Trending Topics

VMware on AWS - How to restore NSX DFW firewall rules to previous state

Customers who uses NSX day-in, day-out would like to have a point-in time restore functionality of DFW firewall rules. Many customer have a large footprints in VMC and make changes to DFW quite often. This feature was missing for long time and we could see its included in recent versions . Let's see how DFW configuration roll back works  NSX DFW configuration has versioning, and it is stored in the NSX Manager.  Every time when someone update DFW configuration, NSX creates one more version but keep storing the previous ones. You can rollback for previous config but reapplying it once again.  You can find the options under Networking & Security tab , > Security > Distributed Firewall . In the right side we see an Actions drop down. Choose View to get to the below screen.  Let’s go through the use case:  1. Original state- default config with no custom rules:  a. There are no saved configurations during last 30 days: In my existing test setup, with the current setting


DNS and WINS are really for doing two different (but similar) things. Second, each has been co-opted to assist the other in some cases -- and as a last resort.
Literally Domain Naming System (DNS) servers, resolve Domain Naming System names to IP addresses. Sounds redundant, but technically it is almost literally true (not quite for you advanced people) that an IP host has NO NAME; it has a DNS name only by virtue of the DNS servers or by convention.
Windows Internet Naming Services (WINS) servers resolve NetBIOS names to IP addresses. NetBIOS names ARE a feature of the network node (or host machine). The NetBIOS protocols require that NetBIOS nodes 'defend' their name from other machines attempting to use the same name.
Likewise, a 'host' file resolves DNS names to IP addresses while an 'LMHOST' file resolves NetBIOS names to IP addresses.
So you can see a 1-1 mapping of DNS server to host file, and WINS server to LMHOSTS file.
The order of use of these name resolutions is dependent on various host options, check boxes, and the assigned node types. But in general, if a DNS name cannot be resolved to an IP address, then the WINS method will be used as a back-up resolution method.
Conversely, the DNS method can be selected -- or on some OS versions defaults -- for backing up the WINS/LMHOSTS resolution for NetBIOS names.
The exact order of each separate method is dependent on these options, as well. For instance there are 4 (now 5 but don't ask) main NetBIOS node types:
  • b-node
  • p-node
  • m-node
  • h-node.
B-nodes broadcasts only, p-nodes talk only to a WINS server or WINS proxy and do not broadcast, m-nodes (mixed) broadcast first, followed by using the p-node method, while h-node (hybrid) reverses the m-node order.
Now this whole idea of one method backing up the other method works only if the TWO host/NetBIOS names are the same -- or if they can be converted trivially.
This fact argues strongly for choosing names valid for both, e.g., 15 characters or less with no dashes, underscores, or other characters that are valid only on one resolution system. In this case, the TCP/IP software will construct the DNS name from the NetBIOS name automatically, e.g.,
My machine HAMACHI becomes
...where '' is the name I registered with the InterNIC.
The most important advantage of WINS name resolutions is that DHCP can instruct the station to register itself with the WINS server. DHCP 'leases' IP addresses to stations as they initialize their TCP/IP software. This leasing means that stations do not have to know or configure their own IP addresses locally; these addresses can be centrally administered on the DHCP server, and the software will correctly configure the address and other parameters at boot time.
There are some rudimentary methods of reverse DNS to approximate this, or to substitute for this by using BOOTP to distribute addresses, but these are much less capable at present and don't in general allow for dynamic assignment.
Additionally, dynamic assignment of IP addresses by DHCP allows an administrator to configure a small pool of IP addresses to effectively service a larger group of client machines. (More machines than addresses, even though each machine requires a unique address.)
Example, consider a hypothetical company owning a Class C address (limited to 254 nodes) with 100 office machines, and 300 sales people who work largely in the field.
If it can be determined that fewer than about 150 of those sales people will ever be in the office at one time, DHCP can lease and reclaim that pool of addresses to service all 400 machines from a pool of only 250 addresses.
DHCP DHCP can instruct the station to register these dynamic assignments with the WINS server, thus making these dynamically assigned addresses resolvable from the host name. DNS is largely a fixed, static database.
With Windows NT 4.0, Microsoft began the integrations of DNS with WINS. Under 4.0 DNS can resolve addresses by querying the WINS server, thus enabling a form of 'dynamic' DNS.) With the integration of WINS and DNS, even the DNS clients can participate in this scheme.
DHCP clients will register addresses with the WINS that is supporting the DNS server, which means that addresses can be dynamically allocated and resolved with both methods.
BTW, DHCP is an extension/elaboration of BOOTP, a standard protocol -- not just a Microsoft extension (RFC 1541, 1542 etc). WINS is Microsoft only (Windows Internet Naming ...). But it appears that Microsoft and other vendors are working on RFCs and standards to extend DNS or enhance a future replacement for DNS to offer all of the advantages of both schemes (Dynamic DNS).

Popular posts from this blog

What is a Sysvol?


AD LDS – Syncronizing AD LDS with Active Directory