VMware VSHIELD APP 1.0.0 UPDATE 1

vShield Administration Guide

vShield Manager 4.1.0 Update 1

vShield Zones 4.1.0 Update 1

vShield Edge 1.0.0 Update 1

vShield App 1.0.0 Update 1

vShield Endpoint 1.0.0 Update 1

This document supports the version of each product listed and

supports all subsequent versions until the document is replaced

by a new edition. To check for more recent editions of this

document, see http://www.vmware.com/support/pubs.

EN-000374-01

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

2VMware, Inc.

vShield Administration Guide

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

intellectual property laws. VMware products are covered by one or more patents listed at

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks

and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3

Contents

About This Book 7

vShield Manager and vShield Zones

1Overview of vShield 11

vShield Components 11

vShield Manager 11

vShield Zones 11

vShield Edge 12

vShield App 12

vShield Endpoint 13

Migration of vShield Components 13

VMware Tools 13

Ports Required for vShield Communication 13

2vShield Manager User Interface Basics 15

Logging in to the vShield Manager User Interface 15

Accessing the Online Help 16

vShield Manager User Interface 16

vShield Manager Inventory Panel 16

vShield Manager Configuration Panel 17

3Management System Settings 19

Identify Your vCenter Server 19

Identify DNS Services 20

Set the vShield Manager Date and Time 21

Identify a Proxy Server 21

Download a Technical Support Log from a Component 21

Back Up vShield Manager Data 22

View vShield Manager System Status 22

Add an SSL Certificate to Identify the vShield Manager Web Service 22

4Zones Firewall Management 25

Using Zones Firewall 25

Default Rules 26

Layer 4 Rules and Layer 2/Layer 3 Rules 26

Hierarchy of Zones Firewall Rules 26

Planning Zones Firewall Rule Enforcement 26

Create a Zones Firewall Rule 27

Create a Layer 2/Layer 3 Zones Firewall Rule 28

Validating Active Sessions against the Current Zones Firewall Rules 29

Revert to a Previous Zones Firewall Configuration 29

Delete a Zones Firewall Rule 30

vShield Administration Guide

4VMware, Inc.

