VMware VSHIELD APP 1.0

vShield Administration Guide

vShield Manager 4.1

vShield Edge 1.0

vShield App 1.0

vShield Endpoint Security 1.0

This document supports the version of each product listed and

supports all subsequent versions until the document is replaced

by a new edition. To check for more recent editions of this

document, see http://www.vmware.com/support/pubs.

EN-000374-00

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

2VMware, Inc.

vShield Administration Guide

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

intellectual property laws. VMware products are covered by one or more patents listed at

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks

and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3

Contents

AboutThisBook 9

vShieldManagerandvShieldZones

1OverviewofvShield 13

vShieldComponents 13

vShieldManager 13

vShieldZones 13

vShieldEdge 14

StandardvShieldEdgeservices(includingCloudDirector) 14

AdvancedvShieldEdgeservices 14

vShieldApp 14

vShieldEndpoint 15

MigrationofvShieldComponents 15

VMwareTools 15

PortsRequiredforvShieldCommunication 15

2vShieldManagerUserInterfaceBasics 17

LoggingintothevShieldManagerUserInterface 17

AccessingtheOnlineHelp 18

vShieldManagerUserInterface 18

vShieldManagerInventoryPanel 18

RefreshingtheInventoryPanel 18

SearchingtheInventoryPanel 18

vShieldManagerConfigurationPanel 19

3ManagementSystemSettings 21

IdentifyYourvCenterServer 21

IdentifyDNSServices 22

SetthevShieldManagerDateandTime 23

IdentifyaProxyServer 23

DownloadaTechnicalSupportLogfromaComponent 23

BackUpvShieldManagerData 24

ViewvShieldManagerSystemStatus 24

AddanSSLCertificatetoIdentifythevShieldManagerWebService 24

4ZonesFirewallManagement 27

UsingZonesFirewall 27

DefaultRules 28

Layer4RulesandLayer2/Layer3Rules 28

HierarchyofZonesFirewallRules 28

PlanningZonesFirewallRuleEnforcement 28

CreateaZonesFirewallRule 29

CreateaLayer2/Layer3ZonesFirewallRule 30

vShield Administration Guide

4VMware, Inc.

ValidatingActiveSessionsagainsttheCurrentZonesFirewallRules 31

ReverttoaPreviousZonesFirewallConfiguration 31

DeleteaZonesFirewallRule 32

5UserManagement 33

ManagingUserRights 33

ManagingtheDefaultUserAccount 34

AddaUser 34

AssignaRoleandRightstoaUser 34

EditaUserAccount 34

DeleteaUserAccount 35

6UpdatingSystemSoftware 37

ViewtheCurrentSystemSoftware 37

UploadanUpdate 37

ReviewtheUpdateHistory 38

7BackingUpvShieldManagerData 39

BackUpYourvShieldManagerDataonDemand 39

ScheduleaBackupofvShieldManagerData 40

RestoreaBackup 40

8SystemEventsandAuditLogs 41

ViewtheSystemEventReport 41

SystemEventNotifications 42

vShieldManagerVirtualApplianceEvents 42

vShieldAppEvents 42

SyslogFormat 42

ViewtheAuditLog 43

9UninstallingvShieldComponents 45

UninstallavShieldApporvShieldZones 45

UninstallavShieldEdgefromaPortGroup 46

UninstallPortGroupIsolationfromanESXHost 46

UninstallavShieldEndpointModule 47

UnregisteranSVMfromavShieldEndpointModule 47

UninstallthevShieldEndpointModulefromthevSphereClient 47

vShieldEdgeandPortGroupIsolation

10 vShieldEdgeManagement 51

ViewtheStatusofavShieldEdge 51

SpecifyaRemoteSyslogServer 52

ManagingthevShieldEdgeFirewall 52

CreateavShieldEdgeFirewallRule 52

ValidateActiveSessionsAgainstCurrentvShieldEdgeFirewallRules 53

ManageNATRules 53

ManageDHCPService 54

ManageVPNService 56

ManageLoadBalancerService 58

StartorStopvShieldEdgeServices 59

VMware, Inc. 5

vShieldAppandvShieldEndpoint

11 vShieldAppManagement 63

SendvShieldAppSystemEventstoaSyslogServer 63

BackUptheRunningCLIConfigurationofavShieldApp 64

ViewtheCurrentSystemStatusofavShieldApp 64

ForceavShieldApptoSynchronizewiththevShieldManager 64

RestartavShieldApp 65

ViewTrafficStatisticsbyvShieldAppInterface 65

DownloadtheFirewallLogsofavShieldApp 65

12 FlowMonitoring 67

UsingFlowMonitoring 67

ViewaSpecificApplicationintheFlowMonitoringCharts 68

ChangetheDateRangeoftheFlowMonitoringCharts 68

ViewtheFlowMonitoringReport 68

AddanAppFirewallRulefromtheFlowMonitoringReport 69

DeleteAllRecordedFlows 70

EditingPortMappings 70

AddanApplication‐PortPairMapping 70

DeleteanApplication‐PortPairMapping 71

HidethePortMappingsTable 71

13 AppFirewallManagement 73

UsingAppFirewall 73

SecuringContainersandDesigningSecurityGroups 73

DefaultRules 74

Layer4RulesandLayer2/Layer3Rules 74

HierarchyofAppFirewallRules 74

PlanningAppFirewallRuleEnforcement 74

CreateanAppFirewallRule 75

CreateaLayer2/Layer3AppFirewallRule 77

CreatingandProtectingSecurityGroups 77

AddaSecurityGroup 77

AssignResourcestoaSecurityGroup 78

ValidatingActiveSessionsagainsttheCurrentAppFirewallRules 78

ReverttoaPreviousAppFirewallConfiguration 79

DeleteanAppFirewallRule 79

14 vShieldEndpointEventsandAlarms 81

ViewvShieldEndpointStatus 81

Alarms 82

HostAlarms 82

SVMAlarms 82

VMAlarms 83

Events 83

AuditMessages 86

VMware, Inc. 6

Appendixes

ACommandLineInterface 89

LoggingInandOutoftheCLI 89

CLICommandModes 89

CLISyntax 90

MovingAroundintheCLI 90

GettingHelpwithintheCLI 91

SecuringCLIUserAccountsandthePrivilegedModePassword 91

AddaCLIUserAccount 91

DeletetheadminUserAccountfromtheCLI 92

ChangetheCLIPrivilegedModePassword 92

CommandReference 93

AdministrativeCommands 93

list 93

reboot 93

shutdown 94

CLIModeCommands 94

configureterminal 94

disable 94

enable 95

end 95

exit 95

interface 96

quit 96

ConfigurationCommands 97

clearvmwallrules 97

clisshallow 97

copyrunning‐configstartup‐config 97

databaseerase 98

enablepassword 98

hostname 99

ipaddress 99

ipnameserver 99

iproute 100

managerkey 100

ntpserver 101

setclock 101

setup 102

ssh 102

syslog 103

write 103

writeerase 104

writememory 104

DebugCommands 104

debugcopy 104

debugpacketcapture 105

debugpacketdisplayinterface 105

debugremove 106

debugservice 107

debugserviceflowsrc 107

debugshowfiles 108

VMware, Inc. 7

ShowCommands 108

showalerts 108

showarp 109

showclock 109

showconfiguration 109

showdebug 110

showethernet 110

showfilesystem 111

showgatewayrules 111

showhardware 112

showhostname 112

showinterface 112

showipaddr 113

showiproute 113

showiptables 113

showkernelmessage 114

showkernelmessagelast 114

showlog 115

showlogalerts 115

showlogevents 115

showloglast 116

showmanagerlog 116

showmanagerloglast 117

showntp 117

showprocess 118

showroute 118

showrunning‐config 118

showservice 119

showservicestatistics 119

showservices 119

showsession‐managercounters 120

showsession‐managersessions 120

showslots 121

showstacktrace 121

showstartup‐config 121

showsyslog 122

showsystemevents 122

showsystemload 122

showsystemmemory 123

showsystemnetwork_connections 123

showsystemstorage 123

showsystemuptime 124

showversion 124

showvmwalllog 124

showvmwallrules 124

DiagnosticsandTroubleshootingCommands 125

exporttech‐supportscp 125

link‐detect 125

ping 125

pinginterfaceaddr 126

showtechsupport 126

ssh 126

telnet 127

VMware, Inc. 8

traceroute 127

validatesessions 128

UserAdministrationCommands 128

defaultweb‐managerpassword 128

user 128

web‐manager 129

TerminalCommands 129

clearvty 129

reset 130

terminallength 130

terminalnolength 130

DeprecatedCommands 131

BTroubleshooting 133

TroubleshootingvShieldManagerInstallation 133

vShieldOVAFileExtractedtoaPCWherevSphereClientIsNotInstalled 133

Problem 133

Solution 133

vShieldOVAFileCannotBeInstalledinvSphereClient 133

Problem 133

Solution 133

CannotLogIntoCLIAfterthevShieldManagerVirtualMachineStarts 134

Problem 134

Solution 134

CannotLogIntothevShieldManagerUserInterface 134

Problem 134

Solution 134

TroubleshootingOperationIssues 134

vShieldManagerCannotCommunicatewithavShieldApp 134

Problem 134

Solution 134

CannotConfigureavShieldApp 134

Problem 134

Solution 134

FirewallBlockRuleNotBlockingMatchingTraffic 135

Problem 135

Solution 135

NoFlowDataDisplayinginFlowMonitoring 135

TroubleshootingPortGroupIsolationIssues 135

ValidateInstallationofPortGroupIsolation 135

TovalidateinstallationofPortGroupIsolation 135

VerifyInstallorUninstallScript 136

ValidatetheDataPath 136

Detailsofthefence‐utilUtility 137

TroubleshootingvShieldEdgeIssues 138

VirtualMachinesAreNotGettingIPAddressesfromtheDHCPServer 138

Load‐BalancerDoesNotWork 138

Load‐BalancerThrowsError502BadGatewayforHTTPRequests 139

VPNDoesNotWork 139

TroubleshootingvShieldEndpointIssues 139

ThinAgentLogging 139

ComponentVersionCompatibility 140

Index 141

VMware, Inc. 9

Thismanual,thevShieldAdministrationGuide,describeshowtoinstall,configure,monitor,andmaintainthe

VMware®vShield™systembyusingthevShieldManageruserinterface,thevSphereClientplug‐in,and

commandlineinterface(CLI).Theinformationincludesstep‐by‐stepconfigurationinstructions,and

suggestedbestpractices.

Intended Audience

ThismanualisintendedforanyonewhowantstoinstallorusevShieldinaVMwarevCenterenvironment.

Theinformationinthismanualiswrittenforexperiencedsystemadministratorswhoarefamiliarwithvirtual

machinetechnologyandvirtualdatacenteroperations.ThismanualassumesfamiliaritywithVMware

Infrastructure4.x,includingVMwareESX,vCenterServer,andthevSphereClient.

VMware Technical Publications Glossary

VMwareTechnicalPublicationsprovidesaglossaryoftermsthatmightbeunfamiliartoyou.Fordefinitions

oftermsastheyareusedinVMwaretechnicaldocumentationgotohttp://www.vmware.com/support/pubs.

Document Feedback

VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhavecomments,sendyour

feedbacktodocfeedback@vmware.com.

vShield Documentation

ThefollowingdocumentscomprisethevShielddocumentationset:

vShieldAdministrationGuide,thisguide

vShieldQuickStartGuide

vShieldAPIProgrammingGuide

Technical Support and Education Resources

Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversion

ofthisbookandotherbooks,gotohttp://www.vmware.com/support/pubs.

Online and Telephone Support

Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and

Customerswithappropriatesupportcontractsshouldusetelephonesupportforthefastestresponseon

priority1issues.Gotohttp://www.vmware.com/support/phone_support.

About This Book

vShield Administration Guide

10 VMware, Inc.

Support Offerings

TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto

http://www.vmware.com/support/services.

VMware Professional Services

VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials

designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive

online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides

offeringsto helpyouassess,plan,build,andmanageyourvirtualenvironment.Toaccessinformationabout

educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.

Other manuals for VSHIELD APP 1.0 -

This manual suits for next models

Table of contents

Other VMware Software manuals

VMware

VMware VCM 5.3 User manual

VMware

VMware VCENTER CONFIGURATION MANAGER Quick guide

VMware

VMware VCLOUD REQUEST MANAGER 1.0.0 User manual

VMware

VMware VSHIELD APP 1.0.0 UPDATE 1 - API Manual

VMware

VMware 454885-B21 - Lab Manager Standard Foundation... User manual

VMware

VMware VSHIELD APP 1.0.0 UPDATE 1 - API User manual

VMware

VMware vSphere 4 User manual

VMware

VMware VIEW 4.5 - ARCHITECTURE PLANNING... User manual

VMware

VMware 4817V62 - vSphere - PC Instruction Manual

VMware

VMware THINAPP User manual

VMware

VMware VCENTER CHARGEBACK 1.5 - API Guide

VMware

VMware VCENTER CHARGEBACK User manual

VMware

VMware VSPHERE 4.0 - SOFTWARE COMPATIBILITY MATRIX User manual

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 General instructions

VMware

VMware CONVERTER STANDALONE 4.3 User manual

VMware

VMware VmWare ESX Server 2.12 Deployment Quick reference guide

VMware

VMware VSHIELD APP 1.0 - API Operating instructions

VMware

VMware VCLOUD SDK 1.0 - FOR NET DEVELOPERS GUIDE User manual

VMware

VMware VSHIELD APP 1.0 - User manual

VMware

VMware ZIMBRA Installation guide

VMware

VMware VCLOUD REQUEST MANAGER User manual

VMware

VMware CLOUD DIRECTOR 1.0 User manual

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.1.1 -... User manual

VMware

VMware VCENTER CONFIGURATION MANAGER 5.3 - SOFTWARE REQUIEREMENTS... Quick guide

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

VMware VSHIELD APP 1.0 - Manual

Popular Software manuals by other brands