VMware VSHIELD APP 1.0.0 UPDATE 1

vShield Quick Start Guide

vShield Manager 4.1.0 Update 1

vShield Zones 4.1.0 Update 1

vShield Edge 1.0.0 Update 1

vShield App 1.0.0 Update 1

vShield Endpoint 1.0.0 Update 1

This document supports the version of each product listed and

supports all subsequent versions until the document is replaced

by a new edition. To check for more recent editions of this

document, see http://www.vmware.com/support/pubs.

EN-000375-01

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

2VMware, Inc.

vShield Quick Start Guide

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

intellectual property laws. VMware products are covered by one or more patents listed at

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks

and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3

Contents

About This Book 5

1Introduction to vShield 7

vShield Components at a Glance 7

vShield Manager 7

vShield Zones 7

vShield Edge 8

vShield App 9

vShield Endpoint 9

Deployment Scenarios 10

Protecting the DMZ 10

Isolating and Protecting Internal Networks 10

Protecting Virtual Machines in a Cluster 11

Common Deployments of vShield Edge 11

Common Deployments of vShield App 11

2Preparing for Installation 13

System Requirements 13

Hardware 13

Software 13

Client and User Access 14

Deployment Considerations 14

Preparing Virtual Machines for vShield Protection 14

vShield Manager Uptime 15

Communication Between vShield Components 15

Hardening Your vShield Virtual Machines 15

3Installing the vShield Manager and vShield Zones 17

Obtain the vShield Manager OVA File 17

Install the vShield Manager Virtual Appliance 17

Configure the Network Settings of the vShield Manager 18

Synchronize the vShield Manager with the vCenter Server 19

Change the Password of the vShield Manager User Interface Default Account 20

Install vShield Zones 20

Where to Go Next 21

4Installing vShield Edge, vShield App, and vShield Endpoint 23

Running vShield in Evaluation Mode 23

Preparing Your Virtual Infrastructure for vShield App, vShield Edge, and vShield Endpoint 23

Install vShield Component Licenses 24

Prepare All ESX Hosts 24

Prepare a vNetwork for Port Group Isolation 25

Install a vShield Edge 25

vShield Quick Start Guide

4VMware, Inc.

Installing vShield Endpoint 27

vShield Endpoint Installation Workflow 27

Install the Thin Agent on the Guest Virtual Machine 27

Where to Go Next 28

Index 29

VMware, Inc. 5

The vShield Quick Start Guide provides information about installing VMware® vShield™ into your VMware

Virtual Infrastructure environment.

Intended Audience

This book is intended for anyone who wants to install or use VMware vShield. The information in this book is

written for experienced Windows or Linux system administrators who are familiar with virtual machine

technology and datacenter operations. This book also assumes familiarity with VMware Virtual

Infrastructure, including vCenter™ Server 4.x, VMware ESX™ 4.x, and the vSphere Client.

VMware Technical Publications Glossary

VMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For definitions

of terms as they are used in VMware technical documentation go to http://www.vmware.com/support/pubs.

Document Feedback

VMware welcomes your suggestions for improving our documentation. If you have comments, send your

feedback to docfeedback@vmware.com.

VMware Infrastructure Documentation

The following documents comprise the vShield 2.0 documentation set:

vShield Administration Guide

vShield Quick Start Guide

vShield API Programming Guide

You should also have access to the combined vCenter Server and ESX documentation set.

Technical Support and Education Resources

The following sections describe the technical support resources available to you. To access the current version

of this book and other books, go to http://www.vmware.com/support/pubs.

Online and Telephone Support

To use online support to submit technical support requests, view your product and contract information, and

Customers with appropriate support contracts should use telephone support for the fastest response on

priority 1 issues. Go to http://www.vmware.com/support/phone_support.

About This Book

vShield Quick Start Guide

6VMware, Inc.

Support Offerings

To find out how VMware support offerings can help meet your business needs, go to

http://www.vmware.com/support/services.

VMware Professional Services

VMware Education Services courses offer extensive hands-on labs, case study examples, and course materials

designed to be used as on-the-job reference tools. Courses are available onsite, in the classroom, and live

online. For onsite pilot programs and implementation best practices, VMware Consulting Services provides

offerings to help you assess, plan, build, and manage your virtual environment. To access information about

education classes, certification programs, and consulting services, go to http://www.vmware.com/services.

VMware, Inc. 7

This chapter introduces the VMware®vShield™ components you install.

The chapter includes the following topics:

“vShield Components at a Glance” on page 7

“Deployment Scenarios” on page 10

vShield Components at a Glance

VMware vShield is a suite of security virtual appliances built for VMware vCenter™ Server integration.

vShield is a critical security component for protecting virtualized datacenters from attacks and misuse helping

you achieve your compliance-mandated goals.

vShield includes virtual appliances and services essential for protecting virtual machines. vShield can be

configured through a web-based user interface, a vSphere Client plug-in, a command line interface (CLI), and

REST API.

vCenter Server includes vShield Manager and vShield Zones. The following vShield packages each require a

license:

vShield Edge with Port Group Isolation

vShield App

vShield Endpoint

One vShield Manager manages multiple vShield Zones, vShield Edge, vShield App, and vShield Endpoint

instances.

vShield Manager

The vShield Manager is the centralized network management component of vShield, and is installed as a

virtual appliance on any ESX™ host in your vCenter Server environment. A vShield Manager can run on a

different ESX host from your vShield agents.

Using the vShield Manager user interface or vSphere Client plug-in, administrators install, configure, and

maintain vShield components. The vShield Manager user interface leverages the VMware Infrastructure SDK

to display a copy of the vSphere Client inventory panel, and includes the Hosts & Clusters and Networks

views.

vShield Zones

vShield Zones provides firewall protection for traffic between virtual machines. For each Zones Firewall rule,

you can specify the source IP, destination IP, source port, destination port, and service.

Introduction to vShield 1

vShield Quick Start Guide

8VMware, Inc.

vShield Edge

vShield Edge provides network edge security and gateway services to isolate the virtual machines in a port

group, vDS port group, or Cisco®Nexus 1000V. The vShield Edge connects isolated, stub networks to shared

(uplink) networks by providing common gateway services such as DHCP, VPN, NAT, and Load Balancing.

Common deployments of vShield Edge include in the DMZ, VPN Extranets, and multi-tenant Cloud

environments where the vShield Edge provides perimeter security for Virtual Datacenters (VDCs).

Standard vShield Edge Services (Including Cloud Director)

Firewall: Supported rules include IP 5-tuple configuration with IP and port ranges for stateful inspection

for TCP, UDP, and ICMP.

Network Address Translation: Separate controls for Source and Destination IP addresses, as well as TCP

and UDP port translation.

Dynamic Host Configuration Protocol (DHCP): Configuration of IP pools, gateways, DNS servers, and

search domains.

Advanced vShield Edge Services

Site-to-Site Virtual Private Network (VPN): Uses standardized IPsec protocol settings to interoperate with

all major firewall vendors.

Load Balancing: Simple and dynamically configurable virtual IP addresses and server groups.

vShield Edge supports syslog export for all services to remote servers.

Figure 1-1. vShield Edge Installed to Secure a vDS Port Group

VMware, Inc. 9

Chapter 1 Introduction to vShield

vShield App

vShield App is an interior, vNIC-level firewall that allows you to create access control policies regardless of

network topology. A vShield App monitors all traffic in and out of an ESX host, including between virtual

machines in the same port group. vShield App includes traffic analysis and container-based policy creation.

vShield App installs as a hypervisor module and firewall service virtual appliance. vShield App integrates

with ESX hosts through VMsafe APIs and works with VMware vSphere platform features such as DRS,

vMotion, DPM, and maintenance mode.

vShield App provides firewalling between virtual machines by placing a firewall filter on every virtual

network adapter. The firewall filter operates transparently and does not require network changes or

modification of IP addresses to create security zones. You can write access rules by using vCenter containers,

like datacenters, cluster, resource pools and vApps, or network objects, like Port Groups and VLANs, to

reduce the number of firewall rules and make the rules easier to track.

You should install vShield App instances on all ESX hosts within a cluster so that VMware vMotion™

operations work and virtual machines remain protected as they migrate between ESX hosts. By default, a

vShield App virtual appliance cannot be moved by using vMotion.

The Flow Monitoring feature displays allowed and blocked network flows at the application protocol level.

You can use this information to audit network traffic and troubleshoot operational.

vShield Endpoint

vShield Endpoint delivers an introspection-based antivirus solution. vShield Endpoint uses the hypervisor to

scan guest virtual machines from the outside without a bulky agent. vShield Endpoint is efficient in avoiding

resource bottlenecks while optimizing memory use.

vShield Endpoint installs as a hypervisor module and security virtual appliance from a third-party antivirus

vendor (VMware partners) on an ESX host.

Figure 1-2. vShield Endpoint Installed on an ESX Host

vShield Quick Start Guide

10 VMware, Inc.

Deployment Scenarios

Using vShield, you can build secure zones for a variety of virtual machine deployments. You can isolate virtual

machines based on specific applications, network segmentation, or custom compliance factors. Once you

determine your zoning policies, you can deploy vShield to enforce access rules to each of these zones.

Protecting the DMZ

The DMZ is a mixed trust zone. Clients enter from the Internet for Web and email services, while services

within the DMZ might require access to services inside the internal network. You can place DMZ virtual

machines in a port group and secure that port group with a vShield Edge. vShield Edge provides access

services such as firewall, NAT, and VPN, as well as load balancing to secure DMZ services.

A common example of a DMZ service requiring an internal service is Microsoft Exchange. Microsoft Outlook

Web Access (OWA) commonly resides in the DMZ cluster, while the Microsoft Exchange back end is in the

internal cluster. On the internal cluster, you can create firewall rules to allow only Exchanged-related requests

from the DMZ, identifying specific source-to-destination parameters. From the DMZ cluster, you can create

rules to allow outside access to the DMZ only to specific destinations using HTTP, FTP, or SMTP.

Isolating and Protecting Internal Networks

You can use a vShield Edge with the Port Group Isolation feature to isolate an internal network from the

external network. A vShield Edge provides perimeter firewall protection and edge services to secure virtual

machines in a port group, enabling communication to the external network through DHCP, NAT, and VPN.

Within the secured port group, you can install a vShield App instance on each ESX host that the vDS spans to

secure communication between virtual machines in the internal network.

If you utilize VLAN tags to segment traffic, you can use App Firewall to create smarter access policies. Using

App Firewall instead of a physical firewall allows you to collapse or mix trust zones in shared ESX clusters. By

doing so, you gain optimal utilization and consolidation from features such as DRS and HA, instead of having

separate, fragmented clusters. Management of the overall ESX deployment as a single pool is less complex

than having separately managed pools.

For example, you use VLANs to segment virtual machine zones based on logical, organizational, or network

boundaries. Leveraging the Virtual Infrastructure SDK, the vShield Manager inventory panel displays a view

of your VLAN networks under the Networks view. You can build access rules for each VLAN network to

isolate virtual machines and drop untagged traffic to these machines.

Altri manuali per VSHIELD APP 1.0.0 UPDATE 1 - API

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali VMware Software

VMware

VMware THINAPP Manuale utente

VMware

VMware VSHIELD APP 1.0.0 UPDATE 1 - API Istruzioni operative

VMware

VMware VC-SRM4-A - vCenter Site Recovery Manager Manuale di istruzioni

VMware

VMware VLM3-ENG-CP - Lab Manager - PC Manuale utente

VMware

VMware VCENTER CHARGEBACK 1.5 - API Manuale utente

VMware

VMware VS4-ENT-PL-A - vSphere Enterprise Plus Manuale utente

VMware

VMware VSPHERE 4.0 - SOFTWARE COMPATIBILITY MATRIX Manuale utente

VMware

VMware VCM 5.3 - RECOVERY GUIDE Manuale utente

VMware

VMware VCENTER CHARGEBACK 1.5 - API Guida

VMware

VMware THINAPP 4.6 - MIGRATING APPLICATIONS TECHNICAL... Guida utente

VMware

VMware VIEW 4.5 - GUIDE DE MISE A NIVEAU Manuale utente

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.0 Manuale utente

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.1.1 -... Manuale utente

VMware

VMware VIEW 4.5 Manuale utente

VMware

VMware VmWare ESX Server 2.12 Deployment Guida di riferimento rapido

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Manuale utente

VMware

VMware SUSE LINUX ENTERPRISE SERVER Manuale utente

VMware

VMware vSphere ESXi 4.0 Manuale di programmazione

VMware

VMware 454885-B21 - Lab Manager Standard Foundation... Manuale utente

VMware

VMware SUSE LINUX ENTERPRISE SERVER Manuale utente

VMware

VMware VSHIELD APP Manuale utente

VMware

VMware VCENTER CHARGEBACK 1.5 - API Manuale utente

VMware

VMware VFABRIC TC SERVER Manuale utente

VMware

VMware CLOUD COMPUTING - Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

VMware VSHIELD APP 1.0.0 UPDATE 1 - API Manuale utente

Manuali Software popolari di altre marche