It takes up to 10 minutes to deploy the Endpoint
{{% /notice %}}  --- ### 3. Route network traffic through endpoints After your Network Security endpoints have successfully deployed, modify the traffic routes in your cloud environment so that traffic is directed to the Network Security endpoints for inspection. - Navigate to the **AWS Console** > **VPC** - Under Virtual Private Cloud, click **Route Tables** - Click **Create route table**.  --- ### 3.1. Creation of Edge Route Table - Name: (optional) ```DevSec WorkShop Edge association rtb``` - Select your **VPC ID** - Click on **Create Route Table**  --- ### 3.2. Edit the Route Table routes - Add the following route | Destination | Target | | ----------- | ----------- | | 192.168.32.0/19 | VPC Endpoint a | | 192.168.0.0/19 | VPC Endpoint b |  --- ### 3.3. Create the edge association - Select the **edge association route table** - Click on the **Edge Associations tab** - Click **Edit edge associations** - Select the Internet Gateway and any Virtual Private Gateways that you want to protect, and then click **Save changes**   ### 3.4. Create another route table for the public subnet in AZ us-east-1b This route table is associated with the Public Subnet in AZ us-east-1b that was created for this VPC - Name: (optional) ```Public subnet az1b route table``` - Select your **VPC ID** - Click on **Create Route Table**  --- ### 3.5. Create subnet association - On the **Public subnet az1b route table** - Click the **Subnet Associations tab** - Click **Edit subnet associations** - Select the subnet that contains the **eksctl-EKS-DevSecOps-TrendMicroWorkshop-cluster/SubnetPublicUSEAST1B** - Create a subnet association for this route table for the subnet **SubnetPublicUSEAST1B**   --- ### 3.6. Edit the Route Table route for the **Public subnet az1b route table** Route Table - On the Route Table ```Public subnet az1b route table``` - Click on **Routes** > **Edit Routes**  - **Modify the route** | Destination | Target | | ----------- | ----------- | | 0.0.0.0/0 | VPC Endpoint b | - Click on **Save Changes**  --- ### 3.7. Edit the Route Table route for the **eksctl-EKS-DevSecOps-TrendMicroWorkshop-cluster/PublicRouteTable** Route Table - Select the Route Table named: ```eksctl-EKS-DevSecOps-TrendMicroWorkshop-cluster/PublicRouteTable``` - Click on **Routes** > **Edit Routes**  - **Modify the route** | Destination | Target | | ----------- | ----------- | | 0.0.0.0/0 | VPC Endpoint a | - Click on **Save Changes**  --- ### 3.8. Create another route table for the **Network Security endpoint subnet** This route table is associated with the **Network Security endpoint** that you deployed in the AZ us-east-1b for this VPC - Name: (optional) ```Network Security endpoint subnet route table 1b``` - Select your **VPC ID** - Click on **Create Route Table**  --- ### 3.9. Create the subnet association - On the **Network Security endpoint subnet route table 1b** - Click the **Subnet Associations tab** - Click **Edit subnet associations**  - Select the subnet that contains your **Network Security deployed on us-east-1b** - To find out what this Subnet is, go to **Cloud One console** > **Network Security** > **Hosted Infrastructure** - Expand the **VPC** you used to deploy the **Network Security Endpoint**  - Click on the option that appears **us-east-1b** in the **Availability Zone** column - On that same page at the bottom, you will see the **Subnet** for this **Network Security Endpoint** in **us-east-1b**  - Back to the **AWS Console** - Select the respective **Network Security Endpoint Subnet** in **us-east-1b** - Create a subnet association for this route table for the subnet **TM-NS-Endpoint-...**  --- ### 3.10. Edit the Route Table route for the **Network Security endpoint subnet route table 1b** Route Table - On the Route Table ```Network Security endpoint subnet route table 1b``` - Click on **Routes** > **Edit Routes**  - **Modify the route** | Destination | Target | | ----------- | ----------- | | 0.0.0.0/0 | igw | - Click on **Save Changes**  --- ### 3.11. Create another route table for the **Network Security endpoint subnet** This route table is associated with the **Network Security endpoint** that you deployed in the AZ us-east-1a for this VPC - Name: (optional) ```Network Security endpoint subnet route table 1a``` - Select your **VPC ID** - Click on **Create Route Table**  --- ### 3.12. Create the subnet association - On the **Network Security endpoint subnet route table 1a** - Click the **Subnet Associations tab** - Click **Edit subnet associations**  - Select the subnet that contains your **Network Security deployed on us-east-1a** - To find out what this Subnet is, go to **Cloud One console** > **Network Security** > **Hosted Infrastructure** - Expand the **VPC** you used to deploy the **Network Security Endpoint**  - Click on the option that appears **us-east-1a** in the **Availability Zone** column - On that same page at the bottom, you will see the **Subnet** for this **Network Security Endpoint** in **us-east-1a**  - Back to the **AWS Console** - Select the respective **Network Security Endpoint Subnet** under **us-east-1a** - Create a subnet association for this route table for the subnet **TM-NS-Endpoint-...**  --- ### 3.13. Edit the Route Table route for the **Network Security endpoint subnet route table 1a** Route Table - On the Route Table ```Network Security endpoint subnet route table 1a``` - Click on **Routes** > **Edit Routes**  - **Modify the route** | Destination | Target | | ----------- | ----------- | | 0.0.0.0/0 | igw | - Click on **Save Changes**  --- ### 4. Now let's test if we are really protected and Network Security is indeed blocking attacks - Go to your **Cloud One Account** > **Network Security** - In the left column click on the third icon and select **Intrusion Prevention Filtering**  - Search for the filter ```3798``` - Select **3798: HTTP: SQL Injection (Boolean Identity)** - Click the **Settings Wheel** to configure rule  - Make sure that your **customized actions** are like the following configuration - Filter State: **Enabled** - Flow Control: **Block** - Log Event: **Enabled** - Click **Save**  - Search for the filter ```5673``` - Select **5673: HTTP: SQL Injection (Boolean Identity)** - Click the **Settings Wheel** to configure rule  - Make sure that your **customized actions** are like the following configuration - Filter State: **Enabled** - Flow Control: **Block** - Log Event: **Enabled** - Click **Save**  - Search for the filter ```0361``` - Select **0361: HTTP: Protected File Access (/etc/passwd)** - Click the **Settings Wheel** to configure rule  - Make sure that your **customized actions** are like the following configuration - Filter State: **Enabled** - Flow Control: **Block** - Log Event: **Enabled** - Click **Save**  - Go back to **Hosted Infrastructure** - Click on the **Distribute Policy** Button to distribute the policy to your **Network Security Endpoint**  - Then click again on the **Distribute Policy** Button  - Wait until it distributes the policy   --- ### 4.1. Go back to the Pygoat Application - Register an account in the application - Click on the **Here** button below password  - Create any user for you to use in our examples - Then click on **Register**  - Login with the user you just created  - In the column on the left, click on **A1: Injection** > **SQL Injection** - Click on the **Lab Details** Button  - And then click on the **Access Lab** Button  - In the **User Name** field put ```admin``` - In the **Password** field put ```anything 1' OR '1' ='1```  - You will see that the page will take some time to load and then a message will appear that **The connection has been restarted**  --- ### Let's confirm that it really was Network Security that did the blocking - In the **AWS console** - Search for **CloudWatch** - In the left column under **Logs** > **Log Groups** - Type ```NSaaS``` - Click on the option that also contains your **VPC ID**  - At the bottom of this screen in **Log Streams** - Click on **ipsBlock**  - You should see at least one detection about **3798: HTTP: SQL Injection (Boolean Identity)** which was exactly the filter we applied to block  -------- ### Congrats now we have a more secure network in the cloud! :smiley: :sun_with_face: :loudspeaker: