Hi, everyone, and welcome back.
Now into this video, we'll go ahead and implement the traffic mirroring feature in VPC.
Now, before we go ahead and do that, it is important for us to understand some of the concepts related
to traffic mirroring and post.
We understand the concepts.
We'll go ahead and implement the practicals.
Now at a high level overview, there are three important traffic mirroring components.
First one is the target, second one is the filters, and third one is these sessions.
Whenever you implement the traffic metering, it is important for us to go ahead and configure all of
these components.
So the first component here is Target.
So Target is nothing but the destination for a traffic meter session.
So basically, whatever network traffic you want to capture, where will you send that traffic to?
So the location that you will be sending the traffic to is referred to as the target.
So the traffic meter target can either be an elastic network interface or it can also be a load balancer.
So in this diagram you have the monitoring instance, which is acting as a target.
The second important component is filters.
So at a high level overview, the traffic meter filter is a set of inbound and outbound traffic routes
that determine the traffic that is copied from a meter source and sent to the mirror destination.
Now we know that ultimately the traffic will go to the target, but what type of traffic do you need
at Target?
Do you need an HTTP protocol based traffic or a different protocol based traffic and so on?
So depending upon the requirement, you can go ahead and set a filter accordingly.
Now in this filter, we have two rules.
First one is allow HTTP traffic.
Second one is allow DNS traffic.
So this is just for an example.
Now again, note that you might not really want the traffic from all the protocols to go to monitoring
instance.
It will simply overload and overburden it.
And this is something that is also not required.
So only the protocols required as part of maybe your ID is IP is systems required to analyze the security
threats.
Those are some things that you can add as part of your filter.
And the component number three is sessions.
So at a high level overview, the session establishes the relationship between a traffic mirror source
and the traffic mirror target.
As we are discussing, you have the source source and nothing but the AC two instances whose network
traffic will be sent to the target, which is the monitoring instance.
So whenever you configure the session component, you will have to specify the ESI two instances which
are part of the source whose network traffic will be copied.
You will have to specify the target and you'll also have to specify the filter and the session allows
you to connect all of these three components.
So with this basic, let's go ahead and implement this practically.
So currently I am in the easy to console.
Let's go ahead and launch a set of instances now within here.
Let's give it a name.
I'll say traffic mirror instances, the number of instances I'll set it to three.
Let's go a bit down and within the instance type.
One important thing to remember for traffic mirroring is that not all of the instance types are supported.
There are specific instance types that will work for this feature.
So PT two micro does not really work, so we change it to t three medium, right?
So we'll be using this for today's example and the key bit will be using the key pair that we have available
for the region.
Once this is, then we'll go ahead and launch the instances here.
Alright.
So three instances are running, let's go to the instances and we'll rename these instances so that
we can identify the function.
First one I'll refer to as a server instance.
The second one will refer to as a client.
And the third one will refer to as a monitoring instance.
So this is the instance where all of the captured traffic will be forwarded to.
So once we have this easy two instances available from a newer tab, we'll go ahead and quickly open
up the VPC console.
Now from the VPC, let's go a bit down.
You have a specific area related to traffic mirroring.
Now within a similar to what we were discussing, there are three important components, target filter
insertions and we'll be configuring it accordingly.
So first, we'll be configuring the target.
Now within here, we'll open up the mirror targets here.
Let's click on create traffic mirror target the name.
You can just say the more traffic mirror target and within the target over here you have the network
interface load balancer or gateway load balancer.
End Point will be using the network interface and which network interface we will be using.
It would be associated with this monitoring server where the network traffic will be forwarded to.
So for our monitoring instance here, let's verify the network interface.
Let's go back down.
The network interface ID is 9d0.
So the same we'll be configuring, we have the 9d0 and I'll be using it as a target.
I'll click on Create Grid.
This is one part.
The second component after we have completed the target is filters where you can go ahead and specify
the type of traffic that you want to send to your target.
So within the filter, let's go a bit down.
Let's open up the mirror filters.
I'll click on create traffic mirror filters, I'll say demo filter, let's go a bit down.
And within here you can set the inbound as well as the outbound rules.
I'll be setting up inbound rule as an initial as part of today's practical.
Now within the inbound rule, you have protocols and you see there are so many protocols that are available
here.
We'll be using the TCP here and within the port range over here, I'll say port of 80.
And within this source idea I'll say one 7230 100 slash 16 for both the source as well as the destination.
So we want the traffic that is coming from this idea to be captured.
And in the description, you can give a captured HTTP traffic from VPC.
All right.
Once this is done, you can go ahead and click on Create a traffic meter is created.
The last component here is session where we go ahead and connect the traffic mirror source to traffic
filter to your monitoring instance.
So in order to do that, let's go bid down again.
Let's go to the Mirror session.
So let's click on Create Traffic Mirror Session, the name I'll say demo mirror session will go a bit
down within.
You have to specify the mirror source and within here you'll have to add an interface.
So for the server over here, let's look into what is the interface.
So in this specific tab you have the interface ending with 6e3.
So you have a 63 order that will be adding.
Now you have to specify the target, our target we have already created as part of step one session
number, you can just give it as one.
And the last important configuration is the filter where you go ahead and select the filter that you
have created once, then you can go ahead and click on Create.
All right.
So our entire configuration related to the traffic mirroring is setup.
Now at this stage, since we are going to capture the HTTP specific traffic, let's go ahead and make
some configurations at the server level so that we have some kind of a HTTP web server that is listening
to.
So let's do one thing.
Let's go ahead and copy the IP address associated with all of these instances and we'll quickly connect
through terminal.
So from my terminal, I'll quickly log into the server.
So this four step is associated with the server instance will copy the IP address of the client instance.
Let's connect here.
And let's copy the IP address of monitoring instance.
And I the IP address your great so just to revise the first step is associated with the server.
Second type is associated with the client and the third tab is associated with the monitoring instance.
So from the server instance here, let's go ahead and install a web server.
Let's say I'll do a Yum install engine X over here and it will give us the Amazon Linux Command.
Let's copy this command and let me paste it over here.
I do away.
Great and our web server is installed.
If you do a system CTL status engine X, it is currently inactive.
So let's go ahead and start Engine X Warrior.
All right.
If you do a system CTL status, engineers are engine X's up and running.
Now, one more thing that you will have to do is to modify the security group.
So for the server here, let's go ahead and modify the security group.
So only Port 22 is allowed.
This is something that we do not want.
Let's add one more year.
I'll edit the inbound rule.
I'll add a new rule for the port of 80, and for simplicity, I'll just add 0000.
All right.
This is one part and second from the monitoring instance, since all of the network traffic will be
sent to the monitoring instance.
What we'll do, we'll go ahead and add one more rule over here.
Now, since we had launched all of these three instances together, they have the same set of security
group.
So let's go ahead and open this up once more.
I'll edit the inbound rule over here, and within this rule, what I do, I'll capture all the traffic
related to one 7230 100 slash 16.
So this is nothing but the VPC idea and I'll click on Save Rules.
All right.
Now, since we have installed the Engine X at a server level, we should be able to open this up from
the browser itself.
So from the browser, if I add this IP address, you see we are getting the basic engine next page warrior.
Now going back to the C.
Let's quickly switch to the monitoring instance here and let's start to capture the traffic.
And I'll be using the TCP command to capture the traffic that is coming to the interface.
Let's press enter.
Now, at this stage, you see there is no traffic that is coming from the client instance.
Let's do a call command and we'll add the IP address of the server, which is the private IP, which
is 170 2.331. 0.20.
As expected, we are seeing the result.
And if you look into the monitoring instance, the entire network traffic was captured.
Now, one more thing that I wanted to show you.
In fact, let's run the DHCP dump once more now from the client instance.
Will do a call but this time will not specify the private IP.
Let's go ahead and copy the public IP of the server and let's run the call command.
As expected, the results have come, but you see there is no traffic that was captured.
Now the question is why.
Now, if you look into the traffic mirror over here, let's go to the mirror filters.
Let's open up this filter over here.
We had added one specific inbound rule.
Now, within this inbound rule, you see, we had specified the source CIDR of one 7231 and the destination
C idea of one 7231.
This means that the traffic that is coming to the public IP address will not really be captured.
Along with that, the traffic that is coming from any other place other than this cinder block will
also not be captured.
For example, if I refresh this page from the browser, you see there is no traffic that is coming to
the monitoring instance here.
All right.
So in case if you'd like, you can go ahead and add a flexibility here.
I can say 0000/0, and you can copy this in the destination as well.
And you can modify the rule.
Now let's clear the screen.
If you send a request to the public IP.
You see, the traffic has been captured in a similar way.
Let's clear the screen and run them once more from the browser.
If I refresh this specific page again, you see you are getting the captured warrior and this time in
the capture you are seeing my current IP address of my ISP warrior and the destination is the easy to
instance which is acting as a server.
Great.
So I hope that this you understood in detail associated with the components of traffic mirroring and
how you can enable it within your organization.
Now again, note that for today's video we had launched three instances that are not part of free tier.
So in case you are trying to stay within the free tier so that you don't get charged, this is something
that will go beyond that.
So once you have completed with the practicals, you can go ahead and immediately terminate the instance
so that you will not really be charged much.
So I'll terminate the instance and along with that make sure to also terminate the resources that you
have created.
So we'll delete the mirror session.
I'll say delete.
We'll go to filters.
Let's delete the filter.
And now we'll go to Target and let's delete the target.
Great.
So that's the high level overview and with this will conclude today's video.