5User Management 31

Managing User Rights 31

Managing the Default User Account 32

Add a User 32

Assign a Role and Rights to a User 32

Edit a User Account 32

Delete a User Account 33

6Updating System Software 35

View the Current System Software 35

Upload an Update 35

Review the Update History 36

7Backing Up vShield Manager Data 37

Back Up Your vShield Manager Data on Demand 37

Schedule a Backup of vShield Manager Data 38

Restore a Backup 38

8System Events and Audit Logs 39

View the System Event Report 39

System Event Notifications 40

vShield Manager Virtual Appliance Events 40

vShield App Events 40

Syslog Format 40

View the Audit Log 41

9Uninstalling vShield Components 43

Uninstall a vShield App or vShield Zones 43

Uninstall a vShield Edge from a Port Group 44

Uninstall Port Group Isolation from an ESX Host 44

Uninstall a vShield Endpoint Module 45

Unregister an SVM from a vShield Endpoint Module 45

Uninstall the vShield Endpoint Module from the vSphere Client 45

vShield Edge and Port Group Isolation

10 vShield Edge Management 49

View the Status of a vShield Edge 49

Specify a Remote Syslog Server 50

Managing the vShield Edge Firewall 50

Create a vShield Edge Firewall Rule 50

Validate Active Sessions Against Current vShield Edge Firewall Rules 51

Manage NAT Rules 51

Manage DHCP Service 52

Manage VPN Service 53

Manage Load Balancer Service 55

Start or Stop vShield Edge Services 56

Upgrade vShield Edge Software 56

VMware, Inc. 5

vShield App and vShield Endpoint

11 vShield App Management 59

Send vShield App System Events to a Syslog Server 59

Back Up the Running CLI Configuration of a vShield App 60

View the Current System Status of a vShield App 60

Force a vShield App to Synchronize with the vShield Manager 60

Restart a vShield App 61

View Traffic Statistics by vShield App Interface 61

12 Flow Monitoring 63

Using Flow Monitoring 63

View a Specific Application in the Flow Monitoring Charts 64

Change the Date Range of the Flow Monitoring Charts 64

View the Flow Monitoring Report 64

Add an App Firewall Rule from the Flow Monitoring Report 65

Delete All Recorded Flows 66

Editing Port Mappings 66

Add an Application-Port Pair Mapping 66

Delete an Application-Port Pair Mapping 67

Hide the Port Mappings Table 67

13 App Firewall Management 69

Using App Firewall 69

Securing Containers and Designing Security Groups 69

Default Rules 70

Layer 4 Rules and Layer 2/Layer 3 Rules 70

Hierarchy of App Firewall Rules 70

Planning App Firewall Rule Enforcement 70

Create an App Firewall Rule 71

Create a Layer 2/Layer 3 App Firewall Rule 73

Creating and Protecting Security Groups 73

Add a Security Group 73

Assign Resources to a Security Group 74

Validating Active Sessions against the Current App Firewall Rules 74

Revert to a Previous App Firewall Configuration 75

Delete an App Firewall Rule 75

Using SpoofGuard 75

SpoofGuard Screen Options 76

Enable SpoofGuard 76

Approve IP Addresses 76

Edit an IP Address 77

Delete an IP Address 77

14 vShield Endpoint Events and Alarms 79

View vShield Endpoint Status 79

Alarms 80

Host Alarms 80

SVM Alarms 80

VM Alarms 81

Events 81

Audit Messages 84

VMware, Inc. 6

Appendixes

ACommand Line Interface 87

Logging In and Out of the CLI 87

CLI Command Modes 87

CLI Syntax 88

Moving Around in the CLI 88

Getting Help within the CLI 89

Securing CLI User Accounts and the Privileged Mode Password 89

Add a CLI User Account 89

Delete the admin User Account from the CLI 90

Change the CLI Privileged Mode Password 90

Command Reference 91

Administrative Commands 91

CLI Mode Commands 92

Configuration Commands 95

Debug Commands 102

Show Commands 107

Diagnostics and Troubleshooting Commands 123

User Administration Commands 126

Terminal Commands 128

Deprecated Commands 129

BTroubleshooting 131

Troubleshooting vShield Manager Installation 131

vShield OVA File Extracted to a PC Where vSphere Client Is Not Installed 131

vShield OVA File Cannot Be Installed in vSphere Client 131

Cannot Log In to CLI After the vShield Manager Virtual Machine Starts 132

Cannot Log In to the vShield Manager User Interface 132

Troubleshooting Operation Issues 132

vShield Manager Cannot Communicate with a vShield App 132

Cannot Configure a vShield App 132

Firewall Block Rule Not Blocking Matching Traffic 133

No Flow Data Displaying in Flow Monitoring 133

Troubleshooting Port Group Isolation Issues 133

Validate Installation of Port Group Isolation 133

Verify Install or Uninstall Script 134

Validate the Data Path 134

Details of the fence-util Utility 135

Troubleshooting vShield Edge Issues 136

Virtual Machines Are Not Getting IP Addresses from the DHCP Server 136

Load-Balancer Does Not Work 136

Load-Balancer Throws Error 502 Bad Gateway for HTTP Requests 137

VPN Does Not Work 137

Troubleshooting vShield Endpoint Issues 137

Thin Agent Logging 137

Component Version Compatibility 138

Index 139

VMware, Inc. 7

This manual, the vShield Administration Guide, describes how to install, configure, monitor, and maintain the

VMware®vShield™ system by using the vShield Manager user interface, the vSphere Client plug-in, and

command line interface (CLI). The information includes step-by-step configuration instructions, and

suggested best practices.

Intended Audience

This manual is intended for anyone who wants to install or use vShield in a VMware vCenter environment.

