Rule#

                              Now before committing, create another DCF rule for blocking also the traffic sourced from any Malicious IP addresses towards the aws-us-east-1-spoke1-test1 instance.

                              @@ -567,7 +567,7 @@

                              6.0 Create two new DCF rules ../_images/lab911-new33.png
                              -

                              Fig. 352 New Rule#

                              +

                              Fig. 353 New Rule#

                              Insert the following parameters:

                              @@ -584,14 +584,14 @@

                              6.0 Create two new DCF rules ../_images/lab96-newrule44.png
                              -

                              Fig. 353 PSF-Deny-Rule-from-malicious-ips#

                              +

                              Fig. 354 PSF-Deny-Rule-from-malicious-ips#

                              Do not forget now to Commit your new rules!

                              ../_images/lab96-newrule-commit.png
                              -

                              Fig. 354 Commit the new rules#

                              +

                              Fig. 355 Commit the new rules#

                              @@ -605,7 +605,7 @@

                              6.0 Create two new DCF rules ../_images/lab96-newrule12.png
                              -

                              Fig. 355 Default ThreatGroup#

                              +

                              Fig. 356 Default ThreatGroup#

                              @@ -623,19 +623,19 @@

                              7.0 Generate again traffic towards the “Bad Guy” ../_images/lab66-newruledelete.png
                              -

                              Fig. 356 Deletion of the Greenfield-Rule#

                              +

                              Fig. 357 Deletion of the Greenfield-Rule#

                              ../_images/lab66-newruledeleted.png
                              -

                              Fig. 357 Commit#

                              +

                              Fig. 358 Commit#

                              ../_images/lab66-newruledeleted00.png
                              -

                              Fig. 358 DCF Rules List#

                              +

                              Fig. 359 DCF Rules List#

                              @@ -650,7 +650,7 @@

                              7.1 Create a new SmartGroup ../_images/lab9-smart100.png
                              -

                              Fig. 359 New WebGroup#

                              +

                              Fig. 360 New WebGroup#

                              Create the new WebGroup with the following parameters:

                              @@ -665,7 +665,7 @@

                              7.1 Create a new SmartGroup ../_images/lab6-webgroup200.png
                              -

                              Fig. 360 WebGroup creation#

                              +

                              Fig. 361 WebGroup creation#

                              @@ -675,7 +675,7 @@

                              7.2 Create a PSF-Allow-Rule ../_images/lab9-newrule100.png
                              -

                              Fig. 361 New Rule#

                              +

                              Fig. 362 New Rule#

                              Insert the following parameters

                              @@ -693,14 +693,14 @@

                              7.2 Create a PSF-Allow-Rule ../_images/lab911-new100.png
                              -

                              Fig. 362 Saving the new Rule#

                              +

                              Fig. 363 Saving the new Rule#

                              Click on the Commit button!

                              ../_images/lab96-newrule201.png
                              -

                              Fig. 363 Commit#

                              +

                              Fig. 364 Commit#

                              @@ -716,7 +716,7 @@

                              8. Connectivity Tests ../_images/lab96-newrule333.png
                              -

                              Fig. 364 Commit#

                              +

                              Fig. 365 Commit#

                              From your SSH client, issue the following commands from the aws-us-east1-spoke1-test1 instance:

                              @@ -732,7 +732,7 @@

                              8. Connectivity Tests ../_images/lab96-newrule301.png
                              -

                              Fig. 365 Outcomes from the curl commands#

                              +

                              Fig. 366 Outcomes from the curl commands#

                              Now issue again the curl command towards the malicious IP address that was earlier provided by the Trainer!

                              @@ -742,7 +742,7 @@

                              8. Connectivity Tests ../_images/lab96-newrule302.png
                              -

                              Fig. 366 Towards the Malicious IP#

                              +

                              Fig. 367 Towards the Malicious IP#

                              You will notice that the traffic towards the IP with Bad Reputation was blocked at the very first SYN and SYN-ACK packets!

                              @@ -750,34 +750,34 @@

                              8. Connectivity Tests ../_images/lab96-newrule308.png
                              -

                              Fig. 367 Filter#

                              +

                              Fig. 368 Filter#

                              ../_images/lab96-newrule309.png
                              -

                              Fig. 368 Condition#

                              +

                              Fig. 369 Condition#

                              Now click on the VIEW link on the right-hand side of the entry:

                              ../_images/lab96-newrule310.png
                              -

                              Fig. 369 View link#

                              +

                              Fig. 370 View link#

                              Last but not least, explore the Threat Summary tab to find out how ProofPoint classified that IP address!

                              ../_images/lab96-newrule311.png
                              -

                              Fig. 370 Condition#

                              +

                              Fig. 371 Condition#

                              After this lab, this is how the overall topology would look like:

                              ../_images/lab9-finaltopologyy.png
                              -

                              Fig. 371 Final Topology for Lab 9#

                              +

                              Fig. 372 Final Topology for Lab 9#

                              diff --git a/docs/ace-pro/searchindex.js b/docs/ace-pro/searchindex.js index bfbecc29..39b52509 100644 --- a/docs/ace-pro/searchindex.js +++ b/docs/ace-pro/searchindex.js @@ -1 +1 @@ -Search.setIndex({"alltitles": {"1. CostIQ Overview": [[3, "costiq-overview"]], "1. Create VPCs, Transit GW, Spoke GW and Attachment through Terraform": [[5, "create-vpcs-transit-gw-spoke-gw-and-attachment-through-terraform"]], "1. General Objectives": [[12, "general-objectives"], [13, "general-objectives"]], "1. Introduction": [[2, "introduction"]], "1. Objective": [[4, "objective"], [6, "objective"], [7, "objective"], [8, "objective"], [9, "objective"], [10, "objective"], [11, "objective"]], "1. Preface": [[1, "preface"]], "1. ThreatGroup Overview": [[14, "threatgroup-overview"]], "2. Azure VNet": [[2, "azure-vnet"]], "2. Distributed Cloud Firewall Overview": [[4, "distributed-cloud-firewall-overview"]], "2. FireNet Overview (Firewall Network)": [[11, "firenet-overview-firewall-network"]], "2. High Performance Encryption and ActiveMesh": [[9, "high-performance-encryption-and-activemesh"]], "2. Implement CostIQ": [[3, "implement-costiq"]], "2. Initial set-up": [[13, "initial-set-up"]], "2. Multicloud Connectivity Overview": [[7, "multicloud-connectivity-overview"]], "2. Network Segmentation Overview": [[8, "network-segmentation-overview"]], "2. Prerequisites": [[1, "prerequisites"]], "2. Provision through Terraform": [[5, "provision-through-terraform"]], "2. Site2Cloud Overview": [[12, "site2cloud-overview"]], "2. ThreatIQ Overview": [[6, "threatiq-overview"]], "2. Topology": [[10, "topology"], [14, "topology"]], "2.1 Enable CostIQ": [[3, "enable-costiq"]], "2.1 Expected Results": [[5, "expected-results"]], "2.1. Attachment between Edge and the Transit": [[13, "attachment-between-edge-and-the-transit"]], "2.1. Create Azure VNet": [[2, "create-azure-vnet"]], "3. AWS VPC": [[2, "aws-vpc"]], "3. Create Transit Peering": [[5, "create-transit-peering"]], "3. Getting Started with the labs": [[1, "getting-started-with-the-labs"]], "3. Network Domain Association": [[13, "network-domain-association"]], "3. New York DC is the Shared Services": [[3, "new-york-dc-is-the-shared-services"]], "3. PSF": [[14, "psf"]], "3. SSH to the EC2 instance in the Private Subnet": [[10, "ssh-to-the-ec2-instance-in-the-private-subnet"]], "3. Smart Groups Creation": [[4, "smart-groups-creation"]], "3. Topology": [[6, "topology"], [7, "topology"], [8, "topology"], [9, "topology"], [11, "topology"], [12, "topology"]], "3.1 Deploy the PSF": [[14, "deploy-the-psf"]], "3.1 Description": [[5, "description"]], "3.1. Create AWS VPC": [[2, "create-aws-vpc"]], "3.1. Preliminary Monitoring Check Using the Gatus APP": [[7, "preliminary-monitoring-check-using-the-gatus-app"]], "3.1. Smart Group \u201cbu1\u201d": [[4, "smart-group-bu1"]], "3.2 Provision through Terraform": [[5, "id1"]], "3.2 RTB verification": [[14, "rtb-verification"]], "3.2. Preliminary Monitoring Check Using an SSH Client (BONUS)": [[7, "preliminary-monitoring-check-using-an-ssh-client-bonus"]], "3.2. Smart Group \u201cbu2\u201d": [[4, "smart-group-bu2"]], "3.2. Verify from AWS Console": [[2, "verify-from-aws-console"]], "3.2.1 Cloud Assets (to retrieve IP addresses)": [[7, "cloud-assets-to-retrieve-ip-addresses"]], "3.2.2 Topology (to retrieve IP addresses)": [[7, "topology-to-retrieve-ip-addresses"]], "3.3 Expected Results": [[5, "id2"]], "3.3. Connectivity verification (ICMP)": [[4, "connectivity-verification-icmp"]], "3.4. Connectivity verification (SSH)": [[4, "connectivity-verification-ssh"]], "4. Access Information": [[1, "access-information"]], "4. Aviatrix CoPilot": [[7, "aviatrix-copilot"]], "4. Configuration": [[8, "configuration"], [11, "configuration"], [12, "configuration"]], "4. DCF Rules Creation": [[4, "dcf-rules-creation"]], "4. Edge: Connectivity Test": [[13, "edge-connectivity-test"]], "4. Egress Control": [[10, "egress-control"]], "4. GCP VPC": [[2, "gcp-vpc"]], "4. High Performance Encryption Configuration": [[9, "high-performance-encryption-configuration"]], "4. IAC Summary": [[5, "iac-summary"]], "4. Initial configuration": [[7, "initial-configuration"]], "4. PSF": [[6, "psf"]], "4.0 Generate traffic towards a Malicious IP": [[14, "generate-traffic-towards-a-malicious-ip"]], "4.1 Deploy the PSF": [[6, "deploy-the-psf"]], "4.1 Enable the Egress Control": [[10, "enable-the-egress-control"]], "4.1 SSH to aws-us-east1-spoke1-test1": [[14, "ssh-to-aws-us-east1-spoke1-test1"]], "4.1. Aviatrix Transit Gateways": [[7, "aviatrix-transit-gateways"], [8, "aviatrix-transit-gateways"]], "4.1. Azure Transit to Spoke Peering": [[11, "azure-transit-to-spoke-peering"]], "4.1. CoPilot View before starting": [[9, "copilot-view-before-starting"]], "4.1. Create GCP VPC": [[2, "create-gcp-vpc"]], "4.1. Create an intra-rule that allows ICMP inside bu1": [[4, "create-an-intra-rule-that-allows-icmp-inside-bu1"]], "4.1. Site2Cloud Connection (Cloud to On-Prem)": [[12, "site2cloud-connection-cloud-to-on-prem"]], "4.1.1.Transit Gateway in AWS US-EAST-2": [[7, "transit-gateway-in-aws-us-east-2"]], "4.2 Inspect the Private RTB": [[10, "inspect-the-private-rtb"]], "4.2 Network Domains": [[8, "network-domains"]], "4.2 RTB verification": [[6, "rtb-verification"]], "4.2 Site2Cloud Connection - StrongSwan\u2019s configuration": [[12, "site2cloud-connection-strongswan-s-configuration"]], "4.2. Aviatrix Spoke Gateways": [[7, "aviatrix-spoke-gateways"]], "4.2. Create an intra-rule that allows ICMP inside bu2": [[4, "create-an-intra-rule-that-allows-icmp-inside-bu2"]], "4.2. PAN Firewall Deployment": [[11, "pan-firewall-deployment"]], "4.2. Transit-Spoke Attachment": [[9, "transit-spoke-attachment"]], "4.2.1. Spoke Gateway in AWS": [[7, "spoke-gateway-in-aws"]], "4.2.2. Spoke Gateway in Azure": [[7, "spoke-gateway-in-azure"]], "4.2.3. Spoke Gateway in GCP": [[7, "spoke-gateway-in-gcp"]], "4.3 Generate Traffic": [[10, "generate-traffic"]], "4.3. CoPilot View after Transit-Spoke Attachment": [[9, "copilot-view-after-transit-spoke-attachment"]], "4.3. Explore the Cloud Fabric": [[7, "explore-the-cloud-fabric"]], "4.3. Firewall Configuration": [[11, "firewall-configuration"]], "4.4 Aviatrix Spoke to Transit Gateways Attachments": [[7, "aviatrix-spoke-to-transit-gateways-attachments"]], "4.4 Enable DCF": [[10, "enable-dcf"]], "4.4. Firewall Vendor Integration": [[11, "firewall-vendor-integration"]], "4.4. Transit Peerings Configuration": [[9, "transit-peerings-configuration"]], "4.4.1 Identify the subnet where the private workload resides": [[10, "identify-the-subnet-where-the-private-workload-resides"]], "4.4.1. Spoke to Transit Attachment in AWS": [[7, "spoke-to-transit-attachment-in-aws"]], "4.4.1. Transit Peerings Verification": [[9, "transit-peerings-verification"]], "4.4.2 Create an Ad-Hoc SmartGroup": [[10, "create-an-ad-hoc-smartgroup"]], "4.4.2 Spoke to Transit Attachment in Azure": [[7, "spoke-to-transit-attachment-in-azure"]], "4.4.3 Create a new Rule": [[10, "create-a-new-rule"]], "4.4.3. Spoke to Transit Attachment in GCP": [[7, "spoke-to-transit-attachment-in-gcp"]], "4.5. CoPilot Verification of Spoke-Transit Attachments": [[7, "copilot-verification-of-spoke-transit-attachments"]], "4.5. Verify Routes Installed on Firewall": [[11, "verify-routes-installed-on-firewall"]], "4.6. FireNet Policy": [[11, "firenet-policy"]], "4.6. Multicloud Transit Peerings": [[7, "multicloud-transit-peerings"]], "4.6.1. AWS and Azure": [[7, "aws-and-azure"]], "4.6.2 Azure and GCP": [[7, "azure-and-gcp"]], "4.6.3. GCP and AWS": [[7, "gcp-and-aws"]], "5. - Network Insights API": [[5, "network-insights-api"]], "5. A new SmartGroup for the Public Subnet": [[6, "a-new-smartgroup-for-the-public-subnet"]], "5. Edge: FlowIQ": [[13, "edge-flowiq"]], "5. Enforcement": [[6, "enforcement"]], "5. High Performance Encryption Verification": [[9, "high-performance-encryption-verification"]], "5. Lab Topology": [[1, "lab-topology"]], "5. S2C - Verification": [[12, "s2c-verification"]], "5. Verification": [[4, "verification"], [7, "verification"], [11, "verification"]], "5. Verification of Segment Attachments": [[8, "verification-of-segment-attachments"]], "5. ZTNA - Zero Trust Network Architecture": [[10, "ztna-zero-trust-network-architecture"]], "5.0 Create a new SmartGroup": [[14, "create-a-new-smartgroup"]], "5.1 Create a New WebGroup": [[10, "create-a-new-webgroup"]], "5.1 Create an Ad-Hoc SmartGroup": [[6, "create-an-ad-hoc-smartgroup"]], "5.1 Description": [[5, "id3"]], "5.1 Generate traffic towards the \u201cBad Guy\u201d": [[6, "id1"]], "5.1. Automatic enforcement: \u201cforce-drop\u201d": [[6, "automatic-enforcement-force-drop"]], "5.1. CoPilot Verification": [[8, "copilot-verification"]], "5.1. CoPilot Verification of the VPC Peerings(Transit-Transit and Spoke-Transit)": [[9, "copilot-verification-of-the-vpc-peerings-transit-transit-and-spoke-transit"]], "5.1. Inside Azure": [[11, "inside-azure"]], "5.1. Verification of Transit Peerings on CoPilot (Cloud Fabric)": [[7, "verification-of-transit-peerings-on-copilot-cloud-fabric"]], "5.1. Verify SSH traffic from your laptop to bu1": [[4, "verify-ssh-traffic-from-your-laptop-to-bu1"]], "5.1.1 Launch connectivity test": [[11, "launch-connectivity-test"]], "5.2 Create a new Rule": [[6, "create-a-new-rule"]], "5.2 Create an \u201ceditable\u201d Explicit -Deny-Rule": [[10, "create-an-editable-explicit-deny-rule"]], "5.2 Generate traffic towards the \u201cBad Guy\u201d": [[6, "generate-traffic-towards-the-bad-guy"]], "5.2 Validate": [[5, "validate"]], "5.2. Azure to GCP": [[11, "azure-to-gcp"]], "5.2. CoPilot Verification of HPE": [[9, "copilot-verification-of-hpe"]], "5.2. Verification of Transit Peerings on CoPilot (Topology)": [[7, "verification-of-transit-peerings-on-copilot-topology"]], "5.2. Verify ICMP within bu1 and from bu1 towards bu2": [[4, "verify-icmp-within-bu1-and-from-bu1-towards-bu2"]], "5.2.1 Enforce the Egress-Rule": [[10, "enforce-the-egress-rule"]], "5.2.2 Create an ad-hoc Explicit-Deny-Rule": [[10, "create-an-ad-hoc-explicit-deny-rule"]], "5.3 Test the modified rule": [[10, "test-the-modified-rule"]], "5.3. Route Info DB": [[7, "route-info-db"]], "5.3. Verify SSH within bu1": [[4, "verify-ssh-within-bu1"]], "5.4. Add a rule that allows SSH in bu1": [[4, "add-a-rule-that-allows-ssh-in-bu1"]], "5.4. Connectivity tests through Gatus": [[7, "connectivity-tests-through-gatus"]], "5.4. SSH to VM in bu2": [[4, "ssh-to-vm-in-bu2"]], "5.5. Verify ICMP traffic within bu2": [[4, "verify-icmp-traffic-within-bu2"]], "5.6. Inter-rule from bu2 to bu1": [[4, "inter-rule-from-bu2-to-bu1"]], "6. ActiveMesh": [[9, "activemesh"]], "6. Connection Policy": [[8, "connection-policy"]], "6. CostIQ": [[6, "costiq"]], "6. East-1 and the Multi-Tier Transit": [[4, "east-1-and-the-multi-tier-transit"]], "6. Edge: \u201cIt\u2019s more than a Spoke GW\u201d\u201d": [[13, "edge-it-s-more-than-a-spoke-gw"]], "6. IDS": [[10, "ids"]], "6.0 Create two new DCF rules": [[14, "create-two-new-dcf-rules"]], "6.1 Activation of the MTT": [[4, "activation-of-the-mtt"]], "6.1 Create a New Rule": [[10, "id1"]], "6.1 Edge: As-Path Prepend": [[13, "edge-as-path-prepend"]], "6.1. CoPilot Verification of ActiveMesh": [[9, "copilot-verification-of-activemesh"]], "6.1. Verification of Connection Policy": [[8, "verification-of-connection-policy"]], "6.2 Prepare the simulator": [[10, "prepare-the-simulator"]], "6.2 Smart Group \u201ceast1\u201d": [[4, "smart-group-east1"]], "6.2. Connectivity test of ActiveMesh (Pt.1)": [[9, "connectivity-test-of-activemesh-pt-1"]], "6.2.1 Enable Segmentation": [[9, "enable-segmentation"]], "6.2.2. Associate Aviatrix Spoke to the Network Domain": [[9, "associate-aviatrix-spoke-to-the-network-domain"]], "6.3 Create an inter-rule that allows ICMP from bu2 towards east1": [[4, "create-an-inter-rule-that-allows-icmp-from-bu2-towards-east1"]], "6.3 Test the New Rule and the IDS feature": [[10, "test-the-new-rule-and-the-ids-feature"]], "6.3. Connectivity test of ActiveMesh (Pt.2)": [[9, "connectivity-test-of-activemesh-pt-2"]], "6.4 Verify connectivity between bu2 and east1": [[4, "verify-connectivity-between-bu2-and-east1"]], "7. Final verification": [[13, "final-verification"]], "7. FlightPath": [[9, "flightpath"]], "7. Spoke to Spoke Attachment": [[4, "spoke-to-spoke-attachment"]], "7.0 Generate again traffic towards the \u201cBad Guy\u201d": [[14, "generate-again-traffic-towards-the-bad-guy"]], "7.1 Create a new SmartGroup": [[14, "id1"]], "7.1 Creating a Spoke to Spoke Attachment": [[4, "creating-a-spoke-to-spoke-attachment"]], "7.2 Create a PSF-Allow-Rule": [[14, "create-a-psf-allow-rule"]], "8. Connectivity Tests": [[14, "connectivity-tests"]], "Bonus questions": [[9, "bonus-questions"]], "Gateway Keepalive Templates": [[9, "gateway-keepalive-templates"]], "LOGOS-ICONS": [[15, null]], "Lab 1 - VPCs/VNets CREATION": [[2, null]], "Lab 10 - COSTIQ": [[3, null]], "Lab 11 - DISTRIBUTED CLOUD FIREWALL": [[4, null]], "Lab 12 - IAC & NETWORK INSIGHTS API": [[5, null]], "Lab 2 - TRANSIT NETWORKING": [[7, null]], "Lab 3 - NETWORK SEGMENTATION": [[8, null]], "Lab 4 - HPE WITH ACTIVE MESH": [[9, null]], "Lab 5 - CLOUD PERIMETER SECURITY (Secure Cloud Egress)": [[10, null]], "Lab 6 - FIRENET": [[11, null]], "Lab 7 - SITE2CLOUD": [[12, null]], "Lab 8 - SECURE HIGH-PERFORMANCE DATACENTER EDGE": [[13, null]], "Lab 9 - THREAT PREVENTION": [[14, null]], "Lab 9 - THREATIQ & COSTIQ": [[6, null]], "Link": [[16, "link"]], "PDFs": [[0, null]], "POD Portal": [[16, null]], "Transitive Routing": [[9, "transitive-routing"]], "Welcome to ACE Professional Lab": [[1, null]]}, "docnames": ["docs/PDFs", "docs/home", "docs/lab1", "docs/lab10", "docs/lab11", "docs/lab12", "docs/lab13", "docs/lab2", "docs/lab3", "docs/lab4", "docs/lab5", "docs/lab6", "docs/lab7", "docs/lab8", "docs/lab9", "docs/logos-icons", "docs/pod"], "envversion": {"sphinx": 62, "sphinx.domains.c": 3, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 9, "sphinx.domains.index": 1, "sphinx.domains.javascript": 3, "sphinx.domains.math": 2, "sphinx.domains.python": 4, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.intersphinx": 1}, "filenames": ["docs/PDFs.md", "docs/home.md", "docs/lab1.md", "docs/lab10.md", "docs/lab11.md", "docs/lab12.md", "docs/lab13.md", "docs/lab2.md", "docs/lab3.md", "docs/lab4.md", "docs/lab5.md", "docs/lab6.md", "docs/lab7.md", "docs/lab8.md", "docs/lab9.md", "docs/logos-icons.md", "docs/pod.md"], "indexentries": {}, "objects": {}, "objnames": {}, "objtypes": {}, "terms": {"": [2, 3, 4, 5, 6, 7, 9, 10, 11, 14], "0": [2, 3, 4, 5, 6, 7, 9, 10, 11, 12, 13], "0xtf": 10, "10": [2, 4, 6, 7, 9, 10, 11, 13], "100": [9, 12, 13], "105": 1, "11": 5, "12": [2, 4, 6], "129": 11, "149": 9, "15": 11, "16": [1, 2, 3, 6, 7, 9, 11, 12, 13], "168": [2, 4, 7, 11, 12], "172": [2, 7, 9, 12, 13], "1918": [9, 10, 11], "192": [2, 4, 7, 11, 12], "1a": [6, 9, 14], "1b": 9, "1x": 7, "20": [7, 11], "200": 12, "22": [1, 2, 4], "225": 13, "23": 4, "24": [2, 6, 7, 9, 12, 13], "26": 7, "27": [7, 10], "28": [6, 7], "2a": [7, 10], "2spoke1": 10, "2x": [2, 7], "30": [9, 13, 14], "32": 6, "3x": 7, "40": [3, 6], "443": [7, 9], "5": 2, "50": 4, "53": [10, 11], "6": [1, 5], "60": 6, "63": [1, 11], "64512": 4, "64513": 13, "64514": 13, "64515": 4, "7": [1, 10, 11], "71": 1, "8": [4, 6, 12], "80": 7, "9": [1, 5, 11], "96": 7, "A": 9, "AS": [4, 13], "As": [2, 7, 9], "At": [1, 4, 7, 8, 9, 10, 11], "Be": [7, 9, 12], "By": [1, 5, 6], "For": [7, 12, 13], "If": [1, 3, 4, 6, 7, 9, 10, 11, 13], "In": [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "It": [2, 4, 7, 9], "Its": 12, "NOT": [2, 4, 7, 9, 10], "No": [4, 6, 10, 13, 14], "Not": 10, "ON": [10, 11, 12], "OR": 4, "Of": [10, 13], "On": [4, 5, 6, 7, 9, 10, 11, 13, 14], "TO": [4, 9], "The": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "Then": [2, 4, 6, 7, 8, 9, 10, 11, 12, 13], "There": 13, "These": [1, 5, 6, 7, 9, 14], "To": [1, 4, 7, 9], "With": [5, 10], "abl": [1, 4, 7, 8, 9, 10, 11], "about": [2, 5, 6, 9, 11, 12, 13, 14], "abov": [4, 5, 6, 7], "absenc": [4, 10], "absolut": [3, 6], "ac": 0, "access": [2, 7, 8, 11, 13, 16], "accomplish": [11, 13], "accord": 4, "account": [2, 3, 6, 7, 14], "achiev": [4, 9, 12], "ack": 14, "across": [4, 8], "action": [3, 4, 6, 7, 9, 10, 11, 12, 14], "activ": [5, 10, 11, 12], "activemesh": [0, 1], "actual": 9, "ad": 5, "add": [6, 10, 11, 12], "addit": [1, 2, 4, 6, 7, 9, 10, 11, 13], "addition": 7, "addr": 11, "address": [6, 10, 11, 12, 13, 14], "adjust": 7, "admin": [2, 11], "administr": 13, "adopt": 4, "advanc": 4, "advertis": [3, 6, 13], "affect": 4, "aforement": [3, 6, 10], "after": [3, 4, 5, 6, 7, 8, 10, 11, 12, 13, 14], "afternoon": 1, "afterward": [2, 6, 7, 10, 13], "again": [2, 4, 5, 6, 7, 9, 10, 11, 13], "against": 10, "aggress": 7, "aid": 1, "aka": [1, 4, 8, 9, 11], "akin": 7, "alert": 6, "algorithm": 9, "alia": 6, "aliv": 9, "all": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13], "alloc": [4, 7], "allow": [5, 10, 11, 13], "almost": [2, 10, 11], "along": [9, 13], "alreadi": [4, 5, 7, 11, 12, 13], "also": [2, 4, 5, 6, 7, 9, 10, 13, 14], "alt": 5, "altern": [2, 7, 10], "although": [4, 11, 13], "alto": [1, 11], "alwai": [2, 4, 7, 8], "among": [4, 7, 8], "an": [1, 2, 5, 9, 11, 12, 13, 14], "analysi": 3, "ani": [3, 4, 6, 7, 9, 10, 11, 12, 13, 14], "anoth": [4, 5, 6, 12, 13, 14], "anyth": 10, "anywher": [10, 11], "api": [0, 1, 11], "app": 5, "appear": 7, "appiq": 9, "appli": [4, 5, 6, 8, 9, 10, 11, 13], "applic": [2, 3, 6], "approach": 10, "appropri": [8, 9], "approv": 5, "approxim": 4, "apt": 13, "ar": [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "arc": 8, "architectur": [4, 7, 8], "arrow": [4, 6, 10], "ask": [1, 4, 10, 13], "asn": [4, 13], "assess": 5, "asset": [2, 6, 10, 14], "assign": [2, 4, 7, 9, 11, 12], "assocci": 13, "associ": [3, 6, 8, 10, 11], "assum": 2, "attach": [1, 2, 6, 11, 14], "attachemnt": 13, "attack": 10, "attempt": [7, 9, 10], "attent": [1, 7], "attribut": [7, 13], "authent": 11, "authet": 12, "author": [5, 10], "auto": [5, 9, 10, 11], "autom": 5, "automat": [9, 10, 11, 12], "avail": [1, 2, 5, 6, 7, 9, 10, 12, 13], "aviatrix": [1, 2, 4, 5, 6, 10, 11, 12, 13, 14, 15], "aviatrixlab": 12, "aviatrixsystem": 5, "avod": 4, "avx": 11, "avxadmin": 11, "aw": [1, 3, 4, 5, 6, 8, 9, 10, 13], "awai": 13, "awar": 13, "az": [2, 6, 7, 9, 10, 11], "azur": [1, 3, 4, 6, 8, 9], "back": [2, 5, 6, 7, 9, 11, 12, 13], "backbon": 8, "backup": 13, "bar": [2, 11], "base": [3, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "bash": 12, "beahvior": 4, "bear": [2, 7, 13], "becaus": [4, 6, 7, 8, 9, 10, 11, 13, 14], "becom": 9, "been": [3, 4, 6, 7, 10, 11, 13], "befor": [1, 2, 4, 6, 7, 10, 11, 12, 13, 14], "begin": [2, 7, 10, 11], "behaviour": [4, 10], "being": [7, 10, 11, 13, 14], "belong": [3, 4, 6, 10], "below": [2, 4, 6, 7, 8, 9, 10, 11, 12, 13, 16], "besid": 10, "best": [7, 13], "better": [9, 10], "between": [5, 7, 8, 9, 11, 12], "bgp": [3, 4, 6, 13], "bgpoverlan": [12, 13], "bi": 14, "bidirect": [7, 8], "bill": [3, 6], "bit": [2, 13], "block": [2, 5, 6, 10, 14], "blown": [1, 4, 5, 11], "blue": [4, 8], "bootcamp": 1, "bootstrap": [1, 11], "border": [4, 13], "both": [2, 3, 4, 6, 7, 9, 10, 11, 13], "bottom": [6, 7, 10, 11], "branch": [8, 11, 12], "bring": 9, "broken": [4, 7], "browser": [1, 11], "build": [5, 7, 12], "bunch": 13, "bundl": 11, "busi": 9, "button": [2, 3, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "bypass": 4, "c6in": 7, "call": [1, 4, 6, 11, 14], "can": [2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16], "candid": 10, "cannot": 1, "capabl": [4, 9, 13, 14], "care": 11, "carri": [4, 9], "case": [1, 4, 13], "cat": 12, "caus": [5, 10], "cd": 5, "center": [3, 6], "central": [2, 7, 13], "central1": [3, 4, 6, 7, 8, 11, 12, 13], "centralis": 7, "certif": 11, "cfg": 12, "challeng": 9, "chang": [2, 4, 5, 6, 7, 9, 10, 12, 13], "channel": 11, "check": [0, 2, 4, 9, 10, 11, 12, 13], "checkbox": 4, "chmod": 10, "choos": [4, 6, 9, 10, 11, 12, 14], "chose": 6, "chrome": 1, "cidr": [2, 3, 6, 10, 12, 13], "circl": 7, "class": 1, "classic": 13, "classifi": [4, 6, 14], "clean": 2, "clearli": [4, 7, 10], "click": [0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "client": [1, 3, 6, 9, 10, 13, 14], "clipboard": [5, 7], "close": [5, 7, 13], "cloud": [0, 1, 2, 3, 6, 8, 9, 11, 13, 14], "cluster": [7, 9, 13], "code": [5, 16], "collaps": 7, "color": [2, 8], "column": 6, "com": [10, 12, 14], "comfort": 1, "command": [5, 6, 7, 9, 10, 12, 13, 14], "commit": [4, 6, 7, 10, 11, 14], "commun": [4, 7, 8, 9, 11, 14], "compar": 5, "complement": 5, "complet": [2, 4, 6, 7, 11, 12, 13, 14], "complianc": 9, "compon": [4, 7], "compris": 7, "compromis": 13, "condit": [4, 6, 10, 14], "conf": 12, "config": 9, "configur": [1, 2, 4, 5, 6, 10, 13], "confirm": [2, 4, 6, 7, 9, 11, 13], "conflict": 2, "congratul": 5, "connect": [5, 10], "connet": 4, "consid": 13, "consol": [7, 9, 12], "construct": [1, 2, 9], "consum": [7, 10], "contact": [10, 11], "contain": [4, 5], "content": [5, 12, 14], "continu": [2, 6, 10, 11], "control": [2, 4, 5, 9, 11, 12, 13, 15], "converg": 9, "coonfigur": 12, "copi": [5, 6, 7, 10, 12, 14], "copilot": [1, 2, 3, 4, 5, 6, 10, 11, 12, 13, 14, 15], "core": 8, "corner": [2, 7, 9, 11], "corpor": 1, "correct": 10, "correctli": 13, "correspon": [3, 6], "correspond": [4, 5, 6, 7, 10, 11], "cost": [3, 6, 10], "costiq": [0, 1], "could": [7, 9, 10, 12], "cours": [10, 13], "cover": 1, "creat": [3, 7, 8, 9, 11, 12, 13], "creation": [1, 7, 8, 10, 11, 12, 13, 14], "credenti": [2, 5, 7, 9, 11, 13], "criteria": [6, 14], "critic": 4, "csp": [4, 7, 8, 10, 12, 14], "ctrl": 5, "cumbersom": 7, "curl": [6, 10, 14], "current": [4, 7, 10, 11], "custom": [1, 8, 11], "customis": 8, "dai": 1, "dash": [7, 9], "dashboard": [7, 11], "data": [4, 5, 6, 10, 13, 14], "databas": [6, 14], "db": [13, 14], "dc": [6, 7, 12, 13], "dcf": [6, 11], "deafultthreatgroup": [6, 14], "decis": [5, 10, 13], "declar": 5, "decrypt": 4, "dedic": [1, 4], "deem": [6, 14], "default": [2, 4, 6, 7, 9, 10, 11, 12, 13, 14], "defaultdenyal": [10, 11], "defaultdenyrul": 10, "defend": 14, "defin": [2, 3, 4, 6, 8, 11, 13], "delet": [6, 10, 14], "deliv": 13, "demonstr": [3, 4, 6, 9, 10, 13, 14], "deni": [11, 14], "depend": 9, "depict": [2, 7, 8, 9, 12, 13], "deploi": [1, 2, 4, 5, 7, 11, 12, 13], "deploy": [2, 5, 6, 7, 12, 14], "describ": 13, "design": [0, 1, 7, 15], "desir": [5, 8], "desktop": [1, 5, 13], "despit": 4, "destin": [4, 6, 9, 10, 11, 13, 14], "detail": [3, 9], "detect": [10, 14], "determin": 6, "determinist": 9, "devic": [5, 12, 13], "diagnost": [3, 6, 9, 12, 13], "dictat": 7, "didn": 9, "differ": [2, 6, 7, 8, 9], "difficult": 7, "dig": 12, "direct": [4, 7, 14], "directli": [4, 5, 7, 8, 9], "directori": 5, "disabl": 9, "discov": [3, 4, 6], "dismiss": 11, "displai": 9, "disrupt": [9, 10], "distinct": 4, "distribut": [0, 1, 3, 6, 10, 11, 14], "dn": [7, 10, 11, 12], "do": [2, 4, 5, 6, 7, 8, 9, 10, 11, 13, 14], "doc": 5, "document": 1, "doe": [1, 4, 5, 7, 9, 11, 12], "doesn": 11, "domain": [4, 10, 11, 14], "don": [4, 7, 9], "done": 9, "dot": [3, 6, 7, 10, 11, 13, 14], "down": [1, 2, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "download": [0, 5, 9], "draft": [4, 6, 10, 11, 14], "draw": [4, 12], "driven": [5, 12], "drop": [2, 4, 7, 9, 10, 11, 12, 13], "due": [4, 10, 11, 12, 13], "dure": 4, "dynam": [4, 7], "e": [1, 2, 4, 7, 8, 10, 11, 12, 13], "each": [1, 2, 4, 7, 8, 9, 11, 12, 13], "earli": 11, "earlier": [9, 11, 13, 14], "eas": 8, "easi": 12, "easili": 5, "east": [1, 3, 5, 6, 8, 9, 10, 11, 13, 14], "east1": [6, 9], "east2": [4, 7, 9, 10], "ec2": [4, 6, 7, 9, 13], "echo": 4, "edg": [0, 1, 3, 5, 6, 7, 12, 15], "edit": [6, 7, 8, 9, 11, 12, 13], "editig": 12, "effect": 10, "egress": [1, 11, 13], "eight": 2, "either": [7, 8, 12, 14], "element": [5, 7], "email": 6, "embrac": 11, "employe": 1, "empti": [4, 6, 10, 13], "emul": 12, "enabl": [4, 5, 6, 8, 11, 13, 14], "encompas": 4, "encrypt": [0, 1, 7, 12, 13], "end": [0, 1, 2, 6, 8, 9, 10, 11, 12, 13], "enforc": [4, 11, 14], "enforcement": 14, "engin": 9, "eni": 9, "ensur": [4, 6, 7, 10, 14], "enter": [4, 5, 6, 7, 9, 10, 11, 13, 14], "enterpris": [4, 7, 8, 9], "entir": 9, "entri": [6, 10, 11, 14], "environ": [4, 5, 7, 8, 10], "eod": 0, "equal": 13, "error": 11, "espn": 10, "essenti": 10, "establish": [4, 5, 7, 10, 12, 13], "etc": 12, "ethernet1": 11, "etho": 13, "evalu": 10, "even": 11, "everi": 14, "everyth": 10, "evid": 4, "exact": 7, "exactli": [13, 14], "exampl": [2, 12], "except": 4, "exchang": 13, "exclud": 4, "exclus": 10, "execut": [4, 5, 10, 13], "exercis": [0, 5], "exist": [2, 4, 7, 10, 11, 12, 13], "expand": [2, 4, 7, 9, 12, 13], "expens": 11, "experi": [6, 7, 9, 11], "explicit": 11, "explicitli": 5, "explor": [2, 5, 8, 10, 13, 14], "export": 13, "extend": [8, 13], "extern": 12, "fabric": [4, 6, 8, 9, 10, 11, 12, 13, 14], "facilit": 11, "fact": [4, 7, 10], "fail": [4, 6, 9], "familiaris": 2, "far": 13, "fast": 9, "featur": [3, 4, 8, 9, 12, 13], "fetch": 7, "few": 5, "field": [2, 4, 6, 7, 10, 11, 12, 13], "fifteen": 7, "figur": [4, 7], "file": [5, 11, 12], "filer": 7, "fill": [9, 13], "filter": [2, 4, 6, 9, 10, 11, 12, 13, 14], "final": [2, 3, 4, 6, 7, 8, 9, 10, 11, 14], "find": [3, 5, 6, 7, 9, 10, 14], "finish": 5, "firefox": 1, "firenet": [1, 2], "firewal": [0, 1, 6, 8, 10, 12, 14], "first": [4, 5, 6, 9, 10, 11, 12, 13, 14], "flag": 4, "flat": [4, 8], "flexibl": 4, "flow": [3, 9, 11, 13], "flowiq": [6, 9], "folder": [5, 11], "follow": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "footbal": 10, "foremost": [6, 10, 13], "forget": [4, 6, 7, 9, 10, 11, 13, 14], "format": 9, "forward": 9, "found": 10, "four": 2, "frequent": [6, 7], "fresh": 1, "fridai": [0, 1], "from": [1, 3, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "full": [1, 4, 5, 7, 10, 11, 13], "function": [1, 2, 4, 7, 9, 10, 11, 13, 14], "furthermor": 10, "fw": 11, "g": [1, 7], "garden": 9, "gatewai": [1, 2, 3, 4, 5, 6, 10, 11, 12, 13, 14, 15], "gateweai": 14, "gather": 10, "gcp": [3, 4, 6, 8, 9, 12, 13], "gener": [4, 5, 9, 11], "get": [2, 3, 6, 7, 9, 10, 11], "githubusercont": 10, "give": [7, 13], "given": 1, "global": [2, 5, 6, 7, 14], "go": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "goe": 9, "good": 10, "googl": 10, "got": [2, 4, 13], "govern": [4, 13], "grafana": 5, "grant": 2, "granular": 10, "grayedout": 13, "green": [2, 4, 7, 8, 9, 11, 12, 13], "greendfield": 10, "greenfield": [6, 10, 11, 14], "grei": [7, 11, 12], "group": [6, 8, 9, 10, 14], "guarante": 10, "guid": [5, 7], "gw": [4, 7, 8, 9, 10, 11, 12], "ha": [2, 4, 5, 6, 7, 9, 10, 11, 13], "had": 11, "hand": [2, 4, 6, 7, 9, 10, 11, 13, 14], "handf": 2, "handl": 11, "happen": 7, "har": 13, "hardwar": 5, "have": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13], "heal": 9, "health": [7, 9], "help": [8, 9, 10], "henc": 11, "here": [2, 5, 7, 8, 9, 12, 13], "hidden": [5, 6], "high": [0, 1, 7], "highest": 13, "highlight": 8, "hit": [2, 10, 11], "home": 5, "hop": [9, 13], "host": [3, 5, 10, 12], "hour": 6, "hourglass": 2, "hover": 8, "how": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "howev": [4, 7, 10], "hpe": [7, 13], "http": [5, 6, 10, 11, 14], "hub": [4, 7, 8], "huge": 9, "hybrid": [9, 13], "hyperlink": 11, "i": [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "iac": [0, 1], "icmp": [7, 11, 12], "icon": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "id": [4, 7], "identifi": [5, 6, 7, 12, 14], "igw": [2, 4, 6, 10, 14], "ikev2": 12, "imag": 11, "immedi": [2, 3, 5, 6, 7, 10, 11, 12], "impact": [4, 10], "implement": 8, "improv": 10, "inadvert": 10, "includ": [1, 3, 7, 11, 15], "increasingli": 7, "inde": [4, 7, 13], "indic": [7, 10, 11], "individu": 5, "inetutil": 13, "info": [2, 3, 6, 8, 9, 11, 13], "inform": [2, 5, 7, 9, 10], "infrastructur": [5, 7], "ingress": 11, "init": 5, "initi": [1, 4, 5, 6, 10, 11, 12, 14], "inject": 10, "inner": 7, "input": 9, "insan": [1, 9], "insert": [2, 4, 5, 6, 7, 10, 11, 13, 14], "insid": [1, 2, 5, 6, 7, 10, 13], "insight": [1, 3, 6, 10], "inspect": [6, 8, 11, 13, 14], "instal": [1, 4, 10, 13], "instanc": [1, 4, 6, 7, 8, 9, 11, 12, 13, 14], "instant": 10, "instanti": [7, 9], "instead": 12, "instructor": [6, 14], "integr": 5, "intellig": 9, "intend": 1, "interconnect": 13, "interfac": [2, 5, 9, 11, 13], "internet": [2, 10, 11, 12, 14], "interrupt": 9, "interv": 7, "intra": 7, "introduc": 11, "introduct": 0, "intrus": 10, "invalid": 11, "investig": [4, 5], "invis": 10, "invok": [2, 9], "involv": [4, 7, 12, 13], "io": 5, "ip": [1, 4, 6, 8, 10, 11, 12, 13], "ipsec": [7, 12], "ipv4": 14, "island": 5, "isol": 7, "issu": [6, 7, 10, 12, 14], "istanc": 7, "item": 7, "its": [4, 6, 7, 9, 10, 11, 12, 13, 14], "itself": 14, "just": [2, 4, 7, 9, 11, 13], "keep": [9, 12], "kei": [4, 5, 11, 12, 14], "kept": [3, 6], "keyboard": [5, 13], "keyword": 7, "kibibyt": 13, "kind": [9, 10, 13], "kindli": 6, "knob": [4, 9, 10, 11, 13], "know": [5, 6, 10, 11], "knowledg": 0, "known": [6, 7, 9, 10], "lab11": 5, "lab2": 7, "lab3": [4, 7], "lab6": 11, "lab7": 12, "lab8": 12, "lan": [12, 13], "land": 13, "laptop": [1, 10, 12], "larg": [7, 9], "larger": 5, "last": [4, 6, 9, 10, 14], "latenc": 9, "later": [1, 8, 11], "latest": 5, "launch": [9, 10, 12, 13, 14], "layer": [8, 10], "learn": [1, 3, 6, 11, 13], "least": [9, 10, 14], "left": 2, "legend": 7, "length": 13, "less": 5, "lesson": 5, "let": [0, 2, 3, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "leverag": 4, "like": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "likewis": [1, 7, 8, 14], "line": [5, 7, 9, 13], "link": [0, 2, 9, 14, 15], "list": [2, 4, 6, 7, 10, 11, 13, 14], "littl": [2, 13], "live": 5, "ll": 7, "load": 11, "local": [3, 4, 6, 10, 12, 13], "locat": [4, 5, 7], "lock": 4, "log": [2, 4, 5, 6, 7, 10, 11, 14], "logic": [4, 7, 8, 9], "login": [2, 5, 9, 11], "logo": 7, "long": 11, "look": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "lose": 5, "lost": 7, "lot": [5, 11], "love": 5, "lower": 4, "lunch": 5, "lx": 13, "lxtermin": 5, "m497": 16, "mac": 5, "machin": [5, 6, 7, 10, 14], "magic": 11, "mai": [1, 6, 7, 9, 11, 13], "main": 5, "maintain": [5, 6, 7], "major": 7, "make": [2, 5, 6, 7, 9, 10, 11, 14], "malciou": 14, "malici": [1, 6, 10], "maliciu": 14, "manag": [4, 7, 11, 12, 13], "mani": 6, "manifest": 5, "manipul": [11, 13], "manner": 12, "manual": [7, 12], "map": [2, 7, 11, 12, 13], "marketplac": 11, "master": 10, "match": [4, 10, 11, 14], "maximum": [7, 11], "mayb": 11, "mc": 5, "mcna": [0, 1, 4, 7, 13], "mean": [5, 7, 10, 11, 13], "meanwhil": 7, "mechan": [13, 14], "medium": [6, 7, 9, 14], "meet": [6, 14], "mention": 1, "menu": [5, 8, 13], "mesh": [4, 5, 7], "messag": [2, 7, 10, 11, 13], "metadata": 6, "method": [4, 12], "metric": [4, 7, 9], "mgmt": 11, "micro": 5, "middl": 11, "might": [6, 7, 9, 11, 14], "mind": [2, 7, 9, 13], "minut": [2, 4, 5, 6, 7, 9, 11, 12, 13, 14], "misconfigur": 7, "mod01": 0, "mod02": 0, "mod03": 0, "mod04": 0, "mod05": 0, "mod06": 0, "mod07": 0, "mod08": 0, "mod09": 0, "mod10": 0, "mod11": 0, "mod12": 0, "mod13": 0, "mod14": 0, "mod15": 0, "mod16": 0, "mod17": 0, "mode": [1, 9, 10], "modifi": 9, "modul": 5, "monitor": [2, 4, 6, 9, 10, 11, 13], "more": [4, 5, 6, 9, 14], "moreov": [2, 7, 11], "move": [3, 5, 6, 10], "much": 13, "multi": [1, 7, 11, 13], "multicloud": [1, 5, 8], "multipl": [7, 13], "must": [1, 7, 11, 14], "n": [6, 9, 14], "n1": 7, "nacl": 9, "name": [2, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "namespac": 5, "nat": [4, 10, 12], "nativ": [7, 9, 10], "navig": [2, 5, 6, 7, 11], "nearbi": 4, "need": [5, 6, 7, 9, 10, 11, 12, 13], "neither": [8, 14], "netflow": [6, 10, 13], "network": [0, 1, 4, 12], "networkinsight": 0, "never": 4, "nevertheless": [10, 13], "new": [4, 5, 7, 8, 9, 11, 12, 13], "newli": 5, "next": [5, 6, 7, 9, 11], "ngfw": [4, 11], "nginx": 14, "nine": [7, 9], "node": [7, 8], "non": [9, 10], "nor": 14, "normal": [4, 7], "north": 11, "note": [4, 6, 11, 14], "notic": [1, 2, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "notif": [2, 6, 13], "notifi": 13, "now": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "nslookup": 12, "number": [4, 7, 9, 12, 13], "o": [10, 12], "observ": [2, 7, 10], "occur": [4, 7, 8], "off": [7, 9, 10, 13], "offici": 5, "ohio": 7, "ok": [4, 12], "onboard": 8, "onc": [2, 4, 5, 6, 7, 9, 11, 13], "one": [1, 2, 3, 4, 6, 7, 9, 10, 11, 12, 13, 14], "onli": [2, 4, 7, 8, 10, 11], "onprem": 12, "onprempartn": 12, "onward": 6, "open": [2, 4, 5, 7, 8, 13], "oper": 13, "opposit": 7, "optim": 10, "option": [6, 8, 10, 12, 13, 14], "orchestr": [4, 11, 13], "order": [6, 7, 8, 9, 10, 11, 13], "oregon": 2, "org": 10, "other": [1, 4, 5, 7, 8, 9, 10, 12], "otherwis": 1, "our": 5, "out": [3, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "outboud": 1, "outcom": [4, 6, 9, 10, 11, 13, 14], "outer": 7, "output": 10, "over": [5, 8, 12, 13], "overal": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "overcom": 9, "overlap": [1, 2, 12], "overview": [9, 10, 13], "own": [10, 13], "owner": 4, "pacif": 1, "packag": [1, 11, 13], "packet": [10, 14], "page": [2, 5, 7, 9, 11], "pai": [1, 7], "pair": [7, 9], "palo": [1, 11], "paloalto": 11, "panel": 2, "parament": 11, "paramet": [4, 6, 7, 10, 11, 14], "particular": 1, "partner": [1, 8, 11, 12], "partner1": 12, "pass": 11, "password": [2, 10, 11, 13], "past": [5, 11], "path": [9, 10, 14], "patient": [2, 7, 9, 11, 12], "pc": 1, "pdf": 9, "peer": [4, 13], "pencil": [6, 7, 8, 9, 10, 11], "pend": [7, 9], "per": [2, 7], "perfect": 5, "perfectli": [4, 7], "perform": [0, 1, 7, 10], "period": [2, 6], "permit": [1, 4, 6, 10, 11, 14], "person": [1, 2, 4, 5, 6, 7, 12, 13, 16], "perspect": 13, "pictur": 16, "ping": [3, 4, 6, 7, 8, 9, 11, 12, 13], "pingabl": 4, "pinpoint": [6, 10], "place": [4, 10, 12], "plan": 5, "plane": [4, 10, 13], "platform": [5, 7, 11], "pleas": [0, 1, 2, 4, 6, 7, 9, 11, 12, 13, 14], "pod": [1, 2, 4, 5, 7, 8, 9, 10, 11, 12, 13], "point": [2, 4, 6, 7, 8, 9, 10, 14], "polici": 4, "pop": [2, 4, 6, 7, 10, 11, 13, 14], "popul": 11, "port": [1, 4, 7, 9, 10, 11], "portal": [1, 2, 4, 5, 7, 10, 11, 12, 13], "possibl": [4, 10, 11], "postur": 10, "potenti": 10, "power": [7, 13], "practic": 7, "pre": [1, 7, 9, 11, 12], "preconfigur": 12, "prefer": [4, 13], "prefix": [7, 11], "prem": [7, 9, 11, 13], "premis": [8, 12], "prepar": [1, 5, 11], "prepend": 6, "preprovis": 7, "presenc": [7, 10, 12, 13], "present": [4, 11], "press": 5, "prevent": [0, 1, 4], "preview": 4, "previou": [4, 5, 7, 9], "previous": [2, 5, 6, 9, 10, 13], "primari": 13, "prioriti": 10, "privat": [2, 4, 7, 8, 9, 11, 12, 13], "proce": [4, 7, 10, 13], "proceed": [6, 7, 9], "process": [1, 5, 7, 13], "product": 7, "prof": 0, "program": [9, 11], "progress": [2, 6, 7, 11, 14], "prometheu": 5, "prompt": [5, 11], "proofpoint": [6, 14], "properli": 4, "properti": [7, 9], "propos": 5, "protect": [6, 14], "protocol": [4, 6, 7, 9, 10, 11, 13, 14], "provid": [1, 3, 5, 6, 7, 9, 10, 14], "provis": [7, 11, 13], "psk": 12, "public": [2, 4, 7, 9, 10, 11, 12, 13, 14], "public_ip": [7, 8], "publlic": 10, "pull": 8, "purpos": [2, 10], "pwd": 10, "queri": 10, "quickli": 5, "quit": 4, "rang": [2, 10], "rate": [5, 13], "rather": 5, "raw": 10, "rbac": 0, "reach": [4, 10, 12, 13, 14], "reachabl": [4, 8, 9], "read": [6, 14], "readi": [11, 13], "real": 12, "reason": 4, "receiv": [5, 6, 11], "recipi": 6, "recommend": [4, 7], "reconverg": 9, "recreat": 11, "recurs": [9, 12], "red": [9, 11, 12], "reduc": 10, "redund": 13, "refer": [2, 4, 5, 6, 7, 8, 9, 10, 11, 12], "reflect": [2, 4, 7, 9, 12], "refresh": [2, 6, 7, 9, 10, 11, 12, 13], "regard": 13, "region": [1, 2, 4, 6, 7, 9, 13, 14], "regist": 13, "registri": 5, "regularli": [6, 14], "rel": [3, 6], "relat": [4, 11, 13, 14], "relaunch": [4, 9, 13], "relev": [4, 8], "reli": [6, 7], "remain": [3, 6, 7, 9, 10], "rememb": 11, "remot": [5, 12, 13], "remov": [0, 6, 9, 10], "repeat": [3, 4, 6, 7, 9, 13], "replac": [10, 12], "replace_with_spoke_gw_public_ip": 12, "repli": 4, "report": [6, 9], "repres": [7, 8, 10], "reput": [6, 14], "request": 10, "requir": [3, 4, 5, 6, 8, 9, 11], "rerout": 10, "resid": [6, 7, 9, 14], "resili": 9, "resolv": 12, "resourc": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 14], "respect": [7, 8, 9], "respons": 11, "rest": [4, 7, 13], "restart": 9, "restor": [2, 14], "restrict": [1, 8], "result": [2, 7], "retest": [8, 9], "retriev": [10, 11, 12, 14], "return": 11, "reveal": 13, "reverifi": 9, "rfc": [9, 10, 11], "rfc1918": [9, 10, 11], "rib": 7, "rid": 11, "right": [1, 2, 4, 6, 7, 9, 10, 11, 13, 14], "root": 10, "roughli": 11, "rout": [2, 3, 4, 6, 8, 10, 12, 13, 14], "router": [1, 11, 12, 13], "row": [6, 11], "rtb": 9, "rule": 11, "run": [3, 5, 6, 7, 9, 12, 13], "safari": 1, "sake": 7, "same": [2, 4, 5, 6, 7, 9, 10, 11, 13], "save": [2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "scalabl": 9, "scale": 11, "scenario": [10, 12], "scope": 1, "scratch": 12, "screen": [11, 12, 13], "screenshot": [2, 6, 7, 9, 14], "script": 12, "scroll": [9, 13, 14], "sd": 13, "sdn": 13, "search": [2, 4, 6, 7, 9, 10, 12, 13, 14], "second": [7, 9, 11, 13], "section": [2, 4, 5, 6, 7, 9, 11, 12, 13, 14], "secur": [0, 1, 4, 5, 6, 8, 9, 11, 14], "see": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13], "seem": 13, "segment": [0, 1, 11, 13], "segreg": 8, "select": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "self": 11, "semplic": 7, "send": [6, 14], "sens": 4, "sent": [4, 14], "separ": [1, 4, 9], "seri": [1, 11], "server": [5, 7, 10], "servic": [2, 4, 6, 7, 9, 10], "session": [4, 5, 9, 11, 12, 14], "set": [4, 5, 6, 7, 9, 11, 12, 14], "sever": [4, 7], "sg": [4, 6, 10], "sh": 12, "share": [1, 6, 11, 12], "shift": 5, "should": [1, 3, 4, 5, 6, 7, 10, 11, 14], "show": [3, 4, 5, 6, 7, 9, 10, 11, 13], "shown": [2, 6, 7, 8, 11, 14], "shut": 9, "side": [2, 4, 6, 7, 9, 10, 11, 12, 13, 14], "sidebar": 5, "sign": [7, 11], "significantli": 11, "similar": [4, 8, 12, 13], "simpl": [5, 7], "simpli": 10, "simplic": 7, "simplifi": [5, 7, 11], "simultan": [9, 13], "sinc": [2, 8, 12], "singl": [1, 4, 7, 9, 10, 13], "sit": 10, "site": 12, "site2cloud": [0, 1, 8], "six": 7, "size": [6, 7, 9, 11, 14], "slide": 0, "slider": 10, "slow": 11, "smartgroup": [4, 11], "smoothli": 4, "snat": [10, 11], "so": [1, 8], "softwar": 13, "sole": [4, 9, 10, 14], "solid": [7, 9], "solut": [1, 4, 5, 8, 11, 13], "some": [1, 2, 5, 7, 9, 11, 13, 14], "someth": 7, "soon": [0, 2, 7], "sourc": [4, 5, 6, 9, 10, 11, 14], "south": 11, "space": [2, 11, 12], "special": [1, 7], "specialti": [6, 14], "specif": [1, 7, 10, 11], "specifi": 10, "speed": 9, "splash": 11, "spoke": [1, 2, 8, 10, 12, 14], "spoke1": [2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13], "spoke2": [1, 3, 4, 6, 7, 8, 9, 11], "ssh": [1, 6, 8, 9, 11, 12, 13], "ssl": 10, "stage": [7, 9], "standalon": 14, "standard": 7, "standard_b2m": 7, "standard_d3_v2": 11, "start": [2, 7, 10, 12], "stat": [5, 9], "state": [4, 5, 7, 9, 11], "statement": 5, "statemet": 5, "static": [7, 11, 12], "statist": 5, "statu": [2, 5, 7, 9, 12], "step": [1, 7, 9, 11], "still": [4, 9, 11, 13], "stop": [6, 9], "storag": 11, "stream": 11, "string": [11, 12], "strong": 11, "strongswan": 1, "student": [1, 7, 8, 10, 13], "studio": 5, "su": 10, "sub1": [2, 7], "subnet": [2, 3, 4, 7, 9, 11, 12, 13, 14], "subscript": 11, "subsequ": [2, 7, 12, 13], "success": [4, 7, 10, 11, 13], "successfulli": [2, 4, 6, 7, 10, 11, 13], "sudo": [10, 12, 13], "suggest": 6, "summari": [6, 9, 14], "support": 1, "sure": [2, 6, 7, 11, 14], "suricata": [4, 10], "survei": 0, "swanctl": 12, "switch": 9, "symbol": [7, 11, 12], "syn": 14, "system": 10, "t": [4, 7, 9, 10, 11], "t2": [6, 7, 14], "tab": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "tabl": [2, 4, 6, 8, 9, 10, 11, 14], "tag": [4, 6, 14], "take": [2, 4, 7, 9, 11, 13], "taken": 11, "target": [10, 13], "task": [2, 7, 12, 13], "tcp": [4, 7, 9], "technologi": 9, "templat": [2, 6, 11, 12, 13, 14], "temporari": 9, "temporarili": 9, "term": 7, "termin": [3, 4, 6, 7, 8, 12, 13], "terraform": 1, "test": [1, 4, 6, 8], "test1": [4, 6, 7, 8, 9, 10, 11, 12, 13], "test2": [4, 7, 9, 10], "testmynid": 10, "tf": 5, "tfstate": 5, "tfvar": 5, "than": 5, "thank": [4, 10], "thei": [0, 2, 3, 6, 13], "them": [5, 7, 8], "ther": 10, "therefor": [2, 4, 5, 6, 7, 10, 11, 13], "thi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], "thing": 5, "thit": 4, "thoroughli": 4, "those": [7, 9, 13, 14], "threat": [0, 1, 4, 6], "threatgroup": [1, 6], "threatguard": 6, "threatiq": 14, "three": [3, 4, 6, 7, 8, 10, 11, 13, 14], "threee": 13, "through": [2, 4, 8, 9, 10, 11, 13, 14], "throughout": 1, "throughput": 11, "thu": 13, "tier": 1, "time": [1, 2, 4, 6, 7, 8, 9, 10, 11, 13], "timer": [7, 9], "timestamp": [6, 10], "tl": 4, "tmnid": 10, "tmp": 10, "togeth": 0, "toggl": [6, 10], "too": 11, "tool": 12, "top": [2, 7, 9, 11, 13], "topologi": [3, 4, 5, 13], "topopologi": 7, "tor": 10, "torn": 1, "total": 7, "toward": [3, 5, 7, 9, 10, 11, 13], "tracerout": 13, "traffic": [3, 7, 9, 11, 13], "train": [0, 1], "trainer": [1, 14], "transit": [0, 1, 2, 14], "transit_gatewai": 5, "translat": 10, "transmit": 5, "travers": [4, 7], "tri": 10, "trigger": [2, 6], "troubl": 5, "troubleshoot": [7, 13], "trust": [4, 5], "try": [4, 10, 11, 14], "tunnel": [7, 9, 12], "turn": [4, 6, 9, 10, 11, 13], "turnkei": 11, "two": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13], "type": [2, 6, 7, 10, 12, 13, 14], "typic": [4, 12], "u": [1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13], "ubuntu": 14, "udp": [10, 11], "ui": [2, 5, 6, 7, 13], "ultim": 13, "unaffect": 10, "unattach": 9, "under": [6, 7, 11, 13], "underlai": [2, 13], "underli": 9, "understand": [4, 10], "undoubtedli": 4, "uniqu": [4, 11], "unless": [1, 8], "unmanag": 7, "unreach": 9, "until": [1, 4, 5, 11, 13], "untrust": 9, "unus": [6, 14], "up": [2, 4, 6, 7, 10, 11, 12, 14], "updat": [6, 7, 12, 14], "update_swanctl": 12, "upon": 10, "url": [2, 4, 9, 10, 11, 14], "us": [1, 2, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15], "user": [0, 2], "usernam": 11, "util": [3, 6, 9], "utilis": [1, 12], "v": 5, "valid": [1, 4, 6, 7], "valu": [2, 4, 6, 7, 10, 14], "vari": 11, "variabl": 5, "variou": 7, "vcn": [4, 7, 8, 9, 11], "vendor": 5, "veri": [4, 7, 10, 11, 13, 14], "verif": 2, "verifi": [1, 6, 7, 8, 9, 10, 12, 13, 14], "version": [5, 11], "via": [11, 13], "view": [2, 6, 7, 8, 14, 16], "virginia": [6, 9, 14], "virtual": [6, 7, 10, 11, 12, 14], "visibl": [9, 10, 13], "visual": 5, "vm": [1, 7, 8, 11, 13], "vnet": [1, 3, 4, 6, 7, 8, 9, 10, 11, 12, 14], "vpc": [1, 3, 4, 6, 7, 8, 10, 11, 12, 13, 14], "vpn": 0, "wa": [2, 4, 5, 6, 9, 10, 11, 12, 13, 14], "wai": 6, "wait": [2, 6, 9, 11, 12, 13, 14], "wall": 9, "wan": 13, "want": [2, 4, 7, 10], "warn": 11, "watch": 10, "we": [5, 6, 7, 8, 9, 10, 11, 12, 14], "web": [2, 6, 7, 9, 10, 11], "webgroup": [6, 14], "websit": 10, "week": [0, 1], "welcom": 11, "well": [6, 7, 8, 9], "were": [9, 11], "west": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11], "west2": [2, 7], "what": [4, 5, 6, 7, 8, 9, 10, 12], "when": [5, 6, 7, 9, 11, 13, 14], "where": [4, 5, 6, 9, 11, 14], "wherea": [7, 13], "wherebi": 10, "whether": [2, 4, 10], "which": [1, 5, 7, 10, 11], "while": [6, 7, 8, 11, 14], "white": 2, "whole": [4, 14], "whom": 10, "why": 9, "widget": [5, 7, 13], "wikipedia": 10, "window": [2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 14], "within": [7, 9, 10, 11, 12, 13], "without": [4, 7, 8, 10, 11, 13], "wll": 10, "word": 1, "work": [3, 4, 5, 6, 10, 11, 12], "workflow": 12, "workload": [6, 7, 8, 14], "workstat": [3, 5, 6, 13], "wortkstat": [3, 6], "would": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "www": [10, 14], "x": 10, "ye": 5, "yet": [4, 7, 9, 11, 13], "york": [6, 12, 13], "you": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16], "your": [1, 2, 3, 5, 6, 7, 9, 10, 11, 12, 13, 14, 15, 16], "yourself": 2, "zero": 4, "zone": [2, 6, 7, 9, 10, 11], "zoom": 1, "ztna": 14}, "titles": ["PDFs", "Welcome to ACE Professional Lab", "Lab 1 - VPCs/VNets CREATION", "Lab 10 - COSTIQ", "Lab 11 - DISTRIBUTED CLOUD FIREWALL", "Lab 12 - IAC & NETWORK INSIGHTS API", "Lab 9 - THREATIQ & COSTIQ", "Lab 2 - TRANSIT NETWORKING", "Lab 3 - NETWORK SEGMENTATION", "Lab 4 - HPE WITH ACTIVE MESH", "Lab 5 - CLOUD PERIMETER SECURITY (Secure Cloud Egress)", "Lab 6 - FIRENET", "Lab 7 - SITE2CLOUD", "Lab 8 - SECURE HIGH-PERFORMANCE DATACENTER EDGE", "Lab 9 - THREAT PREVENTION", "LOGOS-ICONS", "POD Portal"], "titleterms": {"": [12, 13], "0": 14, "1": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "10": 3, "11": 4, "12": 5, "2": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "3": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "33ecff": 7, "4": [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "5": [1, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "6": [4, 6, 7, 8, 9, 10, 11, 13, 14], "7": [4, 9, 12, 13, 14], "8": [13, 14], "9": [6, 14], "A": 6, "As": 13, "It": 13, "On": 12, "WITH": 9, "ac": 1, "access": 1, "activ": [4, 9], "activemesh": 9, "ad": [6, 10], "add": 4, "address": 7, "after": 9, "again": 14, "allow": [4, 14], "an": [4, 6, 7, 10], "api": 5, "app": 7, "architectur": 10, "asset": 7, "associ": [9, 13], "attach": [4, 5, 7, 8, 9, 13], "automat": 6, "aviatrix": [7, 8, 9], "aw": [2, 7, 14], "azur": [2, 7, 11], "bad": [6, 14], "befor": 9, "between": [4, 13], "bonu": [7, 9], "bu1": 4, "bu2": 4, "check": 7, "client": 7, "cloud": [4, 7, 10, 12], "color": 7, "configur": [7, 8, 9, 11, 12], "connect": [4, 7, 8, 9, 11, 12, 13, 14], "consol": 2, "control": 10, "copilot": [7, 8, 9], "costiq": [3, 6], "creat": [2, 4, 5, 6, 10, 14], "creation": [2, 4], "datacent": 13, "db": 7, "dc": 3, "dcf": [4, 10, 14], "deni": 10, "deploi": [6, 14], "deploy": 11, "descript": 5, "distribut": 4, "domain": [8, 9, 13], "drop": 6, "east": [4, 7], "east1": [4, 14], "ec2": 10, "edg": 13, "edit": 10, "egress": 10, "enabl": [3, 9, 10], "encrypt": 9, "enforc": [6, 10], "expect": 5, "explicit": 10, "explor": 7, "fabric": 7, "featur": 10, "final": 13, "firenet": 11, "firewal": [4, 11], "flightpath": 9, "flowiq": 13, "forc": 6, "from": [2, 4], "gatewai": [7, 8, 9], "gatu": 7, "gcp": [2, 7, 11], "gener": [6, 10, 12, 13, 14], "get": 1, "group": 4, "gui": [6, 14], "gw": [5, 13], "high": [9, 13], "hoc": [6, 10], "hpe": 9, "i": 3, "iac": 5, "icmp": 4, "icon": 15, "id": 10, "identifi": 10, "implement": 3, "info": 7, "inform": 1, "initi": [7, 13], "insid": [4, 11], "insight": 5, "inspect": 10, "instal": 11, "instanc": 10, "integr": 11, "inter": 4, "intra": 4, "introduct": 2, "ip": [7, 14], "keepal": 9, "lab": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "laptop": 4, "launch": 11, "link": 16, "logo": 15, "malici": 14, "mesh": 9, "modifi": 10, "monitor": 7, "more": 13, "mtt": 4, "multi": 4, "multicloud": 7, "network": [5, 7, 8, 9, 10, 11, 13], "new": [3, 6, 10, 14], "object": [4, 6, 7, 8, 9, 10, 11, 12, 13], "overview": [3, 4, 6, 7, 8, 11, 12, 14], "pan": 11, "path": 13, "pdf": 0, "peer": [5, 7, 9, 11], "perform": [9, 13], "perimet": 10, "pod": 16, "polici": [8, 11], "portal": 16, "prefac": 1, "preliminari": 7, "prem": 12, "prepar": 10, "prepend": 13, "prerequisit": 1, "prevent": 14, "privat": 10, "profession": 1, "provis": 5, "psf": [6, 14], "pt": 9, "public": 6, "question": 9, "resid": 10, "result": 5, "retriev": 7, "rout": [7, 9, 11], "rtb": [6, 10, 14], "rule": [4, 6, 10, 14], "s2c": 12, "secur": [10, 13], "segment": [8, 9], "servic": 3, "set": 13, "share": 3, "simul": 10, "site2cloud": 12, "smart": 4, "smartgroup": [6, 10, 14], "span": 7, "spoke": [4, 5, 7, 9, 11, 13], "spoke1": 14, "ssh": [4, 7, 10, 14], "start": [1, 9], "strongswan": 12, "style": 7, "subnet": [6, 10], "summari": [5, 7], "templat": 9, "terraform": 5, "test": [7, 9, 10, 11, 13, 14], "test1": 14, "than": 13, "threat": 14, "threatgroup": 14, "threatiq": 6, "through": [5, 7], "tier": 4, "topologi": [1, 6, 7, 8, 9, 10, 11, 12, 14], "toward": [4, 6, 14], "traffic": [4, 6, 10, 14], "transit": [4, 5, 7, 8, 9, 11, 13], "trust": 10, "two": 14, "u": [7, 14], "up": 13, "us": 7, "valid": 5, "vendor": 11, "verif": [4, 6, 7, 8, 9, 11, 12, 13, 14], "verifi": [2, 4, 11], "view": 9, "vm": 4, "vnet": 2, "vpc": [2, 5, 9], "webgroup": 10, "welcom": 1, "where": 10, "within": 4, "workload": 10, "york": 3, "your": 4, "zero": 10, "ztna": 10}}) \ No newline at end of file +Search.setIndex({"alltitles": {"1. CostIQ Overview": [[3, "costiq-overview"]], "1. Create VPCs, Transit GW, Spoke GW and Attachment through Terraform": [[5, "create-vpcs-transit-gw-spoke-gw-and-attachment-through-terraform"]], "1. General Objectives": [[12, "general-objectives"], [13, "general-objectives"]], "1. Introduction": [[2, "introduction"]], "1. Objective": [[4, "objective"], [6, "objective"], [7, "objective"], [8, "objective"], [9, "objective"], [10, "objective"], [11, "objective"]], "1. Preface": [[1, "preface"]], "1. ThreatGroup Overview": [[14, "threatgroup-overview"]], "2. Azure VNet": [[2, "azure-vnet"]], "2. Distributed Cloud Firewall Overview": [[4, "distributed-cloud-firewall-overview"]], "2. FireNet Overview (Firewall Network)": [[11, "firenet-overview-firewall-network"]], "2. High Performance Encryption and ActiveMesh": [[9, "high-performance-encryption-and-activemesh"]], "2. Implement CostIQ": [[3, "implement-costiq"]], "2. Initial set-up": [[13, "initial-set-up"]], "2. Multicloud Connectivity Overview": [[7, "multicloud-connectivity-overview"]], "2. Network Segmentation Overview": [[8, "network-segmentation-overview"]], "2. Prerequisites": [[1, "prerequisites"]], "2. Provision through Terraform": [[5, "provision-through-terraform"]], "2. Site2Cloud Overview": [[12, "site2cloud-overview"]], "2. ThreatIQ Overview": [[6, "threatiq-overview"]], "2. Topology": [[10, "topology"], [14, "topology"]], "2.1 Enable CostIQ": [[3, "enable-costiq"]], "2.1 Expected Results": [[5, "expected-results"]], "2.1. Attachment between Edge and the Transit": [[13, "attachment-between-edge-and-the-transit"]], "2.1. Create Azure VNet": [[2, "create-azure-vnet"]], "3. AWS VPC": [[2, "aws-vpc"]], "3. Create Transit Peering": [[5, "create-transit-peering"]], "3. Getting Started with the labs": [[1, "getting-started-with-the-labs"]], "3. Network Domain Association": [[13, "network-domain-association"]], "3. New York DC is the Shared Services": [[3, "new-york-dc-is-the-shared-services"]], "3. PSF": [[14, "psf"]], "3. SSH to the EC2 instance in the Private Subnet": [[10, "ssh-to-the-ec2-instance-in-the-private-subnet"]], "3. Smart Groups Creation": [[4, "smart-groups-creation"]], "3. Topology": [[6, "topology"], [7, "topology"], [8, "topology"], [9, "topology"], [11, "topology"], [12, "topology"]], "3.1 Deploy the PSF": [[14, "deploy-the-psf"]], "3.1 Description": [[5, "description"]], "3.1. Create AWS VPC": [[2, "create-aws-vpc"]], "3.1. Preliminary Monitoring Check Using the Gatus APP": [[7, "preliminary-monitoring-check-using-the-gatus-app"]], "3.1. Smart Group \u201cbu1\u201d": [[4, "smart-group-bu1"]], "3.2 Provision through Terraform": [[5, "id1"]], "3.2 RTB verification": [[14, "rtb-verification"]], "3.2. Preliminary Monitoring Check Using an SSH Client (BONUS)": [[7, "preliminary-monitoring-check-using-an-ssh-client-bonus"]], "3.2. Smart Group \u201cbu2\u201d": [[4, "smart-group-bu2"]], "3.2. Verify from AWS Console": [[2, "verify-from-aws-console"]], "3.2.1 Cloud Assets (to retrieve IP addresses)": [[7, "cloud-assets-to-retrieve-ip-addresses"]], "3.2.2 Topology (to retrieve IP addresses)": [[7, "topology-to-retrieve-ip-addresses"]], "3.3 Expected Results": [[5, "id2"]], "3.3 Verification Using Uour SSH Client": [[7, "verification-using-uour-ssh-client"]], "3.3. Connectivity verification (ICMP)": [[4, "connectivity-verification-icmp"]], "3.4. Connectivity verification (SSH)": [[4, "connectivity-verification-ssh"]], "4. Access Information": [[1, "access-information"]], "4. Aviatrix CoPilot": [[7, "aviatrix-copilot"]], "4. Configuration": [[8, "configuration"], [11, "configuration"], [12, "configuration"]], "4. DCF Rules Creation": [[4, "dcf-rules-creation"]], "4. Edge: Connectivity Test": [[13, "edge-connectivity-test"]], "4. Egress Control": [[10, "egress-control"]], "4. GCP VPC": [[2, "gcp-vpc"]], "4. High Performance Encryption Configuration": [[9, "high-performance-encryption-configuration"]], "4. IAC Summary": [[5, "iac-summary"]], "4. Initial configuration": [[7, "initial-configuration"]], "4. PSF": [[6, "psf"]], "4.0 Generate traffic towards a Malicious IP": [[14, "generate-traffic-towards-a-malicious-ip"]], "4.1 Deploy the PSF": [[6, "deploy-the-psf"]], "4.1 Enable the Egress Control": [[10, "enable-the-egress-control"]], "4.1 SSH to aws-us-east1-spoke1-test1": [[14, "ssh-to-aws-us-east1-spoke1-test1"]], "4.1. Aviatrix Transit Gateways": [[7, "aviatrix-transit-gateways"], [8, "aviatrix-transit-gateways"]], "4.1. Azure Transit to Spoke Peering": [[11, "azure-transit-to-spoke-peering"]], "4.1. CoPilot View before starting": [[9, "copilot-view-before-starting"]], "4.1. Create GCP VPC": [[2, "create-gcp-vpc"]], "4.1. Create an intra-rule that allows ICMP inside bu1": [[4, "create-an-intra-rule-that-allows-icmp-inside-bu1"]], "4.1. Site2Cloud Connection (Cloud to On-Prem)": [[12, "site2cloud-connection-cloud-to-on-prem"]], "4.1.1.Transit Gateway in AWS US-EAST-2": [[7, "transit-gateway-in-aws-us-east-2"]], "4.2 Inspect the Private RTB": [[10, "inspect-the-private-rtb"]], "4.2 Network Domains": [[8, "network-domains"]], "4.2 RTB verification": [[6, "rtb-verification"]], "4.2 Site2Cloud Connection - StrongSwan\u2019s configuration": [[12, "site2cloud-connection-strongswan-s-configuration"]], "4.2. Aviatrix Spoke Gateways": [[7, "aviatrix-spoke-gateways"]], "4.2. Create an intra-rule that allows ICMP inside bu2": [[4, "create-an-intra-rule-that-allows-icmp-inside-bu2"]], "4.2. PAN Firewall Deployment": [[11, "pan-firewall-deployment"]], "4.2. Transit-Spoke Attachment": [[9, "transit-spoke-attachment"]], "4.2.1. Spoke Gateway in AWS": [[7, "spoke-gateway-in-aws"]], "4.2.2. Spoke Gateway in Azure": [[7, "spoke-gateway-in-azure"]], "4.2.3. Spoke Gateway in GCP": [[7, "spoke-gateway-in-gcp"]], "4.3 Generate Traffic": [[10, "generate-traffic"]], "4.3. CoPilot View after Transit-Spoke Attachment": [[9, "copilot-view-after-transit-spoke-attachment"]], "4.3. Explore the Cloud Fabric": [[7, "explore-the-cloud-fabric"]], "4.3. Firewall Configuration": [[11, "firewall-configuration"]], "4.4 Aviatrix Spoke to Transit Gateways Attachments": [[7, "aviatrix-spoke-to-transit-gateways-attachments"]], "4.4 Enable DCF": [[10, "enable-dcf"]], "4.4. Firewall Vendor Integration": [[11, "firewall-vendor-integration"]], "4.4. Transit Peerings Configuration": [[9, "transit-peerings-configuration"]], "4.4.1 Identify the subnet where the private workload resides": [[10, "identify-the-subnet-where-the-private-workload-resides"]], "4.4.1. Spoke to Transit Attachment in AWS": [[7, "spoke-to-transit-attachment-in-aws"]], "4.4.1. Transit Peerings Verification": [[9, "transit-peerings-verification"]], "4.4.2 Create an Ad-Hoc SmartGroup": [[10, "create-an-ad-hoc-smartgroup"]], "4.4.2 Spoke to Transit Attachment in Azure": [[7, "spoke-to-transit-attachment-in-azure"]], "4.4.3 Create a new Rule": [[10, "create-a-new-rule"]], "4.4.3. Spoke to Transit Attachment in GCP": [[7, "spoke-to-transit-attachment-in-gcp"]], "4.5. CoPilot Verification of Spoke-Transit Attachments": [[7, "copilot-verification-of-spoke-transit-attachments"]], "4.5. Verify Routes Installed on Firewall": [[11, "verify-routes-installed-on-firewall"]], "4.6. FireNet Policy": [[11, "firenet-policy"]], "4.6. Multicloud Transit Peerings": [[7, "multicloud-transit-peerings"]], "4.6.1. AWS and Azure": [[7, "aws-and-azure"]], "4.6.2 Azure and GCP": [[7, "azure-and-gcp"]], "4.6.3. GCP and AWS": [[7, "gcp-and-aws"]], "5. - Network Insights API": [[5, "network-insights-api"]], "5. A new SmartGroup for the Public Subnet": [[6, "a-new-smartgroup-for-the-public-subnet"]], "5. Edge: FlowIQ": [[13, "edge-flowiq"]], "5. Enforcement": [[6, "enforcement"]], "5. High Performance Encryption Verification": [[9, "high-performance-encryption-verification"]], "5. Lab Topology": [[1, "lab-topology"]], "5. S2C - Verification": [[12, "s2c-verification"]], "5. Verification": [[4, "verification"], [7, "verification"], [11, "verification"]], "5. Verification of Segment Attachments": [[8, "verification-of-segment-attachments"]], "5. ZTNA - Zero Trust Network Architecture": [[10, "ztna-zero-trust-network-architecture"]], "5.0 Create a new SmartGroup": [[14, "create-a-new-smartgroup"]], "5.1 Create a New WebGroup": [[10, "create-a-new-webgroup"]], "5.1 Create an Ad-Hoc SmartGroup": [[6, "create-an-ad-hoc-smartgroup"]], "5.1 Description": [[5, "id3"]], "5.1 Generate traffic towards the \u201cBad Guy\u201d": [[6, "id1"]], "5.1. Automatic enforcement: \u201cforce-drop\u201d": [[6, "automatic-enforcement-force-drop"]], "5.1. CoPilot Verification": [[8, "copilot-verification"]], "5.1. CoPilot Verification of the VPC Peerings(Transit-Transit and Spoke-Transit)": [[9, "copilot-verification-of-the-vpc-peerings-transit-transit-and-spoke-transit"]], "5.1. Inside Azure": [[11, "inside-azure"]], "5.1. Verification of Transit Peerings on CoPilot (Cloud Fabric)": [[7, "verification-of-transit-peerings-on-copilot-cloud-fabric"]], "5.1. Verify SSH traffic from your laptop to bu1": [[4, "verify-ssh-traffic-from-your-laptop-to-bu1"]], "5.1.1 Launch connectivity test": [[11, "launch-connectivity-test"]], "5.2 Create a new Rule": [[6, "create-a-new-rule"]], "5.2 Create an \u201ceditable\u201d Explicit -Deny-Rule": [[10, "create-an-editable-explicit-deny-rule"]], "5.2 Generate traffic towards the \u201cBad Guy\u201d": [[6, "generate-traffic-towards-the-bad-guy"]], "5.2 Validate": [[5, "validate"]], "5.2. Azure to GCP": [[11, "azure-to-gcp"]], "5.2. CoPilot Verification of HPE": [[9, "copilot-verification-of-hpe"]], "5.2. Verification of Transit Peerings on CoPilot (Topology)": [[7, "verification-of-transit-peerings-on-copilot-topology"]], "5.2. Verify ICMP within bu1 and from bu1 towards bu2": [[4, "verify-icmp-within-bu1-and-from-bu1-towards-bu2"]], "5.2.1 Enforce the Egress-Rule": [[10, "enforce-the-egress-rule"]], "5.2.2 Create an ad-hoc Explicit-Deny-Rule": [[10, "create-an-ad-hoc-explicit-deny-rule"]], "5.3 Test the modified rule": [[10, "test-the-modified-rule"]], "5.3. Route Info DB": [[7, "route-info-db"]], "5.3. Verify SSH within bu1": [[4, "verify-ssh-within-bu1"]], "5.4. Add a rule that allows SSH in bu1": [[4, "add-a-rule-that-allows-ssh-in-bu1"]], "5.4. Connectivity tests through Gatus": [[7, "connectivity-tests-through-gatus"]], "5.4. SSH to VM in bu2": [[4, "ssh-to-vm-in-bu2"]], "5.5. Verify ICMP traffic within bu2": [[4, "verify-icmp-traffic-within-bu2"]], "5.6. Inter-rule from bu2 to bu1": [[4, "inter-rule-from-bu2-to-bu1"]], "6. ActiveMesh": [[9, "activemesh"]], "6. Connection Policy": [[8, "connection-policy"]], "6. CostIQ": [[6, "costiq"]], "6. East-1 and the Multi-Tier Transit": [[4, "east-1-and-the-multi-tier-transit"]], "6. Edge: \u201cIt\u2019s more than a Spoke GW\u201d\u201d": [[13, "edge-it-s-more-than-a-spoke-gw"]], "6. IDS": [[10, "ids"]], "6.0 Create two new DCF rules": [[14, "create-two-new-dcf-rules"]], "6.1 Activation of the MTT": [[4, "activation-of-the-mtt"]], "6.1 Create a New Rule": [[10, "id1"]], "6.1 Edge: As-Path Prepend": [[13, "edge-as-path-prepend"]], "6.1. CoPilot Verification of ActiveMesh": [[9, "copilot-verification-of-activemesh"]], "6.1. Verification of Connection Policy": [[8, "verification-of-connection-policy"]], "6.2 Prepare the simulator": [[10, "prepare-the-simulator"]], "6.2 Smart Group \u201ceast1\u201d": [[4, "smart-group-east1"]], "6.2. Connectivity test of ActiveMesh (Pt.1)": [[9, "connectivity-test-of-activemesh-pt-1"]], "6.2.1 Enable Segmentation": [[9, "enable-segmentation"]], "6.2.2. Associate Aviatrix Spoke to the Network Domain": [[9, "associate-aviatrix-spoke-to-the-network-domain"]], "6.3 Create an inter-rule that allows ICMP from bu2 towards east1": [[4, "create-an-inter-rule-that-allows-icmp-from-bu2-towards-east1"]], "6.3 Test the New Rule and the IDS feature": [[10, "test-the-new-rule-and-the-ids-feature"]], "6.3. Connectivity test of ActiveMesh (Pt.2)": [[9, "connectivity-test-of-activemesh-pt-2"]], "6.4 Verify connectivity between bu2 and east1": [[4, "verify-connectivity-between-bu2-and-east1"]], "7. Final verification": [[13, "final-verification"]], "7. FlightPath": [[9, "flightpath"]], "7. Spoke to Spoke Attachment": [[4, "spoke-to-spoke-attachment"]], "7.0 Generate again traffic towards the \u201cBad Guy\u201d": [[14, "generate-again-traffic-towards-the-bad-guy"]], "7.1 Create a new SmartGroup": [[14, "id1"]], "7.1 Creating a Spoke to Spoke Attachment": [[4, "creating-a-spoke-to-spoke-attachment"]], "7.2 Create a PSF-Allow-Rule": [[14, "create-a-psf-allow-rule"]], "8. Connectivity Tests": [[14, "connectivity-tests"]], "Bonus questions": [[9, "bonus-questions"]], "Gateway Keepalive Templates": [[9, "gateway-keepalive-templates"]], "LOGOS-ICONS": [[15, null]], "Lab 1 - VPCs/VNets CREATION": [[2, null]], "Lab 10 - COSTIQ": [[3, null]], "Lab 11 - DISTRIBUTED CLOUD FIREWALL": [[4, null]], "Lab 12 - IAC & NETWORK INSIGHTS API": [[5, null]], "Lab 2 - TRANSIT NETWORKING": [[7, null]], "Lab 3 - NETWORK SEGMENTATION": [[8, null]], "Lab 4 - HPE WITH ACTIVE MESH": [[9, null]], "Lab 5 - CLOUD PERIMETER SECURITY (Secure Cloud Egress)": [[10, null]], "Lab 6 - FIRENET": [[11, null]], "Lab 7 - SITE2CLOUD": [[12, null]], "Lab 8 - SECURE HIGH-PERFORMANCE DATACENTER EDGE": [[13, null]], "Lab 9 - THREAT PREVENTION": [[14, null]], "Lab 9 - THREATIQ & COSTIQ": [[6, null]], "Link": [[16, "link"]], "PDFs": [[0, null]], "POD Portal": [[16, null]], "Transitive Routing": [[9, "transitive-routing"]], "Welcome to ACE Professional Lab": [[1, null]]}, "docnames": ["docs/PDFs", "docs/home", "docs/lab1", "docs/lab10", "docs/lab11", "docs/lab12", "docs/lab13", "docs/lab2", "docs/lab3", "docs/lab4", "docs/lab5", "docs/lab6", "docs/lab7", "docs/lab8", "docs/lab9", "docs/logos-icons", "docs/pod"], "envversion": {"sphinx": 62, "sphinx.domains.c": 3, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 9, "sphinx.domains.index": 1, "sphinx.domains.javascript": 3, "sphinx.domains.math": 2, "sphinx.domains.python": 4, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.intersphinx": 1}, "filenames": ["docs/PDFs.md", "docs/home.md", "docs/lab1.md", "docs/lab10.md", "docs/lab11.md", "docs/lab12.md", "docs/lab13.md", "docs/lab2.md", "docs/lab3.md", "docs/lab4.md", "docs/lab5.md", "docs/lab6.md", "docs/lab7.md", "docs/lab8.md", "docs/lab9.md", "docs/logos-icons.md", "docs/pod.md"], "indexentries": {}, "objects": {}, "objnames": {}, "objtypes": {}, "terms": {"": [2, 3, 4, 5, 6, 7, 9, 10, 11, 14], "0": [2, 3, 4, 5, 6, 7, 9, 10, 11, 12, 13], "0xtf": 10, "10": [2, 4, 6, 7, 9, 10, 11, 13], "100": [9, 12, 13], "105": 1, "11": 5, "12": [2, 4, 6], "129": 11, "149": 9, "15": 11, "16": [1, 2, 3, 6, 7, 9, 11, 12, 13], "168": [2, 4, 7, 11, 12], "172": [2, 7, 9, 12, 13], "1918": [9, 10, 11], "192": [2, 4, 7, 11, 12], "1a": [6, 9, 14], "1b": 9, "1x": 7, "20": [7, 11], "200": 12, "22": [1, 2, 4], "225": 13, "23": 4, "24": [2, 6, 7, 9, 12, 13], "26": 7, "27": [7, 10], "28": [6, 7], "2a": [7, 10], "2spoke1": 10, "2x": [2, 7], "30": [9, 13, 14], "32": 6, "3x": 7, "40": [3, 6], "443": [7, 9], "5": 2, "50": 4, "53": [10, 11], "6": [1, 5], "60": 6, "63": [1, 11], "64512": 4, "64513": 13, "64514": 13, "64515": 4, "7": [1, 10, 11], "71": 1, "8": [4, 6, 12], "80": 7, "9": [1, 5, 11], "96": 7, "A": 9, "AS": [4, 13], "As": [2, 7, 9], "At": [1, 4, 7, 8, 9, 10, 11], "Be": [7, 9, 12], "By": [1, 5, 6], "For": [7, 12, 13], "If": [1, 3, 4, 6, 7, 9, 10, 11, 13], "In": [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "It": [2, 4, 7, 9], "Its": 12, "NOT": [2, 4, 7, 9, 10], "No": [4, 6, 10, 13, 14], "Not": 10, "ON": [10, 11, 12], "OR": 4, "Of": [10, 13], "On": [4, 5, 6, 7, 9, 10, 11, 13, 14], "TO": [4, 9], "The": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "Then": [2, 4, 6, 7, 8, 9, 10, 11, 12, 13], "There": 13, "These": [1, 5, 6, 7, 9, 14], "To": [1, 4, 7, 9], "With": [5, 10], "abl": [1, 4, 7, 8, 9, 10, 11], "about": [2, 5, 6, 9, 11, 12, 13, 14], "abov": [4, 5, 6, 7], "absenc": [4, 10], "absolut": [3, 6], "ac": 0, "access": [2, 7, 8, 11, 13, 16], "accomplish": [11, 13], "accord": 4, "account": [2, 3, 6, 7, 14], "achiev": [4, 9, 12], "ack": 14, "across": [4, 8], "action": [3, 4, 6, 7, 9, 10, 11, 12, 14], "activ": [5, 10, 11, 12], "activemesh": [0, 1], "actual": 9, "ad": 5, "add": [6, 10, 11, 12], "addit": [1, 2, 4, 6, 7, 9, 10, 11, 13], "addition": 7, "addr": 11, "address": [6, 10, 11, 12, 13, 14], "adjust": 7, "admin": [2, 11], "administr": 13, "adopt": 4, "advanc": 4, "advertis": [3, 6, 13], "affect": 4, "aforement": [3, 6, 10], "after": [3, 4, 5, 6, 7, 8, 10, 11, 12, 13, 14], "afternoon": 1, "afterward": [2, 6, 7, 10, 13], "again": [2, 4, 5, 6, 7, 9, 10, 11, 13], "against": 10, "aggress": 7, "aid": 1, "aka": [1, 4, 8, 9, 11], "akin": 7, "alert": 6, "algorithm": 9, "alia": 6, "aliv": 9, "all": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13], "alloc": [4, 7], "allow": [5, 10, 11, 13], "almost": [2, 10, 11], "along": [9, 13], "alreadi": [4, 5, 7, 11, 12, 13], "also": [2, 4, 5, 6, 7, 9, 10, 13, 14], "alt": 5, "altern": [2, 7, 10], "although": [4, 11, 13], "alto": [1, 11], "alwai": [2, 4, 7, 8], "among": [4, 7, 8], "an": [1, 2, 5, 9, 11, 12, 13, 14], "analysi": 3, "ani": [3, 4, 6, 7, 9, 10, 11, 12, 13, 14], "anoth": [4, 5, 6, 12, 13, 14], "anyth": 10, "anywher": [10, 11], "api": [0, 1, 11], "app": 5, "appear": 7, "appiq": 9, "appli": [4, 5, 6, 8, 9, 10, 11, 13], "applic": [2, 3, 6], "approach": 10, "appropri": [8, 9], "approv": 5, "approxim": 4, "apt": 13, "ar": [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "arc": 8, "architectur": [4, 7, 8], "arrow": [4, 6, 10], "ask": [1, 4, 10, 13], "asn": [4, 13], "assess": 5, "asset": [2, 6, 10, 14], "assign": [2, 4, 7, 9, 11, 12], "assocci": 13, "associ": [3, 6, 8, 10, 11], "assum": 2, "attach": [1, 2, 6, 11, 14], "attachemnt": 13, "attack": 10, "attempt": [7, 9, 10], "attent": [1, 7], "attribut": [7, 13], "authent": 11, "authet": 12, "author": [5, 10], "auto": [5, 9, 10, 11], "autom": 5, "automat": [9, 10, 11, 12], "avail": [1, 2, 5, 6, 7, 9, 10, 12, 13], "aviatrix": [1, 2, 4, 5, 6, 10, 11, 12, 13, 14, 15], "aviatrixlab": 12, "aviatrixsystem": 5, "avod": 4, "avx": 11, "avxadmin": 11, "aw": [1, 3, 4, 5, 6, 8, 9, 10, 13], "awai": 13, "awar": 13, "az": [2, 6, 7, 9, 10, 11], "azur": [1, 3, 4, 6, 8, 9], "back": [2, 5, 6, 7, 9, 11, 12, 13], "backbon": 8, "backup": 13, "bar": [2, 11], "base": [3, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "bash": 12, "beahvior": 4, "bear": [2, 7, 13], "becaus": [4, 6, 7, 8, 9, 10, 11, 13, 14], "becom": 9, "been": [3, 4, 6, 7, 10, 11, 13], "befor": [1, 2, 4, 6, 7, 10, 11, 12, 13, 14], "begin": [2, 7, 10, 11], "behaviour": [4, 10], "being": [7, 10, 11, 13, 14], "belong": [3, 4, 6, 10], "below": [2, 4, 6, 7, 8, 9, 10, 11, 12, 13, 16], "besid": 10, "best": [7, 13], "better": [9, 10], "between": [5, 7, 8, 9, 11, 12], "bgp": [3, 4, 6, 13], "bgpoverlan": [12, 13], "bi": 14, "bidirect": [7, 8], "bill": [3, 6], "bit": [2, 13], "block": [2, 5, 6, 10, 14], "blown": [1, 4, 5, 11], "blue": [4, 8], "bootcamp": 1, "bootstrap": [1, 11], "border": [4, 13], "both": [2, 3, 4, 6, 7, 9, 10, 11, 13], "bottom": [6, 7, 10, 11], "branch": [8, 11, 12], "bring": 9, "broken": [4, 7], "browser": [1, 11], "build": [5, 7, 12], "bunch": 13, "bundl": 11, "busi": 9, "button": [2, 3, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "bypass": 4, "c6in": 7, "call": [1, 4, 6, 11, 14], "can": [2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16], "candid": 10, "cannot": 1, "capabl": [4, 9, 13, 14], "care": 11, "carri": [4, 9], "case": [1, 4, 13], "cat": 12, "caus": [5, 10], "cd": 5, "center": [3, 6], "central": [2, 7, 13], "central1": [3, 4, 6, 7, 8, 11, 12, 13], "centralis": 7, "certif": 11, "cfg": 12, "challeng": 9, "chang": [2, 4, 5, 6, 7, 9, 10, 12, 13], "channel": 11, "check": [0, 2, 4, 9, 10, 11, 12, 13], "checkbox": 4, "chmod": 10, "choos": [4, 6, 9, 10, 11, 12, 14], "chose": 6, "chrome": 1, "cidr": [2, 3, 6, 10, 12, 13], "circl": 7, "class": 1, "classic": 13, "classifi": [4, 6, 14], "clean": 2, "clearli": [4, 7, 10], "click": [0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "client": [1, 3, 6, 9, 10, 13, 14], "clipboard": [5, 7], "close": [5, 7, 13], "cloud": [0, 1, 2, 3, 6, 8, 9, 11, 13, 14], "cluster": [7, 9, 13], "code": [5, 16], "collaps": 7, "color": [2, 8], "column": 6, "com": [10, 12, 14], "comfort": 1, "command": [5, 6, 7, 9, 10, 12, 13, 14], "commit": [4, 6, 7, 10, 11, 14], "commun": [4, 7, 8, 9, 11, 14], "compar": 5, "complement": 5, "complet": [2, 4, 6, 7, 11, 12, 13, 14], "complianc": 9, "compon": [4, 7], "compris": 7, "compromis": 13, "condit": [4, 6, 10, 14], "conf": 12, "config": 9, "configur": [1, 2, 4, 5, 6, 10, 13], "confirm": [2, 4, 6, 7, 9, 11, 13], "conflict": 2, "congratul": 5, "connect": [5, 10], "connet": 4, "consid": 13, "consol": [7, 9, 12], "construct": [1, 2, 9], "consum": [7, 10], "contact": [10, 11], "contain": [4, 5], "content": [5, 12, 14], "continu": [2, 6, 10, 11], "control": [2, 4, 5, 9, 11, 12, 13, 15], "converg": 9, "coonfigur": 12, "copi": [5, 6, 7, 10, 12, 14], "copilot": [1, 2, 3, 4, 5, 6, 10, 11, 12, 13, 14, 15], "core": 8, "corner": [2, 7, 9, 11], "corpor": 1, "correct": 10, "correctli": 13, "correspon": [3, 6], "correspond": [4, 5, 6, 7, 10, 11], "cost": [3, 6, 10], "costiq": [0, 1], "could": [7, 9, 10, 12], "cours": [10, 13], "cover": 1, "creat": [3, 7, 8, 9, 11, 12, 13], "creation": [1, 7, 8, 10, 11, 12, 13, 14], "credenti": [2, 5, 7, 9, 11, 13], "criteria": [6, 14], "critic": 4, "csp": [4, 7, 8, 10, 12, 14], "ctrl": 5, "cumbersom": 7, "curl": [6, 10, 14], "current": [4, 7, 10, 11], "custom": [1, 8, 11], "customis": 8, "dai": 1, "dash": [7, 9], "dashboard": [7, 11], "data": [4, 5, 6, 10, 13, 14], "databas": [6, 14], "db": [13, 14], "dc": [6, 7, 12, 13], "dcf": [6, 11], "deafultthreatgroup": [6, 14], "decis": [5, 10, 13], "declar": 5, "decrypt": 4, "dedic": [1, 4], "deem": [6, 14], "default": [2, 4, 6, 7, 9, 10, 11, 12, 13, 14], "defaultdenyal": [10, 11], "defaultdenyrul": 10, "defend": 14, "defin": [2, 3, 4, 6, 8, 11, 13], "delet": [6, 10, 14], "deliv": 13, "demonstr": [3, 4, 6, 9, 10, 13, 14], "deni": [11, 14], "depend": 9, "depict": [2, 7, 8, 9, 12, 13], "deploi": [1, 2, 4, 5, 7, 11, 12, 13], "deploy": [2, 5, 6, 7, 12, 14], "describ": 13, "design": [0, 1, 7, 15], "desir": [5, 8], "desktop": [1, 5, 13], "despit": 4, "destin": [4, 6, 9, 10, 11, 13, 14], "detail": [3, 9], "detect": [10, 14], "determin": 6, "determinist": 9, "devic": [5, 12, 13], "diagnost": [3, 6, 9, 12, 13], "dictat": 7, "didn": 9, "differ": [2, 6, 7, 8, 9], "difficult": 7, "dig": 12, "direct": [4, 7, 14], "directli": [4, 5, 7, 8, 9], "directori": 5, "disabl": 9, "discov": [3, 4, 6], "dismiss": 11, "displai": 9, "disrupt": [9, 10], "distinct": 4, "distribut": [0, 1, 3, 6, 10, 11, 14], "dn": [7, 10, 11, 12], "do": [2, 4, 5, 6, 7, 8, 9, 10, 11, 13, 14], "doc": 5, "document": 1, "doe": [1, 4, 5, 7, 9, 11, 12], "doesn": 11, "domain": [4, 10, 11, 14], "don": [4, 7, 9], "done": 9, "dot": [3, 6, 7, 10, 11, 13, 14], "down": [1, 2, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "download": [0, 5, 9], "draft": [4, 6, 10, 11, 14], "draw": [4, 12], "driven": [5, 12], "drop": [2, 4, 7, 9, 10, 11, 12, 13], "due": [4, 10, 11, 12, 13], "dure": 4, "dynam": [4, 7], "e": [1, 2, 4, 7, 8, 10, 11, 12, 13], "each": [1, 2, 4, 7, 8, 9, 11, 12, 13], "earli": 11, "earlier": [9, 11, 13, 14], "eas": 8, "easi": 12, "easili": 5, "east": [1, 3, 5, 6, 8, 9, 10, 11, 13, 14], "east1": [6, 9], "east2": [4, 7, 9, 10], "ec2": [4, 6, 7, 9, 13], "echo": 4, "edg": [0, 1, 3, 5, 6, 7, 12, 15], "edit": [6, 7, 8, 9, 11, 12, 13], "editig": 12, "effect": 10, "egress": [1, 11, 13], "eight": 2, "either": [7, 8, 12, 14], "element": [5, 7], "email": 6, "embrac": 11, "employe": 1, "empti": [4, 6, 10, 13], "emul": 12, "enabl": [4, 5, 6, 8, 11, 13, 14], "encompas": 4, "encrypt": [0, 1, 7, 12, 13], "end": [0, 1, 2, 6, 8, 9, 10, 11, 12, 13], "enforc": [4, 11, 14], "enforcement": 14, "engin": 9, "eni": 9, "ensur": [4, 6, 7, 10, 14], "enter": [4, 5, 6, 7, 9, 10, 11, 13, 14], "enterpris": [4, 7, 8, 9], "entir": 9, "entri": [6, 10, 11, 14], "environ": [4, 5, 7, 8, 10], "eod": 0, "equal": 13, "error": 11, "espn": 10, "essenti": 10, "establish": [4, 5, 7, 10, 12, 13], "etc": 12, "ethernet1": 11, "etho": 13, "evalu": 10, "even": 11, "everi": 14, "everyth": 10, "evid": 4, "exact": 7, "exactli": [13, 14], "exampl": [2, 12], "except": 4, "exchang": 13, "exclud": 4, "exclus": 10, "execut": [4, 5, 10, 13], "exercis": [0, 5], "exist": [2, 4, 7, 10, 11, 12, 13], "expand": [2, 4, 7, 9, 12, 13], "expens": 11, "experi": [6, 7, 9, 11], "explicit": 11, "explicitli": 5, "explor": [2, 5, 8, 10, 13, 14], "export": 13, "extend": [8, 13], "extern": 12, "fabric": [4, 6, 8, 9, 10, 11, 12, 13, 14], "facilit": 11, "fact": [4, 7, 10], "fail": [4, 6, 9], "familiaris": 2, "far": 13, "fast": 9, "featur": [3, 4, 8, 9, 12, 13], "fetch": 7, "few": 5, "field": [2, 4, 6, 7, 10, 11, 12, 13], "fifteen": 7, "figur": [4, 7], "file": [5, 11, 12], "filer": 7, "fill": [9, 13], "filter": [2, 4, 6, 9, 10, 11, 12, 13, 14], "final": [2, 3, 4, 6, 7, 8, 9, 10, 11, 14], "find": [3, 5, 6, 7, 9, 10, 14], "finish": 5, "firefox": 1, "firenet": [1, 2], "firewal": [0, 1, 6, 8, 10, 12, 14], "first": [4, 5, 6, 9, 10, 11, 12, 13, 14], "flag": 4, "flat": [4, 8], "flexibl": 4, "flow": [3, 9, 11, 13], "flowiq": [6, 9], "folder": [5, 11], "follow": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "footbal": 10, "foremost": [6, 10, 13], "forget": [4, 6, 7, 9, 10, 11, 13, 14], "format": 9, "forward": 9, "found": 10, "four": 2, "frequent": [6, 7], "fresh": 1, "fridai": [0, 1], "from": [1, 3, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "full": [1, 4, 5, 7, 10, 11, 13], "function": [1, 2, 4, 7, 9, 10, 11, 13, 14], "furthermor": 10, "fw": 11, "g": [1, 7], "garden": 9, "gatewai": [1, 2, 3, 4, 5, 6, 10, 11, 12, 13, 14, 15], "gateweai": 14, "gather": 10, "gcp": [3, 4, 6, 8, 9, 12, 13], "gener": [4, 5, 9, 11], "get": [2, 3, 6, 7, 9, 10, 11], "githubusercont": 10, "give": [7, 13], "given": 1, "global": [2, 5, 6, 7, 14], "go": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "goe": 9, "good": 10, "googl": 10, "got": [2, 4, 13], "govern": [4, 13], "grafana": 5, "grant": 2, "granular": 10, "grayedout": 13, "green": [2, 4, 7, 8, 9, 11, 12, 13], "greendfield": 10, "greenfield": [6, 10, 11, 14], "grei": [7, 11, 12], "group": [6, 8, 9, 10, 14], "guarante": 10, "guid": [5, 7], "gw": [4, 7, 8, 9, 10, 11, 12], "ha": [2, 4, 5, 6, 7, 9, 10, 11, 13], "had": 11, "hand": [2, 4, 6, 7, 9, 10, 11, 13, 14], "handf": 2, "handl": 11, "happen": 7, "har": 13, "hardwar": 5, "have": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13], "heal": 9, "health": [7, 9], "help": [8, 9, 10], "henc": 11, "here": [2, 5, 7, 8, 9, 12, 13], "hidden": [5, 6], "high": [0, 1, 7], "highest": 13, "highlight": 8, "hit": [2, 10, 11], "home": 5, "hop": [9, 13], "host": [3, 5, 10, 12], "hour": 6, "hourglass": 2, "hover": 8, "how": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "howev": [4, 7, 10], "hpe": [7, 13], "http": [5, 6, 10, 11, 14], "hub": [4, 7, 8], "huge": 9, "hybrid": [9, 13], "hyperlink": 11, "i": [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "iac": [0, 1], "icmp": [7, 11, 12], "icon": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "id": [4, 7], "identifi": [5, 6, 7, 12, 14], "igw": [2, 4, 6, 10, 14], "ikev2": 12, "imag": 11, "immedi": [2, 3, 5, 6, 7, 10, 11, 12], "impact": [4, 10], "implement": 8, "improv": 10, "inadvert": 10, "includ": [1, 3, 7, 11, 15], "increasingli": 7, "inde": [4, 7, 13], "indic": [7, 10, 11], "individu": 5, "inetutil": 13, "info": [2, 3, 6, 8, 9, 11, 13], "inform": [2, 5, 7, 9, 10], "infrastructur": [5, 7], "ingress": 11, "init": 5, "initi": [1, 4, 5, 6, 10, 11, 12, 14], "inject": 10, "inner": 7, "input": 9, "insan": [1, 9], "insert": [2, 4, 5, 6, 7, 10, 11, 13, 14], "insid": [1, 2, 5, 6, 7, 10, 13], "insight": [1, 3, 6, 10], "inspect": [6, 8, 11, 13, 14], "instal": [1, 4, 10, 13], "instanc": [1, 4, 6, 7, 8, 9, 11, 12, 13, 14], "instant": 10, "instanti": [7, 9], "instead": 12, "instructor": [6, 14], "integr": 5, "intellig": 9, "intend": 1, "interconnect": 13, "interfac": [2, 5, 9, 11, 13], "internet": [2, 10, 11, 12, 14], "interrupt": 9, "interv": 7, "intra": 7, "introduc": 11, "introduct": 0, "intrus": 10, "invalid": 11, "investig": [4, 5], "invis": 10, "invok": [2, 9], "involv": [4, 7, 12, 13], "io": 5, "ip": [1, 4, 6, 8, 10, 11, 12, 13], "ipsec": [7, 12], "ipv4": 14, "island": 5, "isol": 7, "issu": [6, 7, 10, 12, 14], "istanc": 7, "item": 7, "its": [4, 6, 7, 9, 10, 11, 12, 13, 14], "itself": 14, "just": [2, 4, 7, 9, 11, 13], "keep": [9, 12], "kei": [4, 5, 11, 12, 14], "kept": [3, 6], "keyboard": [5, 13], "keyword": 7, "kibibyt": 13, "kind": [9, 10, 13], "kindli": 6, "knob": [4, 9, 10, 11, 13], "know": [5, 6, 10, 11], "knowledg": 0, "known": [6, 7, 9, 10], "lab11": 5, "lab2": 7, "lab3": [4, 7], "lab6": 11, "lab7": 12, "lab8": 12, "lan": [12, 13], "land": 13, "laptop": [1, 10, 12], "larg": [7, 9], "larger": 5, "last": [4, 6, 9, 10, 14], "latenc": 9, "later": [1, 8, 11], "latest": 5, "launch": [9, 10, 12, 13, 14], "layer": [8, 10], "learn": [1, 3, 6, 11, 13], "least": [9, 10, 14], "left": 2, "legend": 7, "length": 13, "less": 5, "lesson": 5, "let": [0, 2, 3, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "leverag": 4, "like": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "likewis": [1, 7, 8, 14], "line": [5, 7, 9, 13], "link": [0, 2, 9, 14, 15], "list": [2, 4, 6, 7, 10, 11, 13, 14], "littl": [2, 13], "live": 5, "ll": 7, "load": 11, "local": [3, 4, 6, 10, 12, 13], "locat": [4, 5, 7], "lock": 4, "log": [2, 4, 5, 6, 7, 10, 11, 14], "logic": [4, 7, 8, 9], "login": [2, 5, 9, 11], "logo": 7, "long": 11, "look": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "lose": 5, "lost": 7, "lot": [5, 11], "love": 5, "lower": 4, "lunch": 5, "lx": 13, "lxtermin": 5, "m497": 16, "mac": 5, "machin": [5, 6, 7, 10, 14], "magic": 11, "mai": [1, 6, 7, 9, 11, 13], "main": 5, "maintain": [5, 6, 7], "major": 7, "make": [2, 5, 6, 7, 9, 10, 11, 14], "malciou": 14, "malici": [1, 6, 10], "maliciu": 14, "manag": [4, 7, 11, 12, 13], "mani": 6, "manifest": 5, "manipul": [11, 13], "manner": 12, "manual": [7, 12], "map": [2, 7, 11, 12, 13], "marketplac": 11, "master": 10, "match": [4, 10, 11, 14], "maximum": [7, 11], "mayb": 11, "mc": 5, "mcna": [0, 1, 4, 7, 13], "mean": [5, 7, 10, 11, 13], "meanwhil": 7, "mechan": [13, 14], "medium": [6, 7, 9, 14], "meet": [6, 14], "mention": 1, "menu": [5, 8, 13], "mesh": [4, 5, 7], "messag": [2, 7, 10, 11, 13], "metadata": 6, "method": [4, 12], "metric": [4, 7, 9], "mgmt": 11, "micro": 5, "middl": 11, "might": [6, 7, 9, 11, 14], "mind": [2, 7, 9, 13], "minut": [2, 4, 5, 6, 7, 9, 11, 12, 13, 14], "misconfigur": 7, "mod01": 0, "mod02": 0, "mod03": 0, "mod04": 0, "mod05": 0, "mod06": 0, "mod07": 0, "mod08": 0, "mod09": 0, "mod10": 0, "mod11": 0, "mod12": 0, "mod13": 0, "mod14": 0, "mod15": 0, "mod16": 0, "mod17": 0, "mode": [1, 9, 10], "modifi": 9, "modul": 5, "monitor": [2, 4, 6, 9, 10, 11, 13], "more": [4, 5, 6, 9, 14], "moreov": [2, 7, 11], "move": [3, 5, 6, 10], "much": 13, "multi": [1, 7, 11, 13], "multicloud": [1, 5, 8], "multipl": [7, 13], "must": [1, 7, 11, 14], "n": [6, 9, 14], "n1": 7, "nacl": 9, "name": [2, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "namespac": 5, "nat": [4, 10, 12], "nativ": [7, 9, 10], "navig": [2, 5, 6, 7, 11], "nearbi": 4, "need": [5, 6, 7, 9, 10, 11, 12, 13], "neither": [8, 14], "netflow": [6, 10, 13], "network": [0, 1, 4, 12], "networkinsight": 0, "never": 4, "nevertheless": [10, 13], "new": [4, 5, 7, 8, 9, 11, 12, 13], "newli": 5, "next": [5, 6, 7, 9, 11], "ngfw": [4, 11], "nginx": 14, "nine": [7, 9], "node": [7, 8], "non": [9, 10], "nor": 14, "normal": [4, 7], "north": 11, "note": [4, 6, 11, 14], "notic": [1, 2, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "notif": [2, 6, 13], "notifi": 13, "now": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "nslookup": 12, "number": [4, 7, 9, 12, 13], "o": [10, 12], "observ": [2, 7, 10], "occur": [4, 7, 8], "off": [7, 9, 10, 13], "offici": 5, "ohio": 7, "ok": [4, 12], "onboard": 8, "onc": [2, 4, 5, 6, 7, 9, 11, 13], "one": [1, 2, 3, 4, 6, 7, 9, 10, 11, 12, 13, 14], "onli": [2, 4, 7, 8, 10, 11], "onprem": 12, "onprempartn": 12, "onward": 6, "open": [2, 4, 5, 7, 8, 13], "oper": 13, "opposit": 7, "optim": 10, "option": [6, 8, 10, 12, 13, 14], "orchestr": [4, 11, 13], "order": [6, 7, 8, 9, 10, 11, 13], "oregon": 2, "org": 10, "other": [1, 4, 5, 7, 8, 9, 10, 12], "otherwis": 1, "our": 5, "out": [3, 4, 5, 6, 7, 9, 10, 11, 12, 13, 14], "outboud": 1, "outcom": [4, 6, 7, 9, 10, 11, 13, 14], "outer": 7, "output": 10, "over": [5, 8, 12, 13], "overal": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "overcom": 9, "overlap": [1, 2, 12], "overview": [9, 10, 13], "own": [10, 13], "owner": 4, "pacif": 1, "packag": [1, 11, 13], "packet": [10, 14], "page": [2, 5, 7, 9, 11], "pai": [1, 7], "pair": [7, 9], "palo": [1, 11], "paloalto": 11, "panel": 2, "parament": 11, "paramet": [4, 6, 7, 10, 11, 14], "particular": 1, "partner": [1, 8, 11, 12], "partner1": 12, "pass": 11, "password": [2, 10, 11, 13], "past": [5, 11], "path": [9, 10, 14], "patient": [2, 7, 9, 11, 12], "pc": 1, "pdf": 9, "peer": [4, 13], "pencil": [6, 7, 8, 9, 10, 11], "pend": [7, 9], "per": [2, 7], "perfect": 5, "perfectli": [4, 7], "perform": [0, 1, 7, 10], "period": [2, 6], "permit": [1, 4, 6, 10, 11, 14], "person": [1, 2, 4, 5, 6, 7, 12, 13, 16], "perspect": 13, "pictur": 16, "ping": [3, 4, 6, 7, 8, 9, 11, 12, 13], "pingabl": 4, "pinpoint": [6, 10], "place": [4, 10, 12], "plan": 5, "plane": [4, 10, 13], "platform": [5, 7, 11], "pleas": [0, 1, 2, 4, 6, 7, 9, 11, 12, 13, 14], "pod": [1, 2, 4, 5, 7, 8, 9, 10, 11, 12, 13], "point": [2, 4, 6, 7, 8, 9, 10, 14], "polici": 4, "pop": [2, 4, 6, 7, 10, 11, 13, 14], "popul": 11, "port": [1, 4, 7, 9, 10, 11], "portal": [1, 2, 4, 5, 7, 10, 11, 12, 13], "possibl": [4, 10, 11], "postur": 10, "potenti": 10, "power": [7, 13], "practic": 7, "pre": [1, 7, 9, 11, 12], "preconfigur": 12, "prefer": [4, 13], "prefix": [7, 11], "prem": [7, 9, 11, 13], "premis": [8, 12], "prepar": [1, 5, 11], "prepend": 6, "preprovis": 7, "presenc": [7, 10, 12, 13], "present": [4, 11], "press": 5, "prevent": [0, 1, 4], "preview": 4, "previou": [4, 5, 7, 9], "previous": [2, 5, 6, 9, 10, 13], "primari": 13, "prioriti": 10, "privat": [2, 4, 7, 8, 9, 11, 12, 13], "proce": [4, 7, 10, 13], "proceed": [6, 7, 9], "process": [1, 5, 7, 13], "product": 7, "prof": 0, "program": [9, 11], "progress": [2, 6, 7, 11, 14], "prometheu": 5, "prompt": [5, 11], "proofpoint": [6, 14], "properli": 4, "properti": [7, 9], "propos": 5, "protect": [6, 14], "protocol": [4, 6, 7, 9, 10, 11, 13, 14], "provid": [1, 3, 5, 6, 7, 9, 10, 14], "provis": [7, 11, 13], "psk": 12, "public": [2, 4, 7, 9, 10, 11, 12, 13, 14], "public_ip": [7, 8], "publlic": 10, "pull": 8, "purpos": [2, 10], "pwd": 10, "queri": 10, "quickli": 5, "quit": 4, "rang": [2, 10], "rate": [5, 13], "rather": 5, "raw": 10, "rbac": 0, "reach": [4, 10, 12, 13, 14], "reachabl": [4, 8, 9], "read": [6, 14], "readi": [11, 13], "real": 12, "reason": 4, "receiv": [5, 6, 11], "recipi": 6, "recommend": [4, 7], "reconverg": 9, "recreat": 11, "recurs": [9, 12], "red": [9, 11, 12], "reduc": 10, "redund": 13, "refer": [2, 4, 5, 6, 7, 8, 9, 10, 11, 12], "reflect": [2, 4, 7, 9, 12], "refresh": [2, 6, 7, 9, 10, 11, 12, 13], "regard": 13, "region": [1, 2, 4, 6, 7, 9, 13, 14], "regist": 13, "registri": 5, "regularli": [6, 14], "rel": [3, 6], "relat": [4, 11, 13, 14], "relaunch": [4, 9, 13], "relev": [4, 8], "reli": [6, 7], "remain": [3, 6, 7, 9, 10], "rememb": 11, "remot": [5, 12, 13], "remov": [0, 6, 9, 10], "repeat": [3, 4, 6, 7, 9, 13], "replac": [10, 12], "replace_with_spoke_gw_public_ip": 12, "repli": 4, "report": [6, 9], "repres": [7, 8, 10], "reput": [6, 14], "request": 10, "requir": [3, 4, 5, 6, 8, 9, 11], "rerout": 10, "resid": [6, 7, 9, 14], "resili": 9, "resolv": 12, "resourc": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 14], "respect": [7, 8, 9], "respons": 11, "rest": [4, 7, 13], "restart": 9, "restor": [2, 14], "restrict": [1, 8], "result": [2, 7], "retest": [8, 9], "retriev": [10, 11, 12, 14], "return": 11, "reveal": 13, "reverifi": 9, "rfc": [9, 10, 11], "rfc1918": [9, 10, 11], "rib": 7, "rid": 11, "right": [1, 2, 4, 6, 7, 9, 10, 11, 13, 14], "root": 10, "roughli": 11, "rout": [2, 3, 4, 6, 8, 10, 12, 13, 14], "router": [1, 11, 12, 13], "row": [6, 11], "rtb": 9, "rule": 11, "run": [3, 5, 6, 7, 9, 12, 13], "safari": 1, "sake": 7, "same": [2, 4, 5, 6, 7, 9, 10, 11, 13], "save": [2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "scalabl": 9, "scale": 11, "scenario": [10, 12], "scope": 1, "scratch": 12, "screen": [11, 12, 13], "screenshot": [2, 6, 7, 9, 14], "script": 12, "scroll": [9, 13, 14], "sd": 13, "sdn": 13, "search": [2, 4, 6, 7, 9, 10, 12, 13, 14], "second": [7, 9, 11, 13], "section": [2, 4, 5, 6, 7, 9, 11, 12, 13, 14], "secur": [0, 1, 4, 5, 6, 8, 9, 11, 14], "see": [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13], "seem": 13, "segment": [0, 1, 11, 13], "segreg": 8, "select": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "self": 11, "semplic": 7, "send": [6, 14], "sens": 4, "sent": [4, 14], "separ": [1, 4, 9], "seri": [1, 11], "server": [5, 7, 10], "servic": [2, 4, 6, 7, 9, 10], "session": [4, 5, 9, 11, 12, 14], "set": [4, 5, 6, 7, 9, 11, 12, 14], "sever": [4, 7], "sg": [4, 6, 10], "sh": 12, "share": [1, 6, 11, 12], "shift": 5, "should": [1, 3, 4, 5, 6, 7, 10, 11, 14], "show": [3, 4, 5, 6, 7, 9, 10, 11, 13], "shown": [2, 6, 7, 8, 11, 14], "shut": 9, "side": [2, 4, 6, 7, 9, 10, 11, 12, 13, 14], "sidebar": 5, "sign": [7, 11], "significantli": 11, "similar": [4, 8, 12, 13], "simpl": [5, 7], "simpli": 10, "simplic": 7, "simplifi": [5, 7, 11], "simultan": [9, 13], "sinc": [2, 8, 12], "singl": [1, 4, 7, 9, 10, 13], "sit": 10, "site": 12, "site2cloud": [0, 1, 8], "six": 7, "size": [6, 7, 9, 11, 14], "slide": 0, "slider": 10, "slow": 11, "smartgroup": [4, 11], "smoothli": 4, "snat": [10, 11], "so": [1, 8], "softwar": 13, "sole": [4, 9, 10, 14], "solid": [7, 9], "solut": [1, 4, 5, 8, 11, 13], "some": [1, 2, 5, 7, 9, 11, 13, 14], "someth": 7, "soon": [0, 2, 7], "sourc": [4, 5, 6, 9, 10, 11, 14], "south": 11, "space": [2, 11, 12], "special": [1, 7], "specialti": [6, 14], "specif": [1, 7, 10, 11], "specifi": 10, "speed": 9, "splash": 11, "spoke": [1, 2, 8, 10, 12, 14], "spoke1": [2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13], "spoke2": [1, 3, 4, 6, 7, 8, 9, 11], "ssh": [1, 6, 8, 9, 11, 12, 13], "ssl": 10, "stage": [7, 9], "standalon": 14, "standard": 7, "standard_b2m": 7, "standard_d3_v2": 11, "start": [2, 7, 10, 12], "stat": [5, 9], "state": [4, 5, 7, 9, 11], "statement": 5, "statemet": 5, "static": [7, 11, 12], "statist": 5, "statu": [2, 5, 7, 9, 12], "step": [1, 7, 9, 11], "still": [4, 9, 11, 13], "stop": [6, 9], "storag": 11, "stream": 11, "string": [11, 12], "strong": 11, "strongswan": 1, "student": [1, 7, 8, 10, 13], "studio": 5, "su": 10, "sub1": [2, 7], "subnet": [2, 3, 4, 7, 9, 11, 12, 13, 14], "subscript": 11, "subsequ": [2, 7, 12, 13], "success": [4, 7, 10, 11, 13], "successfulli": [2, 4, 6, 7, 10, 11, 13], "sudo": [10, 12, 13], "suggest": 6, "summari": [6, 9, 14], "support": 1, "sure": [2, 6, 7, 11, 14], "suricata": [4, 10], "survei": 0, "swanctl": 12, "switch": 9, "symbol": [7, 11, 12], "syn": 14, "system": 10, "t": [4, 7, 9, 10, 11], "t2": [6, 7, 14], "tab": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "tabl": [2, 4, 6, 8, 9, 10, 11, 14], "tag": [4, 6, 14], "take": [2, 4, 7, 9, 11, 13], "taken": 11, "target": [10, 13], "task": [2, 7, 12, 13], "tcp": [4, 7, 9], "technologi": 9, "templat": [2, 6, 11, 12, 13, 14], "temporari": 9, "temporarili": 9, "term": 7, "termin": [3, 4, 6, 7, 8, 12, 13], "terraform": 1, "test": [1, 4, 6, 8], "test1": [4, 6, 7, 8, 9, 10, 11, 12, 13], "test2": [4, 7, 9, 10], "testmynid": 10, "tf": 5, "tfstate": 5, "tfvar": 5, "than": 5, "thank": [4, 10], "thei": [0, 2, 3, 6, 13], "them": [5, 7, 8], "ther": 10, "therefor": [2, 4, 5, 6, 7, 10, 11, 13], "thi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], "thing": 5, "thit": 4, "thoroughli": 4, "those": [7, 9, 13, 14], "threat": [0, 1, 4, 6], "threatgroup": [1, 6], "threatguard": 6, "threatiq": 14, "three": [3, 4, 6, 7, 8, 10, 11, 13, 14], "threee": 13, "through": [2, 4, 8, 9, 10, 11, 13, 14], "throughout": 1, "throughput": 11, "thu": 13, "tier": 1, "time": [1, 2, 4, 6, 7, 8, 9, 10, 11, 13], "timer": [7, 9], "timestamp": [6, 10], "tl": 4, "tmnid": 10, "tmp": 10, "togeth": 0, "toggl": [6, 10], "too": 11, "tool": 12, "top": [2, 7, 9, 11, 13], "topologi": [3, 4, 5, 13], "topopologi": 7, "tor": 10, "torn": 1, "total": 7, "toward": [3, 5, 7, 9, 10, 11, 13], "tracerout": 13, "traffic": [3, 7, 9, 11, 13], "train": [0, 1], "trainer": [1, 14], "transit": [0, 1, 2, 14], "transit_gatewai": 5, "translat": 10, "transmit": 5, "travers": [4, 7], "tri": 10, "trigger": [2, 6], "troubl": 5, "troubleshoot": [7, 13], "trust": [4, 5], "try": [4, 10, 11, 14], "tunnel": [7, 9, 12], "turn": [4, 6, 9, 10, 11, 13], "turnkei": 11, "two": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13], "type": [2, 6, 7, 10, 12, 13, 14], "typic": [4, 12], "u": [1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13], "ubuntu": 14, "udp": [10, 11], "ui": [2, 5, 6, 7, 13], "ultim": 13, "unaffect": 10, "unattach": 9, "under": [6, 7, 11, 13], "underlai": [2, 13], "underli": 9, "understand": [4, 10], "undoubtedli": 4, "uniqu": [4, 11], "unless": [1, 8], "unmanag": 7, "unreach": 9, "until": [1, 4, 5, 11, 13], "untrust": 9, "unus": [6, 14], "up": [2, 4, 6, 7, 10, 11, 12, 14], "updat": [6, 7, 12, 14], "update_swanctl": 12, "upon": 10, "url": [2, 4, 9, 10, 11, 14], "us": [1, 2, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15], "user": [0, 2], "usernam": 11, "util": [3, 6, 9], "utilis": [1, 12], "v": 5, "valid": [1, 4, 6, 7], "valu": [2, 4, 6, 7, 10, 14], "vari": 11, "variabl": 5, "variou": 7, "vcn": [4, 7, 8, 9, 11], "vendor": 5, "veri": [4, 7, 10, 11, 13, 14], "verif": 2, "verifi": [1, 6, 7, 8, 9, 10, 12, 13, 14], "version": [5, 11], "via": [11, 13], "view": [2, 6, 7, 8, 14, 16], "virginia": [6, 9, 14], "virtual": [6, 7, 10, 11, 12, 14], "visibl": [9, 10, 13], "visual": 5, "vm": [1, 7, 8, 11, 13], "vnet": [1, 3, 4, 6, 7, 8, 9, 10, 11, 12, 14], "vpc": [1, 3, 4, 6, 7, 8, 10, 11, 12, 13, 14], "vpn": 0, "wa": [2, 4, 5, 6, 9, 10, 11, 12, 13, 14], "wai": 6, "wait": [2, 6, 9, 11, 12, 13, 14], "wall": 9, "wan": 13, "want": [2, 4, 7, 10], "warn": 11, "watch": 10, "we": [5, 6, 7, 8, 9, 10, 11, 12, 14], "web": [2, 6, 7, 9, 10, 11], "webgroup": [6, 14], "websit": 10, "week": [0, 1], "welcom": 11, "well": [6, 7, 8, 9], "were": [9, 11], "west": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11], "west2": [2, 7], "what": [4, 5, 6, 7, 8, 9, 10, 12], "when": [5, 6, 7, 9, 11, 13, 14], "where": [4, 5, 6, 9, 11, 14], "wherea": [7, 13], "wherebi": 10, "whether": [2, 4, 10], "which": [1, 5, 7, 10, 11], "while": [6, 7, 8, 11, 14], "white": 2, "whole": [4, 14], "whom": 10, "why": 9, "widget": [5, 7, 13], "wikipedia": 10, "window": [2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 14], "within": [7, 9, 10, 11, 12, 13], "without": [4, 7, 8, 10, 11, 13], "wll": 10, "word": 1, "work": [3, 4, 5, 6, 10, 11, 12], "workflow": 12, "workload": [6, 7, 8, 14], "workstat": [3, 5, 6, 13], "wortkstat": [3, 6], "would": [3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14], "www": [10, 14], "x": 10, "ye": 5, "yet": [4, 7, 9, 11, 13], "york": [6, 12, 13], "you": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 16], "your": [1, 2, 3, 5, 6, 7, 9, 10, 11, 12, 13, 14, 15, 16], "yourself": 2, "zero": 4, "zone": [2, 6, 7, 9, 10, 11], "zoom": 1, "ztna": 14}, "titles": ["PDFs", "Welcome to ACE Professional Lab", "Lab 1 - VPCs/VNets CREATION", "Lab 10 - COSTIQ", "Lab 11 - DISTRIBUTED CLOUD FIREWALL", "Lab 12 - IAC & NETWORK INSIGHTS API", "Lab 9 - THREATIQ & COSTIQ", "Lab 2 - TRANSIT NETWORKING", "Lab 3 - NETWORK SEGMENTATION", "Lab 4 - HPE WITH ACTIVE MESH", "Lab 5 - CLOUD PERIMETER SECURITY (Secure Cloud Egress)", "Lab 6 - FIRENET", "Lab 7 - SITE2CLOUD", "Lab 8 - SECURE HIGH-PERFORMANCE DATACENTER EDGE", "Lab 9 - THREAT PREVENTION", "LOGOS-ICONS", "POD Portal"], "titleterms": {"": [12, 13], "0": 14, "1": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "10": 3, "11": 4, "12": 5, "2": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "3": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "33ecff": 7, "4": [1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "5": [1, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "6": [4, 6, 7, 8, 9, 10, 11, 13, 14], "7": [4, 9, 12, 13, 14], "8": [13, 14], "9": [6, 14], "A": 6, "As": 13, "It": 13, "On": 12, "WITH": 9, "ac": 1, "access": 1, "activ": [4, 9], "activemesh": 9, "ad": [6, 10], "add": 4, "address": 7, "after": 9, "again": 14, "allow": [4, 14], "an": [4, 6, 7, 10], "api": 5, "app": 7, "architectur": 10, "asset": 7, "associ": [9, 13], "attach": [4, 5, 7, 8, 9, 13], "automat": 6, "aviatrix": [7, 8, 9], "aw": [2, 7, 14], "azur": [2, 7, 11], "bad": [6, 14], "befor": 9, "between": [4, 13], "bonu": [7, 9], "bu1": 4, "bu2": 4, "check": 7, "client": 7, "cloud": [4, 7, 10, 12], "color": 7, "configur": [7, 8, 9, 11, 12], "connect": [4, 7, 8, 9, 11, 12, 13, 14], "consol": 2, "control": 10, "copilot": [7, 8, 9], "costiq": [3, 6], "creat": [2, 4, 5, 6, 10, 14], "creation": [2, 4], "datacent": 13, "db": 7, "dc": 3, "dcf": [4, 10, 14], "deni": 10, "deploi": [6, 14], "deploy": 11, "descript": 5, "distribut": 4, "domain": [8, 9, 13], "drop": 6, "east": [4, 7], "east1": [4, 14], "ec2": 10, "edg": 13, "edit": 10, "egress": 10, "enabl": [3, 9, 10], "encrypt": 9, "enforc": [6, 10], "expect": 5, "explicit": 10, "explor": 7, "fabric": 7, "featur": 10, "final": 13, "firenet": 11, "firewal": [4, 11], "flightpath": 9, "flowiq": 13, "forc": 6, "from": [2, 4], "gatewai": [7, 8, 9], "gatu": 7, "gcp": [2, 7, 11], "gener": [6, 10, 12, 13, 14], "get": 1, "group": 4, "gui": [6, 14], "gw": [5, 13], "high": [9, 13], "hoc": [6, 10], "hpe": 9, "i": 3, "iac": 5, "icmp": 4, "icon": 15, "id": 10, "identifi": 10, "implement": 3, "info": 7, "inform": 1, "initi": [7, 13], "insid": [4, 11], "insight": 5, "inspect": 10, "instal": 11, "instanc": 10, "integr": 11, "inter": 4, "intra": 4, "introduct": 2, "ip": [7, 14], "keepal": 9, "lab": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14], "laptop": 4, "launch": 11, "link": 16, "logo": 15, "malici": 14, "mesh": 9, "modifi": 10, "monitor": 7, "more": 13, "mtt": 4, "multi": 4, "multicloud": 7, "network": [5, 7, 8, 9, 10, 11, 13], "new": [3, 6, 10, 14], "object": [4, 6, 7, 8, 9, 10, 11, 12, 13], "overview": [3, 4, 6, 7, 8, 11, 12, 14], "pan": 11, "path": 13, "pdf": 0, "peer": [5, 7, 9, 11], "perform": [9, 13], "perimet": 10, "pod": 16, "polici": [8, 11], "portal": 16, "prefac": 1, "preliminari": 7, "prem": 12, "prepar": 10, "prepend": 13, "prerequisit": 1, "prevent": 14, "privat": 10, "profession": 1, "provis": 5, "psf": [6, 14], "pt": 9, "public": 6, "question": 9, "resid": 10, "result": 5, "retriev": 7, "rout": [7, 9, 11], "rtb": [6, 10, 14], "rule": [4, 6, 10, 14], "s2c": 12, "secur": [10, 13], "segment": [8, 9], "servic": 3, "set": 13, "share": 3, "simul": 10, "site2cloud": 12, "smart": 4, "smartgroup": [6, 10, 14], "span": 7, "spoke": [4, 5, 7, 9, 11, 13], "spoke1": 14, "ssh": [4, 7, 10, 14], "start": [1, 9], "strongswan": 12, "style": 7, "subnet": [6, 10], "summari": [5, 7], "templat": 9, "terraform": 5, "test": [7, 9, 10, 11, 13, 14], "test1": 14, "than": 13, "threat": 14, "threatgroup": 14, "threatiq": 6, "through": [5, 7], "tier": 4, "topologi": [1, 6, 7, 8, 9, 10, 11, 12, 14], "toward": [4, 6, 14], "traffic": [4, 6, 10, 14], "transit": [4, 5, 7, 8, 9, 11, 13], "trust": 10, "two": 14, "u": [7, 14], "uour": 7, "up": 13, "us": 7, "valid": 5, "vendor": 11, "verif": [4, 6, 7, 8, 9, 11, 12, 13, 14], "verifi": [2, 4, 11], "view": 9, "vm": 4, "vnet": 2, "vpc": [2, 5, 9], "webgroup": 10, "welcom": 1, "where": 10, "within": 4, "workload": 10, "york": 3, "your": 4, "zero": 10, "ztna": 10}}) \ No newline at end of file