The information in this manual is written for experienced system administrators who are familiar with virtual

machine technology and virtual datacenter operations. This manual assumes familiarity with VMware

Infrastructure 4.x, including VMware ESX, vCenter Server, and the vSphere Client.

VMware Technical Publications Glossary

VMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For definitions

of terms as they are used in VMware technical documentation go to http://www.vmware.com/support/pubs.

Document Feedback

VMware welcomes your suggestions for improving our documentation. If you have comments, send your

feedback to docfeedback@vmware.com.

vShield Documentation

The following documents comprise the vShield documentation set:

vShield Administration Guide, this guide

vShield Quick Start Guide

vShield API Programming Guide

Technical Support and Education Resources

The following sections describe the technical support resources available to you. To access the current version

of this book and other books, go to http://www.vmware.com/support/pubs.

Online and Telephone Support

To use online support to submit technical support requests, view your product and contract information, and

Customers with appropriate support contracts should use telephone support for the fastest response on

priority 1 issues. Go to http://www.vmware.com/support/phone_support.

About This Book

vShield Administration Guide

8VMware, Inc.

Support Offerings

To find out how VMware support offerings can help meet your business needs, go to

http://www.vmware.com/support/services.

VMware Professional Services

VMware Education Services courses offer extensive hands-on labs, case study examples, and course materials

designed to be used as on-the-job reference tools. Courses are available onsite, in the classroom, and live

online. For onsite pilot programs and implementation best practices, VMware Consulting Services provides

offerings to help you assess, plan, build, and manage your virtual environment. To access information about

education classes, certification programs, and consulting services, go to http://www.vmware.com/services.

VMware, Inc. 9

vShield Manager and vShield Zones

vShield Administration Guide

10 VMware, Inc.

Altri manuali per VSHIELD APP 1.0.0 UPDATE 1 - API

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali VMware Software

VMware

VMware VCLOUD API 1.0 - TECHNICAL NOTE Istruzioni operative

VMware

VMware VC-SRM4-A - vCenter Site Recovery Manager Manuale di istruzioni

VMware

VMware VCLOUD REQUEST MANAGER 1.0.0 Manuale utente

VMware

VMware VCENTER CONVERTER EN-000158-02 Manuale utente

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.1.1 -... Manuale utente

VMware

VMware VIEW 4.5 Manuale di installazione e funzionamento

VMware

VMware VLM3-ENG-CP - Lab Manager - PC Manuale utente

VMware

VMware VCM 5.3 - CONFIGURATION MANAGER SECURITY ENVIRONMENT... Guida rapida

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.1.1 -... Manuale di istruzioni

VMware

VMware VSHIELD Manuale utente

VMware

VMware VCM 5.3 - TRANSPORT LAYER SECURITY... Manuale utente

VMware

VMware VSPHERE 4.0 - SOFTWARE COMPATIBILITY MATRIX Manuale utente

VMware

VMware GLOBAL SUPPORT SERVICES Manuale utente

VMware

VMware VSHIELD APP 1.0.0 UPDATE 1 - API Manuale utente

VMware

VMware 454885-B21 - Lab Manager Standard Foundation... Manuale utente

VMware

VMware CLOUD DIRECTOR 1.0 Manuale

VMware

VMware VSHIELD APP 1.0 - Manuale utente

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER Manuale utente

VMware

VMware APPSPEED SERVER 1.5 - VCENTER APPSPEED INSTALLATION... Manuale utente

VMware

VMware VCENTER CAPACITYIQ 1.5 Manuale utente

VMware

VMware VCLOUD SDK 1.0 - FOR NET DEVELOPERS GUIDE Manuale utente

VMware

VMware VCM 5.3 - RECOVERY GUIDE Manuale utente

VMware

VMware VmWare ESX Server 2.12 Deployment Guida di riferimento rapido

VMware

VMware VSHIELD APP Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente