Page 1 App 1.0 vShield Endpoint Security 1.0 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www.vmware.com/support/pubs. EN-000374-00...
Page 2 VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
Page 3: Table Of Contents
Overview of vShield 13 vShield Components 13 vShield Manager 13 vShield Zones 13 vShield Edge 14 Standard vShield Edge services (including Cloud Director) 14 Advanced vShield Edge services 14 vShield App 14 vShield Endpoint 15 Migration of vShield Components 15 VMware Tools 15 Ports Required for vShield Communication 15 vShield Manager User Interface Basics 17 Logging in to the vShield Manager User Interface 17 Accessing the Online Help 18 vShield Manager User Interface 18 vShield Manager Inventory Panel 18 Refreshing the Inventory Panel 18 Searching the Inventory Panel 18 vShield Manager Configuration Panel 19 Management System Settings 21...
Page 4 View the Audit Log 43 Uninstalling vShield Components 45 Uninstall a vShield App or vShield Zones 45 Uninstall a vShield Edge from a Port Group 46 Uninstall Port Group Isolation from an ESX Host 46 Uninstall a vShield Endpoint Module 47 Unregister an SVM from a vShield Endpoint Module 47 Uninstall the vShield Endpoint Module from the vSphere Client 47 vShield Edge and Port Group Isolation vShield Edge Management 51 View the Status of a vShield Edge 51 Specify a Remote Syslog Server 52 Managing the vShield Edge Firewall 52 Create a vShield Edge Firewall Rule 52 Validate Active Sessions Against Current vShield Edge Firewall Rules 53 Manage NAT Rules 53 Manage DHCP Service 54 Manage VPN Service 56 Manage Load Balancer Service 58 Start or Stop vShield Edge Services 59 VMware, Inc.
Page 5 Layer 4 Rules and Layer 2/Layer 3 Rules 74 Hierarchy of App Firewall Rules 74 Planning App Firewall Rule Enforcement 74 Create an App Firewall Rule 75 Create a Layer 2/Layer 3 App Firewall Rule 77 Creating and Protecting Security Groups 77 Add a Security Group 77 Assign Resources to a Security Group 78 Validating Active Sessions against the Current App Firewall Rules 78 Revert to a Previous App Firewall Configuration 79 Delete an App Firewall Rule 79 vShield Endpoint Events and Alarms 81 View vShield Endpoint Status 81 Alarms 82 Host Alarms 82 SVM Alarms 82 VM Alarms 83 Events 83 Audit Messages 86 VMware, Inc.
Page 6 99 ip route 100 manager key 100 ntp server 101 set clock 101 setup 102 ssh 102 syslog 103 write 103 write erase 104 write memory 104 Debug Commands 104 debug copy 104 debug packet capture 105 debug packet display interface 105 debug remove 106 debug service 107 debug service flow src 107 debug show files 108 VMware, Inc.
Page 7 121 show syslog 122 show system events 122 show system load 122 show system memory 123 show system network_connections 123 show system storage 123 show system uptime 124 show version 124 show vmwall log 124 show vmwall rules 124 Diagnostics and Troubleshooting Commands 125 export tech‐support scp 125 link‐detect 125 ping 125 ping interface addr 126 show tech support 126 ssh 126 telnet 127 VMware, Inc.
Page 8 Firewall Block Rule Not Blocking Matching Traffic 135 Problem 135 Solution 135 No Flow Data Displaying in Flow Monitoring 135 Troubleshooting Port Group Isolation Issues 135 Validate Installation of Port Group Isolation 135 To validate installation of Port Group Isolation 135 Verify Install or Uninstall Script 136 Validate the Data Path 136 Details of the fence‐util Utility 137 Troubleshooting vShield Edge Issues 138 Virtual Machines Are Not Getting IP Addresses from the DHCP Server 138 Load‐Balancer Does Not Work 138 Load‐Balancer Throws Error 502 Bad Gateway for HTTP Requests 139 VPN Does Not Work 139 Troubleshooting vShield Endpoint Issues 139 Thin Agent Logging 139 Component Version Compatibility 140 Index 141 VMware, Inc.
Page 9: About This Book
About This Book This manual, the vShield Administration Guide, describes how to install, configure, monitor, and maintain the ® VMware vShield™ system by using the vShield Manager user interface, the vSphere Client plug‐in, and command line interface (CLI). The information includes step‐by‐step configuration instructions, and suggested best practices. Intended Audience This manual is intended for anyone who wants to install or use vShield in a VMware vCenter environment. The information in this manual is written for experienced system administrators who are familiar with virtual machine technology and virtual datacenter operations. This manual assumes familiarity with VMware Infrastructure 4.x, including VMware ESX, vCenter Server, and the vSphere Client. VMware Technical Publications Glossary VMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For definitions of terms as they are used in VMware technical documentation go to http://www.vmware.com/support/pubs. Document Feedback VMware welcomes your suggestions for improving our documentation. If you have comments, send your feedback to docfeedback@vmware.com. vShield Documentation The following documents comprise the vShield documentation set:  vShield Administration Guide, this guide  vShield Quick Start Guide  vShield API Programming Guide Technical Support and Education Resources The following sections describe the technical support resources available to you. To access the current version ...
Page 10 Administration Guide Support Offerings To find out how VMware support offerings can help meet your business needs, go to http://www.vmware.com/support/services. VMware Professional Services VMware Education Services courses offer extensive hands‐on labs, case study examples, and course materials designed to be used as on‐the‐job reference tools. Courses are available onsite, in the classroom, and live online. For onsite pilot programs and implementation best practices, VMware Consulting Services provides offerings to help you assess, plan, build, and manage your virtual environment. To access information about education classes, certification programs, and consulting services, go to http://www.vmware.com/services. VMware, Inc.
Page 11: Vshield Manager And Vshield Zones
Manager and vShield Zones VMware, Inc.
Page 12 Administration Guide VMware, Inc.
Page 13: Overview Of Vshield
Overview of vShield ® VMware vShield is a suite of security virtual appliances built for VMware vCenter™ Server and Vmware ESX™ integration. vShield is a critical security component for protecting virtualized datacenters from attacks and misuse helping you achieve your compliance‐mandated goals. This guide assumes you have administrator access to the entire vShield system. The viewable resources in the vShield Manager user interface can differ based on the assigned role and rights of a user, and licensing. If you are unable to access a screen or perform a particular task, consult your vShield administrator. This chapter includes the following topics:  “vShield Components” on page 13  “Migration of vShield Components” on page 15  “VMware Tools” on page 15  “Ports Required for vShield Communication” on page 15 vShield Components vShield includes components and services essential for protecting virtual machines. vShield can be configured through a web‐based user interface, a vSphere Client plug‐in, a command line interface (CLI), and REST API. To run vShield, you need one vShield Manager virtual machine and at least one vShield App or vShield Edge module. vShield Manager The vShield Manager is the centralized network management component of vShield and is installed from OVA as a virtual machine by using the vSphere Client. Using the vShield Manager user interface, administrators install, configure, and maintain vShield components. A vShield Manager can run on a different ESX host from your vShield App and vShield Edge modules. The vShield Manager leverages the VMware Infrastructure SDK to display a copy of the vSphere Client inventory panel. For more on the using the vShield Manager user interface, see Chapter 2, “vShield Manager User Interface ...
Page 14: Vshield Edge
 Firewall: Supported rules include IP 5‐tuple configuration with IP and port ranges for stateful inspection for TCP, UDP, and ICMP.  Network Address Translation: Separate controls for Source and Destination IP addresses, as well as TCP and UDP port translation.  Dynamic Host Configuration Protocol (DHCP): Configuration of IP pools, gateways, DNS servers, and search domains. Advanced vShield Edge services  Site‐to‐Site Virtual Private Network (VPN): Uses standardized IPsec protocol settings to interoperate with all major firewall vendors.  Load Balancing: Simple and dynamically configurable virtual IP addresses and server groups. vShield Edge supports syslog export for all services to remote servers. vShield App You must obtain an evaluation or full license to use vShield App. vShield App is an interior, vNIC‐level firewall that allows you to create access control policies regardless of network topology. A vShield App monitors all traffic in and out of an ESX host, including between virtual machines in the same port group. vShield App includes traffic analysis and container‐based policy creation. vShield App installs as a hypervisor module and firewall service virtual appliance. vShield App integrates with ESX hosts through VMsafe APIs and works with VMware vSphere platform features such as DRS, vMotion, DPM, and maintenance mode. vShield App provides firewalling between virtual machines by placing a firewall filter on every virtual network adapter. The firewall filter operates transparently and does not require network changes or modification of IP addresses to create security zones. You can write access rules by using vCenter containers, like datacenters, cluster, resource pools and vApps, or network objects, like Port Groups and VLANs, to reduce the number of firewall rules and make the rules easier to track. You should install vShield App instances on all ESX hosts within a cluster so that VMware vMotion™ operations work and virtual machines remain protected as they migrate between ESX hosts. By default, a vShield App virtual appliance cannot be moved by using vMotion. The Flow Monitoring feature displays allowed and blocked network flows at the application protocol level. You can use this information to audit network traffic and troubleshoot operational. VMware, Inc.
Page 15: Vshield Endpoint
 On‐demand file scanning in a service virtual machine.  On‐access file scanning in a service virtual machine. Migration of vShield Components The vShield Manager and vShield Edge virtual appliances can be automatically or manually migrated based on DRS and HA policies. The vShield Manager must always be up, so you must migrate the vShield Manager whenever the current ESX host undergoes a reboot or maintenance mode routine. Each vShield Edge should move with its secured port group to maintain security settings and services. vShield App and Port Group Isolation services cannot be moved to another ESX host. If the ESX host on which these services reside requires a manual maintenance mode operation, you must de‐select the Move powered off and suspended virtual machines to other hosts in the cluster check box to ensure these virtual appliances are not migrated. These services restart after the ESX host comes online. VMware Tools Each vShield virtual appliance includes VMware Tools. Do not upgrade or uninstall the version of VMware Tools included with a vShield virtual appliance. Ports Required for vShield Communication The vShield Manager requires the following ports to be open:  REST API: 80/TCP and 443/TCP  Graphical User Interface: 80/TCP to 443/TCP and initiates connections to vSphere vCenter SDK.  SSH access to the CLI (not enabled by default): 22/TCP VMware, Inc.
Page 16 Administration Guide VMware, Inc.
Page 17: Vshield Manager User Interface Basics
“Logging in to the vShield Manager User Interface” on page 17  “Accessing the Online Help” on page 18  “vShield Manager User Interface” on page 18 Logging in to the vShield Manager User Interface You access the vShield Manager management interface by using a Web browser. To log in to the vShield Manager user interface Open a Web browser window and type the IP address assigned to the vShield Manager. The vShield Manager user interface opens in an SSH session. Accept the security certificate. To use an SSL certificate for authentication, see “Add an SSL Certificate to Identify the vShield Manager Web Service” on page 24. The vShield Manager login screen appears. Log in to the vShield Manager user interface by using the username admin and the password default. You should change the default password as one of your first tasks to prevent unauthorized use. See “Edit a User Account” on page 34. Click Log In. VMware, Inc.
Page 18: Accessing The Online Help
There are differences in the icons for virtual machines and vShield components between the vShield Manager and the vSphere Client inventory panels. Custom icons are used to show the difference between vShield components and virtual machines, and the difference between protected and unprotected virtual machines. Table 2-1. vShield Virtual Machine Icons in the vShield Manager Inventory Panel Icon Description A powered on vShield App in active protection state. A powered off vShield App. A powered on virtual machine that is protected by a vShield App. A powered on virtual machine that is not protected by a vShield App. Refreshing the Inventory Panel To refresh the list of resources in the inventory panel, click . The refresh action requests the latest resource information from the vCenter Server. By default, the vShield Manager requests resource information from the vCenter Server every five minutes. Searching the Inventory Panel To search the inventory panel for a specific resource, type a string in the field atop the vShield Manager inventory panel and click . VMware, Inc.
Page 19: Vshield Manager Configuration Panel
Chapter 2 vShield Manager User Interface Basics vShield Manager Configuration Panel The vShield Manager configuration panel presents the settings that can be configured based on the selected inventory resource and the output of vShield operation. Each resource offers multiple tabs, each tab presenting information or configuration forms corresponding to the resource. Because each resource has a different purpose, some tabs are specific to certain resources. Also, some tabs have a second level of options. VMware, Inc.
Page 20 Administration Guide VMware, Inc.
Page 21: Management System Settings
 “Identify a Proxy Server” on page 23  “Download a Technical Support Log from a Component” on page 23  “View vShield Manager System Status” on page 24  “Add an SSL Certificate to Identify the vShield Manager Web Service” on page 24 Identify Your vCenter Server After the vShield Manager is installed as a virtual machine, log in to the vShield Manager user interface to connect to your vCenter Server. This enables the vShield Manager to display your VMware Infrastructure inventory. To identify your vCenter Server from the vShield Manager Log in to the vShield Manager. Upon initial login, the vShield Manager opens to the Configuration > vCenter tab. If you have previously configured the vCenter tab form, perform the following steps: Click the Settings & Reports from the vShield Manager inventory panel. Click the Configuration tab. The vCenter screen appears. Under vCenter Server Information, type the IP address of your vCenter Server in the vSphere Server IP Address/Name field. Type your vSphere Client login user name in the Administrator User Name field. This user account must have administrator access. VMware, Inc.
Page 22: Register The Vshield Manager As A Vsphere Client Plug-In
To register the vShield Manager as a vSphere Client plug-in If you are logged in to the vSphere Client, log out. Log in to the vShield Manager. Click Settings & Reports from the vShield Manager inventory panel. Click the Configuration tab. The vCenter screen appears. Under vSphere Plug‐in, click Register. Registration might take a few minutes. Log in to the vSphere Client. Select an ESX host. Verify that vShield Install appears as a tab. You can install and configure vShield components from the vSphere Client. Identify DNS Services You must specify at least one DNS server during vShield Manager setup. The specified DNS servers appear in the vShield Manager user interface. In the vShield Manager user interface, you can specify up to three DNS servers that the vShield Manager can use for IP address and host name resolution. To identify a DNS server Click Settings & Reports from the vShield Manager inventory panel. Click the Configuration tab. The vCenter screen appears. Under DNS Servers, type an IP address in Primary DNS IP Address to identify the primary DNS server. This server is checked first for all resolution requests. (Optional) Type an IP address in the Secondary DNS IP Address field. (Optional) Type an IP address in the Tertiary DNS IP Address field. Click Save. VMware, Inc.
Page 23: Set The Vshield Manager Date And Time
Microsoft ISA Server. To identify a proxy server Click Settings & Reports from the vShield Manager inventory panel. Click the Configuration tab. Click HTTP Proxy. From the Use Proxy drop‐down menu, select Yes. (Optional) Type the host name of the proxy server in the Proxy Host Name field. Type the IP address of the proxy server in the Proxy IP Address field. Type the connecting port number on your proxy server in the Proxy Port field. Type the User Name required to log in to the proxy server. Type the Password associated with the user name for proxy server login. 10 Click Save. Download a Technical Support Log from a Component You can use the Support option to download the system log from a vShield component to your PC. A system log can be used to troubleshoot operational issues. To download a vShield component system log Click Settings & Reports from the vShield Manager inventory panel. Click the Configuration tab. Click Support. VMware, Inc.
Page 24: Back Up Vshield Manager Data
Add an SSL Certificate to Identify the vShield Manager Web Service You can generate or import an SSL certificate into the vShield Manager to authenticate the identity of the vShield Manager web service and encrypt information sent to the vShield Manager web server. As a security best practice, you should use the generate certificate option to generate a private key and public key, where the private key is saved to the vShield Manager. To generate an SSL certificate Click Settings & Reports from the vShield Manager inventory panel. Click the Configuration tab. Click SSL Certificate. Under Generate Certificate Signing Request, enter the following information: Field Description Common Name Enter the name that matches the site name. For example, if the IP address of vShield Manager management interface is 192.168.1.10, enter 192.168.1.10. Organization Unit Enter the department in your company that is ordering the certificate. Organization Name Enter the full legal name of your company. City Name Enter the full name of the city in which your company resides. State Name Enter the full name of the state in which your company resides. Country Code Enter the two‐digit code that represents your country. For example, the United States is US. VMware, Inc.
Page 25 Chapter 3 Management System Settings Field Description Key Algorithm Select the cryptographic algorithm to use from either DSA or RSA. Key Size Select the number of bits used in the selected algorithm. Click Generate. To import an SSL certificate Click Settings & Reports from the vShield Manager inventory panel. Click the Configuration tab. Click SSL Certificate. Under Import Signed Certificate, click Browse at Certificate File to find the file. Select the type of certificate file from the Certificate File drop‐down list. Click Apply. VMware, Inc.
Page 26 Administration Guide VMware, Inc.
Page 27: Zones Firewall Management
You can upgrade vShield Zones to vShield App by obtaining a vShield App license. vShield App enhances vShield Zones protection by offering Flow Monitoring, custom container creation (Security Groups), and container‐based access policy creation and enforcement. You do not have to uninstall vShield Zones to install vShield App. All vShield Zones instances become vShield App instances, the Zones Firewall becomes App Firewall, and the additional vShield App features are enabled. This chapter includes the following topics:  “Using Zones Firewall” on page 27  “Create a Zones Firewall Rule” on page 29  “Create a Layer 2/Layer 3 Zones Firewall Rule” on page 30  “Validating Active Sessions against the Current Zones Firewall Rules” on page 31  “Revert to a Previous Zones Firewall Configuration” on page 31  “Delete a Zones Firewall Rule” on page 32 Using Zones Firewall Zones Firewall is a centralized, hierarchical firewall for ESX hosts. Zones Firewall enables you to create rules that allow or deny access to and from your virtual machines. Each installed vShield Zones enforces the App Zones rules. You can manage Zones Firewall rules at the datacenter, cluster, and port group levels to provide a consistent set of rules across multiple vShield Zones instances under these containers. As membership in these containers can change dynamically, Zones Firewall maintains the state of existing sessions without requiring reconfiguration of firewall rules. In this way, Zones Firewall effectively has a continuous footprint on each ESX host under the managed containers. When creating Zones Firewall rules, you create 5‐tuple firewall rules based on specific source and destination IP addresses. VMware, Inc.
Page 28: Default Rules
Zones Firewall rules are enforced in the following hierarchy: Data Center High Precedence Rules Cluster Level Rules Data Center Low Precedence Rules (seen as Rules below this level have lower precedence than cluster level rules when a datacenter resource is selected) Secure Port Group Rules Default Rules Zones Firewall offers container‐level and custom priority precedence configurations:  Container‐level precedence refers to recognizing the datacenter level as being higher in priority than the cluster level. When a rule is configured at the datacenter level, the rule is inherited by all clusters and vShield agents therein. A cluster‐level rule is only applied to the vShield Zones instances within the cluster.  Custom priority precedence refers to the option of assigning high or low precedence to rules at the datacenter level. High precedence rules work as noted in the container‐level precedence description. Low precedence rules include the Default Rules and the configuration of Data Center Low Precedence rules. This flexibility allows you to recognize multiple layers of applied precedence. At the cluster level, you configure rules that apply to all vShield Zones instances within the cluster. Because Data Center High Precedence Rules are above Cluster Level Rules, ensure your Cluster Level Rules are not in conflict with Data Center High Precedence Rules. Planning Zones Firewall Rule Enforcement Using Zones Firewall, you can configure allow and deny rules based on your network policy. The following examples represent two common firewall policies:  Allow all traffic by default. You keep the default allow all rules and add deny rules based on Flow Monitoring data or manual App Firewall configuration. In this scenario, if a session does not match any of the deny rules, the vShield App allows the traffic to pass.  Deny all traffic by default.You can change the Action status of the default rules from Allow to Deny, and add allow rules explicitly for specific systems and applications. In this scenario, if a session does not match any of the allow rules, the vShield App drops the session before it reaches its destination. If you change all of the default rules to deny any traffic, the vShield App drops all incoming and outgoing traffic. VMware, Inc.
Page 29: Create A Zones Firewall Rule
To create a firewall rule at the datacenter level In the vSphere Client, go to Inventory > Hosts and Clusters. Select a datacenter resource from the resource tree. Click the vShield Zones tab. Click Zones Firewall. By default, the L4 Rules option is selected. To create L2/L3 rules, see “Create a Layer 2/Layer 3 Zones Firewall Rule” on page 30. Do one of the following:  Click Add to add a new rule to the Data Center Low Precedence Rules (Rules below this level have lower precedence...).  Select a row in the Data Center High Precedence Rules section of the table and click Add. A new appears below the selected row. Double‐click each cell in the new row to select the appropriate information. You must type IP addresses in the Source and Destination fields, and port numbers in the Source Port and Destination Port fields. (Optional) Select the new row and click Up to move the row up in priority. (Optional) Select the Log check box to log all sessions matching this rule. Click Commit to save the rule. To create a firewall rule at the cluster level In the vSphere Client, go to Inventory > Hosts and Clusters. Select a cluster resource from the resource tree. Click the vShield Zones tab. Click Zones Firewall. By default, the L4 Rules option is selected. To create L2/L3 rules, see “Create a Layer 2/Layer 3 Zones Firewall Rule” on page 30. VMware, Inc.
Page 30: Create A Layer 2/Layer 3 Zones Firewall Rule
(Optional) Select the new row and click Up to move the row up in priority. (Optional) Select the Log check box to log all sessions matching this rule. Click Commit to save the rule. Create a Layer 2/Layer 3 Zones Firewall Rule The Layer 2/Layer 3 firewall enables configuration of allow or deny rules for common Data Link Layer and Network Layer requests, such as ICMP pings and traceroutes. You can change the default Layer 2/Layer 3 rules from allow to deny based on your network security policy. Layer 4 firewall rules allow or deny traffic based on the following criteria: Criteria Description Source (A.B.C.D/nn) IP address with netmask (nn) from which the communication originated Destination (A.B.C.D/nn) IP address with netmask (nn) which the communication is targeting Protocol Transport protocol used for communication To create a Layer 2/Layer 3 firewall rule In the vSphere Client, go to Inventory > Hosts and Clusters. Select a datacenter resource from the resource tree. Click the vShield Zones tab. Click Zones Firewall. Click L2/L3 Rules. Click Add. A new row is added at the bottom of the DataCenter Rules section of the table. VMware, Inc.
Page 31: Validating Active Sessions Against The Current Zones Firewall Rules
Open a console session on a vShield Zones instance issue the validate sessions command. vShieldZones> enable Password: vShieldZones# validate sessions Revert to a Previous Zones Firewall Configuration The vShield Manager saves a snapshot of App Firewall settings each time you commit a new rule. Clicking Commit causes the vShield Manager to save the previous configuration with a timestamp before adding the new rule. These snapshots are available from the Revert to Snapshot drop‐down menu. To revert to a previous App Firewall configuration In the vSphere Client, go to Inventory > Hosts and Clusters. Select a datacenter or cluster resource from the inventory panel. Click the vShield Zones tab. Click Zones Firewall. From the Revert to Snapshot drop‐down list, select a snapshot. Snapshots are presented in the order of timestamps, with the most recent snapshot listed at the top. View snapshot configuration details. Do one of the following:  To return to the current configuration, select the ‐ option from the Revert to Snapshot drop‐down list.  Click Commit to overwrite the current configuration with the snapshot configuration. VMware, Inc.
Page 32: Delete A Zones Firewall Rule
Administration Guide Delete a Zones Firewall Rule You can delete any App Firewall rule you have created. You cannot delete the any rules in the Default Rules section of the table. To delete an App Firewall rule Click an existing row in the Zones Firewall table. Click Delete. Click Commit. VMware, Inc.
Page 33: User Management
Managing User Rights Within the vShield Manager user interface, a user’s rights define the actions the user is allowed to perform on a given resource. Rights determine the user’s authorized activities on the given resource, ensuring that a user has access only to the functions necessary to complete applicable operations. This allows domain control over specific resources, or system‐wide control if your right encompasses the System resource. The following rules are enforced:  A user can only have one right to one resource.  A user cannot add to or remove assigned rights and resources. Table 5-1. vShield Manager User Rights Right Description Read only CRUD Read and Write Table 5-2. vShield Manager User Resources Resource Description System Access to entire vShield system Datacenter Access to a specified datacenter resource Cluster Access to a specified cluster resource None Access to no resources VMware, Inc.
Page 34: Managing The Default User Account
Assign a Role and Rights to a User After creating a user account, you can assign the user a role and rights to system resources. The role defines the resource, and the right defines the user’s access to that resource. To assign a role and right to a user Click Settings & Reports from the vShield Manager inventory panel. Click the Users tab. Double‐click the Resource cell for the user. From the drop‐down menu that opens, select an available resource. Double‐click the Access Right cell for the user. From the drop‐down menu that opens, select an available access right. Edit a User Account You can edit a user account to change the password. To edit an existing user account Click Settings & Reports from the vShield Manager inventory panel. Click the Users tab. Click a cell in the table row that identifies the user account. VMware, Inc.
Page 35: Delete A User Account
Chapter 5 User Management Click Update User. Make changes as necessary. If you are changing the password, confirm the password by typing it a second time in the Retype Password field. Click OK to save your changes. Delete a User Account You can delete any created user account. You cannot delete the admin account. Audit records for deleted users are maintained in the database and can be referenced in an Audit Log report. To delete a user account Click Settings & Reports from the vShield Manager inventory panel. Click the Users tab. Click a cell in the table row that identifies the user account. Click Delete User. VMware, Inc.
Page 36 Administration Guide VMware, Inc.
Page 37: Updating System Software
“Upload an Update” on page 37  “Review the Update History” on page 38 View the Current System Software The current versions of vShield component software display under the Update Status tab. To view the current system software Click Settings & Reports from the vShield Manager inventory panel. Click the Updates tab. Click Update Status. Upload an Update vShield updates are available as offline updates. When an update is made available, you can download the update to your PC, and then upload the update by using the vShield Manager user interface. When the update is uploaded, the vShield Manager is updated first, after which, each vShield App is updated. If a reboot of either the vShield Manager or a vShield App is required, the Update Status screen prompts you to reboot the component. In the event that both the vShield Manager and all vShield App instances must be rebooted, you must reboot the vShield Manager first, and then reboot each vShield App. To upload an update Click Settings & Reports from the vShield Manager inventory panel. Click the Updates tab. Click Upload Settings. Click Browse to locate the update. After locating the file, click Upload File. VMware, Inc.
Page 38: Review The Update History
Administration Guide Click Confirm Install to confirm update installation. There are two tables on this screen. During installation, you can view the top table for the description, start time, success state, and process state of the current update. View the bottom table for the update status of each vShield App. All vShield App instances have been upgraded when the status of the last vShield App is displayed as Finished. After the vShield Manager reboots, click the Update Status tab. Click Reboot Manager if prompted. Click Finish Install to complete the system update. 10 Click Confirm. Review the Update History The Update History tab lists the updates that have already been installed, including the installation date and a brief description of each update. To view a history of installed updates Click Settings & Reports from the vShield Manager inventory panel. Click the Updates tab. Click Update History. VMware, Inc.
Page 39: Backing Up Vshield Manager Data
Back Up Your vShield Manager Data on Demand You can back up vShield Manager data at any time by performing an on‐demand backup. To back up the vShield Manager database Click Settings & Reports from the vShield Manager inventory panel. Click the Configuration tab. Click Backups. (Optional) Select the Exclude System Events check box if you do not want to back up system event tables. (Optional) Select the Exclude Audit Logs check box if you do not want to back up audit log tables. Type the Host IP Address of the system where the backup will be saved. (Optional) Type the Host Name of the backup system. Type the User Name required to log in to the backup system. Type the Password associated with the user name for the backup system. 10 In the Backup Directory field, type the absolute path where backups are to be stored. 11 Type a text string in Filename Prefix. This text is prepended to the backup filename for easy recognition on the backup system. For example, if you type ppdb, the resulting backup is named as ppdbHH_MM_SS_DayDDMonYYYY. 12 From the Transfer Protocol drop‐down menu, select either SFTP or FTP. 13 Click Backup. Once complete, the backup appears in a table below this form. 14 Click Save Settings to save the configuration. VMware, Inc.
Page 40: Schedule A Backup Of Vshield Manager Data
10 Type the User Name required to login to the backup system. 11 Type the Password associated with the user name for the backup system. 12 In the Backup Directory field, type the absolute path where backups will be stored. 13 Type a text string in Filename Prefix. This text is prepended to each backup filename for easy recognition on the backup system. For example, if you type ppdb, the resulting backup is named as ppdbHH_MM_SS_DayDDMonYYYY. 14 From the Transfer Protocol drop‐down menu, select either SFTP or FTP, based on what the destination supports. 15 Click Save Settings. Restore a Backup To restore an available backup, the Host IP Address, User Name, Password, and Backup Directory fields in the Backups screen must have values that identify the location of the backup to be restored. When you restore a backup, the current configuration is overridden. If the backup file contains system event and audit log data, that data is also restored. Back up your current data before restoring a backup file. MPORTANT To restore an available vShield Manager backup Click Settings & Reports from the vShield Manager inventory panel. Click the Configuration tab. Click Backups. Click View Backups to view all available backups saved to the backup server. Select the check box for the backup to restore. Click Restore. Click OK to confirm. VMware, Inc.
Page 41: System Events And Audit Logs
System Events and Audit Logs System events are events that are related to vShield operation. They are raised to detail every operational event, such as a vShield App reboot or a break in communication between a vShield App and the vShield Manager. Events might relate to basic operation (Informational) or to a critical error (Critical). This chapter includes the following topics:  “View the System Event Report” on page 41  “System Event Notifications” on page 42  “Syslog Format” on page 42  “View the Audit Log” on page 43 View the System Event Report The vShield Manager aggregates system events into a report that can be filtered by vShield App and event severity. To view the System Event report Click Settings & Reports from the vShield Manager inventory panel. Click the System Events tab. (Optional) Select one or more vShield App instances from the vShield field. All vShield App instances are selected by default. From the and Severity drop‐down menu, select a severity by which to filter results. All severities are included by default. You can select one or more severities at a time. Click View Report. In the report output, click an Event Time link to view details about a specific event. VMware, Inc.
Page 42: System Event Notifications
64 page 64 Syslog Format The system event message logged in the syslog has the following structure: syslog header (timestamp + hostname + sysmgr/) Timestamp (from the service) Name/value pairs Name and value separated by delimiter '::' (double colons) Each name/value pair separated by delimiter ';;' (double semi-colons) VMware, Inc.
Page 43: View The Audit Log
Severity :: string (possible values: INFORMATION LOW MEDIUM HIGH CRITICAL) Message :: View the Audit Log The Audit Logs tab provides a view into the actions performed by all vShield Manager users. The vShield Manager retains audit log data for one year, after which time the data is discarded. To view the Audit Log Click Settings & Reports from the vShield Manager inventory panel. Click the Audit Logs tab. Narrow the output by clicking one or more of the following column filters: Column Description User Name Select the login name of a user who performed the action. Module Select the vShield resource on which the action was performed. Operation Select the type of action performed. Status Select the result of action as either Success or Failure. Operation Span Select the vShield component on which the action was performed. Local refers to the vShield Manager. VMware, Inc.
Page 44 Administration Guide VMware, Inc.
Page 45: Uninstalling Vshield Components
 “Uninstall a vShield Edge from a Port Group” on page 46  “Uninstall Port Group Isolation from an ESX Host” on page 46  “Uninstall a vShield Endpoint Module” on page 47 The vShield Quick Start Guide details installation of vShield components. Uninstall a vShield App or vShield Zones Uninstalling a vShield App or vShield Zones removes the agent from the network. Uninstalling a vShield App or vShield Zones places the ESX host in maintenance mode. After AUTION uninstallation is complete, the ESX host reboots. If any of the virtual machines that are running on the target ESX host cannot be migrated to another ESX host, these virtual machines must be powered off or migrated manually before the uninstallation can continue. If the vShield Manager is on the same ESX host, the vShield Manager must be migrated prior to uninstalling the vShield App or vShield Zones. To uninstall a vShield App or vShield Zones instance Log in to the vSphere Client. Select the ESX host from the inventory tree. Click the vShield tab. Click Uninstall for the vShield App or vShield Zones service. The instance is uninstalled. VMware, Inc.
Page 46: Uninstall A Vshield Edge From A Port Group
To uninstall a vShield Edge Log in to the vSphere Client. Go to View > Inventory > Networking. Click the Edge tab. Click Uninstall. Uninstall Port Group Isolation from an ESX Host Uninstalling Port Group Isolation requires multiple steps that must be performed in the following order. Uninstalling Port Group Isolation places the ESX host in maintenance mode. After uninstallation is AUTION complete, the ESX host reboots. If any of the virtual machines that are running on the target ESX host cannot be migrated to another ESX host, these virtual machines must be powered off or migrated manually before the uninstallation can continue. If the vShield Manager is on the same ESX host, the vShield Manager must be migrated prior to uninstalling Port Group Isolation. To uninstall Port Group Isolation Migrate all vShield Edge instances and their secured port groups off the ESX host from which Port Group Isoaltion is being uninstalled. Go to View > Inventory > Networking. Right‐click the vDS from which Port Group Isolation will be uninstalled. Select vShield > Disable Isolation. Go to View > Inventory > Hosts and Clusters. Click the ESX host from the vSphere Client inventory panel on which Port Group Isolation is installed. Click the vShield tab. Click Uninstall for to the vShield Edge Port Group Isolation service. VMware, Inc.
Page 47: Uninstall A Vshield Endpoint Module
40007=SVM with moid: <> not registered 40015=vmId is malformatted or of incorrect length : <> Uninstall the vShield Endpoint Module from the vSphere Client Uninstalling an vShield Endpoint module puts the ESX host into maintenance mode and reboots it. Migrate your vShield Manager and any other virtual machines to another ESX host to avoid AUTION shutting down these virtual machines during reboot. To uninstall an vShield Endpoint module from an ESX host Log in to the vSphere Client. Select an ESX host from the inventory tree. Click the vShield tab. Click Uninstall for to the vShield Endpoint service. Uninstallation removes port group epsec-vmk-1 and vSwitch epsec-vswitch-2. VMware, Inc.
Page 48 Administration Guide VMware, Inc.
Page 49: Vshield Edge And Port Group Isolation
Edge and Port Group Isolation VMware, Inc.
Page 50 Administration Guide VMware, Inc.
Page 51: Vshield Edge Management
“Managing the vShield Edge Firewall” on page 52  “Manage NAT Rules” on page 53  “Manage DHCP Service” on page 54  “Manage VPN Service” on page 56  “Manage Load Balancer Service” on page 58  “Start or Stop vShield Edge Services” on page 59 View the Status of a vShield Edge The Status option presents the network configuration and status of services of a vShield Edge module. Details include interface addressing and network ID. You can use the network ID to send REST API commands to a vShield Edge module. To view the status of a vShield App In the vSphere Client, go to Inventory > Networking. Select an internal port group that is protected by a vShield Edge. Click the Edge tab. Click the Status link. VMware, Inc.
Page 52: Specify A Remote Syslog Server
Create a vShield Edge Firewall Rule vShield Edge firewall rules police traffic based on the following criteria: Criteria Description Source IP IP address from which the communication originated. To enter an IP address range, use a hyphen. For example, 192.168.10.1‐192.168.10.5. Source Port Port or range of ports from which the communication originated. To enter a port range, use a hyphen. For example, 1000‐1100. Destination IP IP address which the communication is targeting. To enter an IP address range, use a hyphen. For example, 192.168.10.1‐192.168.10.5. Destination Port Port or range of ports which the communication is targeting. To enter a port range, use a hyphen. For example, 1000‐1100. Protocol Transport protocol used for communication. Direction Direction of transmission. Options are IN, OUT, or BOTH. Action Action to enforce on transmission. Options are ALLOW or DENY. The default action on all traffic is ALLOW. You can add destination and source port ranges to a rule for dynamic services such as FTP and RPC, which require multiple ports to complete a transmission. If you do not allow all of the ports that must be opened for a transmission, the transmission is blocked. To create a vShield Edge firewall rule In the vSphere Client, go to Inventory > Networking. Select an internal port group that is protected by a vShield Edge. Click the vShield Edge tab. Click the Firewall link. VMware, Inc.
Page 53: Validate Active Sessions Against Current Vshield Edge Firewall Rules
Manage NAT Rules The vShield Edge provides network address translation (NAT) service to protect the IP addresses of internal, private networks from the public network. You must configure NAT rules to provide access to services running on privately addressed virtual machines. The NAT service configuration is separated into SNAT and DNAT rules. An SNAT rule translates a private internal IP address into a public IP address for outbound traffic. A DNAT rule maps a public IP address to a private internal IP address. NAT rules adhere to the following criteria: Criteria Description Original (Internal) Source SNAT only. Internal IP address or IP address range of protected virtual machines. To IP/Range enter an IP address range, use a hyphen. For example, 192.168.10.1‐192.168.10.5. Translated (External) Source SNAT only. External IP address or IP address range used to masquerade internal IP/Range addressing of protected virtual machines. To enter an IP address range, use a hyphen. For example, 192.168.10.1‐192.168.10.5. Translated (Internal) DNAT only. Internal IP address or IP address range of protected virtual machines. Destination IP/Range and To enter an IP address range, use a hyphen. For example, 192.168.10.1‐192.168.10.5. Port/Range Original (External) DNAT only. External IP address or IP address range used to masquerade internal Destination IP/Range and addressing of protected virtual machines. To enter an IP address range, use a Port/Range hyphen. For example, 192.168.10.1‐192.168.10.5. Protocol DNAT only. Transport protocol used for communication. Select the check box to send NAT events to a configured syslog server. VMware, Inc.
Page 54: Manage Dhcp Service
To configure a DNAT rule for a vShield Edge In to the vSphere Client, go to Inventory > Networking. Select an Internal port group where a vShield Edge has been installed. Click the vShield Edge tab. Click the NAT link. Under Direction In (DNAT), click Add Rule. A new row appears in the table. Double‐click each cell in the row to enter or select the appropriate information. Click Commit to save the rule. Manage DHCP Service vShield Edge supports IP address pooling and one‐to‐one static IP address allocation. Static IP address binding is based on the vCenter managed object ID and interface ID of the requesting client. vShield Edge DHCP service adheres to the following rules:  Listens on the vShield Edge internal interface for DHCP discovery.  Uses the IP address of the internal interface on the vShield Edge as the default gateway address for all clients, and the broadcast and subnet mask values of the internal interface for the container network. To add a DHCP IP pool In the vSphere Client, go to Inventory > Networking. Select an internal port group that is protected by a vShield Edge. Click the vShield Edge tab. Click the DHCP link. Under IP Pools, click Add Pool. A new row appears in the table. Double‐click each cell in the row to enter or select the appropriate information. The Primary Name Server and Secondary Name Server fields refer to DNS service. You must enter the IP address of a DNS server for hostname‐to‐IP address resolution. The Domain Name and Lease Time fields are optional. The default lease time is one day. VMware, Inc.
Page 55 Chapter 10 vShield Edge Management Click Commit to save the rule. If DHCP service has not been enabled, enable DHCP service. See “Start or Stop vShield Edge Services” on page 59. To add a DHCP static binding In the vSphere Client, go to Inventory > Networking. Select an internal port group that is protected by a vShield Edge. Click the vShield Edge tab. Click the DHCP link. Under Static Bindings, click Add Bindings. A new row appears in the table. Double‐click each cell in the row to enter or select the appropriate information. The Primary Name Server and Secondary Name Server fields refer to DNS service. You must enter the IP address of a DNS server for hostname‐to‐IP address resolution. The Domain Name and Lease Time fields are optional. The default lease time is one day. Click Commit to save the rule. If DHCP service has not been enabled, enable DHCP service. See “Start or Stop vShield Edge Services” on page 59. VMware, Inc.
Page 56: Manage Vpn Service
Figure 10-1. vShield Edge Providing VPN Access from a Remote Site to a Secured Port Group At this time, vShield Edge supports pre‐shared key mode, IP unicast traffic, and no dynamic routing protocol between the vShield Edge and remote VPN routers. Behind each remote VPN router, you can configure multiple subnets to connect to the internal network behind a vShield Edge through IPSec tunnels. These subnets and the internal network behind a vShield Edge must have non‐overlapping address ranges. You can deploy a vShield Edge agent behind a NAT device. In this deployment, the NAT device translates the VPN address of a vShield Edge into a publicly accessible address facing the Internet. Remote VPN routers use this public address to access the vShield Edge. Remote VPN routers can be located behind a NAT device as well. You must provide both the VPN native address and the NAT public address to set up the tunnel. On both ends, static one‐to‐one NAT is required for the VPN address. To configure VPN on a vShield Edge In the vSphere Client, go to Inventory > Networking. Select an internal port group that is protected by a vShield Edge. Click the vShield Edge tab. Click the VPN link. Type an External IP Address for the VPN service on the vShield Edge. Type the NATed Public IP that represents the External IP Address to the external network. Select the Log check box to log VPN activity. Click Apply. Next, identify a peer site. VMware, Inc.
Page 57 To identify a VPN peer site In the vSphere Client, go to Inventory > Networking. Select an internal port group that is protected by a vShield Edge. Click the vShield Edge tab. Click the VPN link. Under Peer Site Configuration, click Create Site. Type a name to identify the site in Site Name. Type the IP address of the site in Remote EndPoint. Type the Shared Secret. Type an MTU threshold. 10 Click Add. Next, add a tunnel to connect to the site. To identify a VPN peer tunnel In the vSphere Client, go to Inventory > Networking. Select an internal port group that is protected by a vShield Edge. Click the vShield Edge tab. Click the VPN link. Under Peer Site Configuration, select the appropriate peer from the Select or create a site drop‐down list. Click Add Tunnel. Double‐click the Tunnel Name cell and type a name to identify the tunnel. Double‐click the Remote Site Subnet cell and enter the IP address in CIDR format (A.B.C.D/M). Double‐click the Encryption cell and select the appropriate encryption type. 10 Click Commit. 11 Enable VPN service. See “Start or Stop vShield Edge Services” on page 59. VMware, Inc.
Page 58: Manage Load Balancer Service
Figure 10-2. vShield Edge Providing Load Balancing Service for Protected Virtual Machines You map an external (or public) IP address to a set of internal servers for load balancing. The load balancer accepts HTTP requests on the external IP address and decides which internal server to use. Port 80 is the default listening port for load balancer service. To configure load balancer service In the vSphere Client, go to Inventory > Networking. Select an internal port group that is protected by a vShield Edge. Click the vShield Edge tab. Click the Load Balancer link. Click Add Configuration above the External IP Addresses table. A new row appears in the table. Enter the External IP Address for the service. Select the routing algorithm from the Algorithm drop‐down list. (Optional) Select the Log check box to send a syslog event for each request to the external IP address. Click Add. 10 Enter the IP address of the first web server and click Add. You can add additional web servers in the same manner. 11 Click Commit. 12 If load balancer service has not been enabled, enable the service. See “Start or Stop vShield Edge Services” on page 59. VMware, Inc.
Page 59: Start Or Stop Vshield Edge Services
Chapter 10 vShield Edge Management Start or Stop vShield Edge Services You can start and stop the VPN, DHCP, and load balancing services of a vShield Edge from the vSphere Client. By default, all services are stopped, or in Not Configured state. You should configure a service before starting it. To manage services on a vShield Edge In the vSphere Client, go to Inventory > Networking. Select an internal port group that is protected by a vShield Edge. Click the vShield Edge tab. Click the Status link. Under Edge Services, select a service and click Start to start the service. Select a service and click Stop to stop a running service. If a service has been started but is not responding, click Refresh Status to send a synchronization request from the vShield Manager. to the vShield Edge. VMware, Inc.
Page 60 Administration Guide VMware, Inc.
Page 61: Vshield App And Vshield Endpoint
App and vShield Endpoint VMware, Inc.
Page 62 Administration Guide VMware, Inc.
Page 63: Vshield App Management
“Send vShield App System Events to a Syslog Server” on page 63  “Back Up the Running CLI Configuration of a vShield App” on page 64  “View the Current System Status of a vShield App” on page 64 Send vShield App System Events to a Syslog Server You can send vShield App system events to a syslog server. To send vShield App system events to a syslog server Log in to the vShield Manager user interface. Select a vShield App from the inventory panel. Click the Configuration tab. Click Syslog Servers. Type the IP Address of the syslog server. From the Log Level drop‐down menu, select the event level at and above which to send vShield App events to the syslog server. For example, if you select Emergency, then only emergency‐level events are sent to the syslog server. If you select Critical, then critical‐, alert‐, and emergency‐level events are sent to the syslog server. Click Add to save new settings. You send vShield App events to up to five syslog instances. VMware, Inc.
Page 64: Back Up The Running Cli Configuration Of A Vshield App
“Force a vShield App to Synchronize with the vShield Manager” on page 64  “Restart a vShield App” on page 65  “View Traffic Statistics by vShield App Interface” on page 65  “Download the Firewall Logs of a vShield App” on page 65 Force a vShield App to Synchronize with the vShield Manager The Force Sync option forces a vShield App to re‐synchronize with the vShield Manager. This might be necessary after a software upgrade. To force a vShield App to re-synchronize with the vShield Manager Log in to the vShield Manager user interface. Select a vShield App from the inventory panel. Click the Configuration tab. Click System Status. Click Force Sync. VMware, Inc.
Page 65: Restart A Vshield App
To view traffic statistics by vShield port Log in to the vShield Manager user interface. Select a vShield App from the inventory panel. Click the Configuration tab. Click System Status. Click an interface under the Port column to view traffic statistics. For example, to view the traffic statistics for the vShield App management interface, click mgmt. Download the Firewall Logs of a vShield App You can download a log of the firewall activity from a vShield App. The firewall log details the results of the firewall operation based on matching firewall rules against traffic. To download and view the firewall log for a vShield App Log in to the vShield Manager user interface. Select a vShield App from the inventory panel. Click the Configuration tab. Click System Status. Under App Firewall, click Show Logs. The vShield App uploads the log to the vShield Manager. To download the log from the vShield Manager to your PC, click Download App Firewall Logs. VMware, Inc.
Page 66 Administration Guide VMware, Inc.
Page 67: Flow Monitoring
Session details can be used to create App Firewall allow or deny rules. You can use Flow Monitoring as a forensic tool to detect rogue services and examine outbound sessions. This chapter includes the following topics:  “Using Flow Monitoring” on page 67  “View a Specific Application in the Flow Monitoring Charts” on page 68  “Change the Date Range of the Flow Monitoring Charts” on page 68  “View the Flow Monitoring Report” on page 68  “Add an App Firewall Rule from the Flow Monitoring Report” on page 69  “Editing Port Mappings” on page 70 Using Flow Monitoring The Flow Monitoring tab displays throughput statistics as returned by a vShield App. Flow Monitoring displays traffic statistics in three charts:  Sessions/hr: Total number of sessions per hour  Server KBytes/hr: Number of outgoing kilobytes per hour  Client/hr: Number of incoming kilobytes per hour Flow Monitoring organizes statistics by the application protocols used in client‐server communications, with each color in a chart representing a different application protocol. This charting method enables you to track your server resources per application. Traffic statistics display all inspected sessions within the time span specified. The last seven days of data are displayed by default. VMware, Inc.
Page 68: View A Specific Application In The Flow Monitoring Charts
To change the date range of the Flow Monitoring chart In the vSphere Client, go to Inventory > Hosts and Clusters. Select a datacenter or cluster resource from the resource tree. Click the vShield App tab. Click Flow Monitoring. The charts are updated to display the most current information for the last seven days. This might take several seconds. In the Start Date field, type a new date. This date represents the date furthest in the past on which to start the query. Type a new date in the End Date field. This represents the most recent date on which to stop the query. Click Update Chart. View the Flow Monitoring Report The Flow Monitoring report presents the traffic statistics in tabular format. The report supports drilling down into traffic statistics based on the following hierarchy: Select the firewall action: Allowed or Blocked. Select an L4 or L2/L3 protocol.  L4: TCP or UDP  L2/L3: ICMP, Other‐IPv4, or ARP If an L2/L3 protocol was selected, select an L2/L3 protocol or message type. Select the traffic direction: Incoming, Outgoing, or Intra (between virtual machines). Select the port type: Categorized (standardized ports) or Uncategorized (non‐standardized ports). Select an application protocol or port. VMware, Inc.
Page 69: Add An App Firewall Rule From The Flow Monitoring Report
Add an App Firewall Rule from the Flow Monitoring Report By drilling down into the traffic data, you can evaluate the use of your resources and send session information to App Firewall to create a new Layer 4 allow or deny rule. App Firewall rule creation from Flow Monitoring data is available at the datacenter and cluster levels only. To add an App Firewall rule from the Flow Monitoring report In the vSphere Client, go to Inventory > Hosts and Clusters. Select a datacenter resource from the resource tree. Click the vShield App tab. Click Flow Monitoring. The charts update to display the most current information for the last seven days. This might take several seconds. Click Show Report. Expand the firewall action list. Expand the Layer 4 protocol list. Expand the traffic direction list. Expand the port type list. 10 Expand the application or port list. 11 Expand the destination IP address list. 12 Review the source IP addresses. 13 Select the Zones Firewall column radio button for a source IP address to create an App Firewall rule. A pop‐up window opens. Click Ok to proceed. The App Firewall table appears. A new table row is displayed at the bottom of the Data Center Low Precedence Rules or Cluster Level Rules section with the session information completed. VMware, Inc.
Page 70: Delete All Recorded Flows
Select a datacenter resource from the inventory panel. Click the Flow Monitoring tab. Click Delete All Flows. Click Ok in the pop‐up window to confirm deletion. You cannot recover traffic data after you click Delete All Flows. AUTION Editing Port Mappings When you click Edit Port Mappings, a table appears, listing well‐known applications and protocols, their respective ports, and a description. vShield recognizes common protocol and port mappings, such as HTTP over port 80. Your organization might employ an application or protocol that uses a non‐standard port. In this case, you can use Edit Port Mappings to identify a custom protocol‐port pair. Your custom mapping appears in the Flow Monitoring report output. The Edit Port Mappings table offers complete management capabilities, and provides a model for you to follow. You cannot edit or delete the default entries. Add an Application-Port Pair Mapping You can add a custom application‐port mapping to the port mappings table. To add an application port-pair mapping Go to Inventory > Networking in the vSphere Client. Select a port group from the inventory panel. Click the Flow Monitoring tab. Click Edit Port Mappings. Click a row in the table. Click Add. A new row is inserted above the selected row. Double‐click the Application cell and type the application name. Double‐click the Port Number cell and type the port number. Double‐click the Protocol cell to select the transport protocol. VMware, Inc.
Page 71: Delete An Application-Port Pair Mapping
Chapter 12 Flow Monitoring 10 Double‐click the Resource cell to select the container in which to enforce the new mapping. The ANY value adds the port mapping to all containers. 11 Double‐click the Description cell and type a brief description. 12 Click Hide Port Mappings. Delete an Application-Port Pair Mapping You can delete any application‐port pair mapping from the table. When you delete a mapping, any traffic to the application‐port pair is listed as Uncategorized in the Flow Monitoring statistics. To delete an application-port pair mapping Go to Inventory > Networking in the vSphere Client. Select a port group from the inventory panel. Click the Flow Monitoring tab. Click Edit Port Mappings. Click a row in the table. Click Delete to delete it from the table. Hide the Port Mappings Table When you click Edit Port Mappings, the label changes from Edit Port Mappings to Hide Port Mappings. Click Hide Port Mappings. VMware, Inc.
Page 72 Administration Guide VMware, Inc.
Page 73: App Firewall Management
“Creating and Protecting Security Groups” on page 77  “Validating Active Sessions against the Current App Firewall Rules” on page 78  “Revert to a Previous App Firewall Configuration” on page 79  “Delete an App Firewall Rule” on page 79 Using App Firewall The App Firewall service is a centralized, hierarchical firewall for ESX hosts. App Firewall enables you to create rules that allow or deny access to and from your virtual machines. Each installed vShield App enforces the App Firewall rules. You can manage App Firewall rules at the datacenter, cluster, and port group levels to provide a consistent set of rules across multiple vShield App instances under these containers. As membership in these containers can change dynamically, App Firewall maintains the state of existing sessions without requiring reconfiguration of firewall rules. In this way, App Firewall effectively has a continuous footprint on each ESX host under the managed containers. Securing Containers and Designing Security Groups When creating App Firewall rules, you can create rules based on traffic to or from a specific container that encompasses all of the resources within that container. For example, you can create a rule to deny any traffic from inside of a cluster that targets a specific destination outside of the cluster. You can create a rule to deny any incoming traffic that is not tagged with a VLAN ID. When you specify a container as the source or destination, all IP addresses within that container are included in the rule. A security group is a trust zone that you create and assign resources to for App Firewall protection. Security groups are containers, like a vApp or a cluster. Security groups enables you to create a container by assigning resources arbitrarily, such as virtual machines and network adapters. After the security group is defined, you add the group as a container in the source or destination field of an App Firewall rule. See “Creating and Protecting Security Groups” on page 77. VMware, Inc.
Page 74: Default Rules
The first rule in the table that matches the traffic parameters is enforced. The rules are enforced in the following hierarchy: Data Center High Precedence Rules Cluster Level Rules Data Center Low Precedence Rules (seen as Rules below this level have lower precedence than cluster level rules when a datacenter resource is selected) Secure Port Group Rules Default Rules App Firewall offers container‐level and custom priority precedence configurations:  Container‐level precedence refers to recognizing the datacenter level as being higher in priority than the cluster level. When a rule is configured at the datacenter level, the rule is inherited by all clusters and vShield agents therein. A cluster‐level rule is only applied to the vShield App within the cluster.  Custom priority precedence refers to the option of assigning high or low precedence to rules at the datacenter level. High precedence rules work as noted in the container‐level precedence description. Low precedence rules include the Default Rules and the configuration of Data Center Low Precedence rules. This flexibility allows you to recognize multiple layers of applied precedence. At the cluster level, you configure rules that apply to all vShield App instances within the cluster. Because Data Center High Precedence Rules are above Cluster Level Rules, ensure your Cluster Level Rules are not in conflict with Data Center High Precedence Rules. Planning App Firewall Rule Enforcement Using App Firewall, you can configure allow and deny rules based on your network policy. The following examples represent two common firewall policies:  Allow all traffic by default. You keep the default allow all rules and add deny rules based on Flow Monitoring data or manual App Firewall rule configuration. In this scenario, if a session does not match any of the deny rules, the vShield App allows the traffic to pass.  Deny all traffic by default.You can change the Action status of the default rules from Allow to Deny, and add allow rules explicitly for specific systems and applications. In this scenario, if a session does not match any of the allow rules, the vShield App drops the session before it reaches its destination. If you change all of the default rules to deny any traffic, the vShield App drops all incoming and outgoing traffic. VMware, Inc.
Page 75: Create An App Firewall Rule
Protocol Transport protocol used for communication. You can add destination and source port ranges to a rule for dynamic services such as FTP and RPC, which require multiple ports to complete a transmission. If you do not allow all of the ports that must be opened for a transmission, the transmission fails. To create a firewall rule at the datacenter level In the vSphere Client, go to Inventory > Hosts and Clusters. Select a datacenter resource from the resource tree. Click the vShield App tab. Click App Firewall. By default, the L4 Rules option is selected. To create L2/L3 rules, see “Create a Layer 2/Layer 3 App Firewall Rule” on page 77. Do one of the following:  Click Add to add a new rule to the Data Center Low Precedence Rules (Rules below this level have lower precedence...).  Select a row in the Data Center High Precedence Rules section of the table and click Add. A new appears below the selected row. Double‐click each cell in the new row to select the appropriate information. You can type IP addresses in the Source and Destination fields, and port numbers in the Source Port and Destination Port fields. (Optional) Select the new row and click Up to move the rule up in priority. (Optional) Select the Log check box to log all sessions matching this rule. Click Commit to save the rule. Layer 4 firewall rules can also be created from the Flow Monitoring report. See “Add an App Firewall Rule from the Flow Monitoring Report” on page 69. VMware, Inc.
Page 76 To create L2/L3 rules, see “Create a Layer 2/Layer 3 App Firewall Rule” on page 77. Click Add. A new row appears in the Cluster Level Rules section of the table. Double‐click each cell in the new row to select the appropriate information. You can type IP addresses in the Source and Destination fields, and port numbers in the Source Port and Destination Port fields. (Optional) Select the new row and click Up to move the row up in priority. (Optional) Select the Log check box to log all sessions matching this rule. Click Commit to save the rule. Layer 4 firewall rules can also be created from the Flow Monitoring report. See “Add an App Firewall Rule from the Flow Monitoring Report” on page 69. To create a firewall rule at the port group level In the vSphere Client, go to Inventory > Networking. Select a port group from the resource tree. Click the vShield App tab. Click App Firewall. Click Add. A new row is added at the bottom of the Secure Port Group Rules section. Double‐click each cell in the new row to select the appropriate information. You can type IP addresses in the Source and Destination fields, and port numbers in the Source Port and Destination Port fields. (Optional) Select the new row and click Up to move the row up in priority. (Optional) Select the Log check box to log all sessions matching this rule. Click Commit to save the rule. Layer 4 firewall rules can also be created from the Flow Monitoring report. See “Add an App Firewall Rule from the Flow Monitoring Report” on page 69. VMware, Inc.
Page 77: Create A Layer 2/Layer 3 App Firewall Rule
Click App Firewall. Click L2/L3 Rules. Click Add. A new row is added at the bottom of the DataCenter Rules section of the table. Double‐click each cell in the new row to type or select the appropriate information. You can type IP addresses in the Source and Destination fields (Optional) Select the Log check box to log all sessions matching this rule. Click Commit. Layer 2/Layer 3 firewall rules can also be created from the Flow Monitoring report. See “Add an App Firewall Rule from the Flow Monitoring Report” on page 69. Creating and Protecting Security Groups The Security Groups feature enables you to create custom containers to which you can assign resources, such as virtual machines and network adapters, for App Firewall protection. After a security group is defined, you add the security group to a firewall rule for protection. Add a Security Group In the vSphere Client, you can add a security group at the datacenter resource level. To add a security group by using the vSphere Client Click a datacenter resource from the vSphere Client. Click the vShield App tab. Click Security Groups. Click Add Group. VMware, Inc.
Page 78: Assign Resources To A Security Group
Validating Active Sessions against the Current App Firewall Rules By default, a vShield Edge matches firewall rules against each new session. After a session has been established, any firewall rule changes do not affect active sessions. The CLI command validate sessions enables you to validate active sessions that are in violation of the current rule set. You would use this procedure for the following scenarios:  You updated the firewall rule set. After a firewall rule set update, you should validate active sessions to purge any existing sessions that are in violation of the updated policy.  You viewed sessions in Flow Monitoring and determined that an existing or historical flow requires a new access rule. After creating a firewall rule that matches the offending session, you should validate active sessions to purge any existing sessions that are in violation of the updated policy. After the App Firewall update is complete, issue the validate sessions command from the CLI of a vShield App to purge sessions that are in violation of current policy. To validate active sessions against the current firewall rules Update and commit the App Firewall rule set at the appropriate container level. Open a console session on a vShield App issue the validate sessions command. vShieldApp> enable Password: vShieldApp# validate sessions VMware, Inc.
Page 79: Revert To A Previous App Firewall Configuration
Commit causes the vShield Manager to save the previous configuration with a timestamp before adding the new rule. These snapshots are available from the Revert to Snapshot drop‐down list. To revert to a previous App Firewall configuration In the vSphere Client, go to Inventory > Hosts and Clusters. Select a datacenter or cluster resource from the inventory panel. Click the vShield App tab. Click App Firewall. From the Revert to Snapshot drop‐down list, select a snapshot. Snapshots are presented in the order of timestamps, with the most recent snapshot listed at the top. View snapshot configuration details. Do one of the following:  To return to the current configuration, select the ‐ option from the Revert to Snapshot drop‐down list.  Click Commit to overwrite the current configuration with the snapshot configuration. Delete an App Firewall Rule You can delete any App Firewall rule you have created. You cannot delete the any rules in the Default Rules section of the table. To delete an App Firewall rule Click an existing row in the App Firewall table. Click Delete. Click Commit. VMware, Inc.
Page 80 Administration Guide VMware, Inc.
Page 81: Vshield Endpoint Events And Alarms
All virtual machines (with supported operating systems) that reside on a vShield Endpoint‐protected ESX host must be protected by a vShield Endpoint module. Not all ESX hosts in a vCenter Server must be protected by the security solution, but each protected ESX  must have an SVM installed on it. vMotion migration of a protected virtual machine are blocked if the target ESX is not enabled AUTION for vShield Endpoint. Make sure that the resource pool for vMotion of protected virtual machines contains only security enabled ESX hosts. This chapter includes the following topics:  “View vShield Endpoint Status” on page 81  “Alarms” on page 82  “Events” on page 83  “Audit Messages” on page 86 View vShield Endpoint Status Monitoring a vShield Endpoint instance involves checking for status coming from the vShield Endpoint components: the security virtual machine (SVM), the ESX host‐resident vShield Endpoint module, and the protected virtual machine‐resident thin agent. To view vShield Endpoint status In the vSphere Client, go to Inventory > Hosts and Clusters. Select a datacenter, cluster, or ESX host resource from the resource tree. Click the vShield App tab (or vShield tab on ESX hosts). Click Endpoint Status. VMware, Inc.
Page 82: Alarms
The ESX host has no virtual machines yet, or only virtual are currently protected. machines with non‐supported operating systems. No action required.  Check the vShield Manager console for the status of the virtual machines that should be protected on that host. If one or more have an error status, the Endpoint thin agents in those machines may be malfunctioning. Table 14-2. Errors (Marked Red) Possible Cause Action The SVM version is not compatible with the Install compatible components. Look in the vShield Endpoint vShield Endpoint module version. Installation Guide for compatible versions for vShield Endpoint module and SVM. SVM Alarms SVM alarms are generated by events affecting the health status of the vShield Endpoint module. Table 14-3. Red SVM Alarms Problem Action The vShield Monitor is not receiving status from Either there are network issues between the vShield Monitor and the the SVM. SVM, or the SVM is not operating properly. The SVM failed to initialize Contact your security provider for help with SVM errors. VMware, Inc.
Page 83: Vm Alarms
Table 14-6. vShield Endpoint Events Event Code Name Arguments Category Description 0001 VSM_FSFD_EVENT_VERSION_MISMATCH timestamp, error vShield Endpoint: The SVM was SVM version contacted by a non‐compatible version of FSFD of the vShield Endpoint Thin Agent. protocol, FSFD version of FSFD protocol 0003 VSM_FSFD_EVENT_DISK_FULL timestamp warning The vShield Endpoint Thin Agent encountered a ʺdisk fullʺ error while attempting to write to the local disk. 0004 VSM_FSFD_EVENT_TIMEOUT timestamp warning A timeout occurred in the communication between the SVM and the Thin Agent. VMware, Inc.
Page 84 LKM protocol 3002 VSM_HOST_EVENT_UNKNOWN_STATE timestamp warning vShield Endpoint Module Status Information has been lost. 3003 VSM_HOST_EVENT_SVM_REGISTERED timestamp info SVM is registered with the vShield Manager. 3004 VSM_HOST_EVENT_SVM_UNREGISTERED timestamp info SVM is unregistered with the vShield Manager. timestamp, info vShield Endpoint module has 3005 VSM_HOST_EVENT_VMS_CONNECTED Host version connected with SVM. of vShield Endpoint module protocol 3006 VSM_HOST_EVENT_VMS_DISCONNECTED timestamp info vShield Endpoint module has disconnected from the SVM VMware, Inc.
Page 85 VM_POWERED_OFF 2000 VSM_SVM_EVENT_ENABLED 2001 VSM_SVM_EVENT_INIT_FAILURE vShield Endpoint SVM component failed to initialize. Please consult partner SVM installation documentation for causes. 2003 VSM_SVM_EVENT_FSFD_FLOOD_DETECTED The SVM is overloaded. The number of events exceeds the maximum concurrent events threshold. Heavy load of event reporting on the SVM, or communication problem 2005 VSM_SVM_EVENT_DROPPED_EVENTS between the SVM and the vShield Manager. 2006 VSM_SVM_EVENT_MISSING_REPORT Check SVM status. Check network connection between vShield Manager and SVM. 2007 VSM_SVM_EVENT_REPORT_RESTORED 3000 VSM_HOST_EVENT_VERSION_MISMATCH Compatible versions of the vShield Endpoint modules must be used. Please refer to the vShield Endpoint Installation guide for a compatibility list. Heavy load of event reporting on the SVM, or communication problem 3002 VSM_HOST_EVENT_UNKNOWN_STATE between the SVM and the vShield Manager. 3003 VSM_HOST_EVENT_SVM_REGISTERED 3004 VSM_HOST_EVENT_SVM_UNREGISTERED 3005 VSM_HOST_EVENT_VMS_CONNECTED 3006 VSM_HOST_EVENT_VMS_DISCONNECTED VMware, Inc.
Page 86: Audit Messages
Administration Guide Audit Messages Audit messages include fatal errors and other important audit messages and are logged to vmware.log. The following conditions are logged as AUDIT messages:  Thin agent initialization success (and version number.)  Thin agent initialization failure.  Successfully found SCSI device to communicate with the security virtual machine (SVM).  Failure to create filter device object, or failure to attach to device stack.  Established first time communication with SVM.  Failure to establish communication with SVM (when first such failure occurs). Generated log messages have the following substrings near the beginning of each log message: “vf-AUDIT”, “vf-ERROR”, “vf-WARN”, “vf-INFO”, “vf-DEBUG”. VMware, Inc.
Page 87: Appendixes
Appendixes VMware, Inc.
Page 88 Administration Guide VMware, Inc.
Page 89: Command Line Interface
“Moving Around in the CLI” on page 90  “Getting Help within the CLI” on page 91  “Securing CLI User Accounts and the Privileged Mode Password” on page 91  “Command Reference” on page 93 Logging In and Out of the CLI Before you can run CLI commands, you must initiate a console session to a vShield virtual machine. To open a console session within the vSphere Client, select the vShield virtual machine from the inventory panel and click the Console tab. You can log in to the CLI by using the default user name admin and password default. You can also use SSH to access the CLI. By default, SSH access is disabled. Use the ssh command to enable and disable the SSH service on a vShield virtual appliance. See “ssh” on page 102. To log out, type exit from either Basic or Privileged mode. CLI Command Modes The commands available to you at any given time depend on the mode you are currently in. vShield Edge virtual machines have Basic mode only.  Basic: Basic mode is a read‐only mode. To have access to all commands, you must enter Privileged mode.  Privileged: Privileged mode commands allow support‐level options such as debugging and system diagnostics. Privileged mode configurations are not saved upon reboot. You must run the write memory command to save Privileged mode configurations. VMware, Inc.
Page 90: Cli Syntax
Moves the pointer to beginning of the line. CTRL+B or Moves the pointer back one character. the left arrow key CTRL+C Ends any operation that continues to propagate, such as a ping. CTRL+D Deletes the character at the pointer. CTRL+E Moves the pointer to end of the line. CTRL+F or Moves the pointer forward one character. the right arrow key CTRL+K Deletes all characters from the pointer to the end of the line. CTRL+N or Displays more recent commands in the history buffer after recalling commands the down arrow key with CTRL+P (or the up arrow key). Repeat to recall other recently run commands. CTRL+P or Recalls commands in the history, starting with the most recent completed command. Repeat to recall successively older commands. the up arrow key CTRL+U Deletes all characters from the pointer to beginning of the line. CTRL+W Deletes the word to the left of pointer. ENTER Scrolls down one line. ESC+B Moves the pointer back one word. ESC+D Deletes all characters from the pointer to the end of the word. ESC+F Moves the pointer forward one word. SPACE Scrolls down one screen. VMware, Inc.
Page 91: Getting Help Within The Cli
You cannot change the password for any CLI user account on a vShield Manager or vShield App virtual machine. If you need to change a CLI user account password, you must delete the user account, and then re‐add it with a new password. You can change the password of any non‐admin account on the vShield Edge. The CLI admin account password and the Privileged mode password are managed separately. The default Privileged mode password is the same for each CLI user account. You should change the Privileged mode password to secure access to the CLI configuration options. Each vShield virtual machine has two built‐in CLI user accounts for system use: nobody and MPORTANT vs_comm. Do not delete or modify these accounts. If these accounts are deleted or modified, the virtual machine will not work. Add a CLI User Account You can add a user account with a strong password to secure CLI access to each vShield virtual machine. After adding a user account, you should delete the admin user account. To add a CLI user account Log in to the vSphere Client. Select a vShield virtual machine from the inventory. Click the Console tab to open a CLI session. Log in by using the admin account. manager login: admin password: manager> Switch to Privileged mode. manager> enable password: manager# VMware, Inc.
Page 92: Delete The Admin User Account From The Cli
Click the Console tab to open a CLI session. Log in by using a user account other than admin. Switch to Privileged mode. Switch to Configuration mode. Delete the admin user account. manager(config)# no user admin Save the configuration. Run the exit command twice to log out of the CLI. Change the CLI Privileged Mode Password You can change the Privileged mode password to secure access to the configuration options of the CLI. To change the Privileged mode password Log in to the vSphere Client. Select a vShield virtual machine from the inventory. Click the Console tab to open a CLI session. Log in to the CLI. Switch to Privileged mode. Switch to Configuration mode. Change the Privileged mode password. manager(config)# enable password (hash | plaintext) password VMware, Inc.
Page 93: Command Reference
Administrative Commands list Lists all in‐mode commands. Syntax list CLI Mode Basic, Privileged, Configuration, Interface Configuration Example vShieldMgr> list enable exit list ping WORD quit show interface show ip route ssh WORD telnet WORD telnet WORD PORT traceroute WORD reboot Reboots a vShield virtual machine. You can also reboot a vShield App from the vShield Manager user interface. See “Restart a vShield App” on page 65. Syntax reboot VMware, Inc.
Page 94: Shutdown
Example vShield# shutdown vShield(config)# interface mgmt vShield(config-if)# shutdown vShield(config-if)# no shutdown Related Commands reboot CLI Mode Commands configure terminal Switches to Configuration mode from Privileged mode. Syntax configure terminal CLI Mode Privileged Example vShield# configure terminal vShield(config)# Related Commands interface disable Switches to Basic mode from Privileged mode. Syntax disable VMware, Inc.
Page 95: Enable
Related Commands enable enable Switches to Privileged mode from Basic mode. Syntax enable CLI Mode Basic Example vShield> enable password: vShield# Related Commands disable Ends the current CLI mode and switches to the previous mode. Syntax CLI Mode Basic, Privileged, Configuration, and Interface Configuration Example vShield# end vShield> Related Commands exit quit exit Exits from the current mode and switches to the previous mode, or exits the CLI session if run from Privileged or Basic mode. Syntax exit CLI Mode Basic, Privileged, Configuration, and Interface Configuration VMware, Inc.
Page 96: Interface
The management port on a vShield virtual machine. vShield App p0 interface. vShield App u0 interface. CLI Mode Configuration Example vShield# configure terminal vShield(config)# interface mgmt vShield(config-if)# vShield(config)# no interface mgmt Related Commands show interface quit Quits Interface Configuration mode and switches to Configuration mode, or quits the CLI session if run from Privileged or Basic mode. Syntax quit CLI Mode Basic, Privileged, and Interface Configuration Example vShield(config-if)# quit vShield(config)# Related Commands exit VMware, Inc.
Page 97: Configuration Commands
Enable or disable access to the CLI via SSH session. Syntax [no] cli ssh allow CLI Mode Configuration Usage Guidelines Use this command with the ssh command to allow or disallow CLI access via SSH. Example manager(config)# ssh start manager(config)# cli ssh allow Related Commands copy running-config startup-config Copies the current system configuration to the startup configuration. You can also copy and save the running CLI configuration of a vShield App from the vShield Manager user interface. See “Back Up the Running CLI Configuration of a vShield App” on page 64. Syntax copy running-config startup-config CLI Mode Privileged VMware, Inc.
Page 98: Database Erase
Changes the Privileged mode password. You should change the Privileged mode password for each vShield virtual machine. CLI user passwords and the Privileged mode password are managed separately. The Privileged mode password is the same for each CLI user account. Syntax enable password (hash | plaintext) password Option Description hash Masks the password by using the MD5 hash. You can view and copy the provided MD5 hash by running the show running-config command. plaintext Keeps the password unmasked. password Password to use. The default password is default. CLI Mode Configuration Example vShield# configure terminal vShield(config)# enable password plaintext abcd123 Related Commands enable VMware, Inc.
Page 99: Hostname
[no] ip address Option Description A.B.C.D IP address to use. Subnet mask to use. CLI Mode Interface Configuration Example vShield(config)# interface mgmt vShield(config-if)# ip address 192.168.110.200/24 vShield(config)# interface mgmt vShield(config-if)# no ip address 192.168.110.200/24 Related Commands show interface ip name server Identifies a DNS server to provide address resolution service. You can also identify one or more DNS servers by using the vShield Manager user interface. See “Identify DNS Services” on page 22. To remove a DNS server, use no before the command. VMware, Inc.
Page 100: Ip Route
Subnet mask to use. W.X.Y.Z IP address of network gateway. CLI Mode Configuration Example vShield# configure terminal vShield(config)# ip route 0.0.0.0/0 192.168.1.1 vShield(config)# no ip route 0.0.0.0/0 192.168.1.1 Related Commands show ip route manager key Sets a shared key for authenticating communication between a vShield App and the vShield Manager. You can set a shared key on any vShield App. This key must be entered during vShield App installation. If the shared key between a vShield App and the vShield Manager is not identical, the service cannot install and is inoperable. Syntax manager key Option Description The key that the vShield App and vShield Manager must match. VMware, Inc.
Page 101: Ntp Server
Hostname of the NTP server. A.B.C.D IP address of NTP server. CLI Mode Configuration Usage Guidelines vShield App CLI Example vShield# configure terminal vShield(config)# ntp server 10.1.1.113 vShield# configure terminal vShield(config)# no ntp server Related Commands show ntp set clock Sets the date and time. From the vShield Manager user interface, you can connect to an NTP server for time synchronization. All vShield App instances use the NTP server configuration of the vShield Manager. You should use this command if you meet one of the following conditions.  You cannot connect to an NTP server.  You frequently power off and power on a vShield App, such as in a lab environment. A vShield App can become out of sync with the vShield Manager when it is frequently power on and off. VMware, Inc.
Page 102: Setup
Default gateway (A.B.C.D): 192.168.0.1 Old configuration will be lost, and system needs to be rebooted Do you want to save new configuration (y/[n]): y Please log out and log back in again. manager> Starts or stops the SSH service on a vShield virtual appliance. Syntax ssh (start | stop) VMware, Inc.
Page 103: Syslog
63. To disable syslog export, use no before the command. Syntax hostname A.B.C.D [no] syslog ( Option Description hostname Hostname of the syslog server. A.B.C.D IP address of syslog server. CLI Mode Configuration Example vShield(config)# syslog 192.168.1.2 Related Commands show syslog write Writes the running configuration to memory. This command performs the same operation as the write memory command. Syntax write CLI Mode Privileged Example manager# write VMware, Inc.
Page 104: Write Erase
Related Commands write Debug Commands debug copy Copies one or all packet trace or tcpdump files and exports them to a remote server. You must enable the debug packet capture command before you can copy and export files. Syntax debug copy (scp|ftp) (packet-traces | tcpdumps) ( filename | all) Option Description Use SCP as transport protocol. Use FTP as transport protocol. Add a URL in the format userid@<ip_address>:<directory>. For example: admin@10.10.1.10:/tmp packet-traces Copy and export packet traces. tcpdumps Copy and export system tcpdumps. filename Identify a specific packet trace or tcpdump file to export. Copy and export all packet trace or tcpdump files. CLI Mode Privileged VMware, Inc.
Page 105: Debug Packet Capture
(mgmt | u0 | p0) The specific interface from which to capture packets. Interface p1, u1, p2, u2, p3, and u3 have been deprecated. expression A tcpdump‐formatted string. You must use an underscore between words in the expression. CLI Mode Privileged Usage Guidelines vShield App CLI Example vShield# debug packet capture segment 0 host_10.10.11.11_port_8 Related Commands debug copy debug packet display interface debug packet display interface Displays all packets captured by a vShield App or vShield Edge interface, similar to a tcpdump. Enabling this command can impact vShield App or vShield Edge performance. To disable the display of packets, use no before the command. VMware, Inc.
Page 106: Debug Remove
Related Commands debug copy debug packet capture debug remove Removes one or all packet trace or tcpdump files from a vShield App. Syntax filename debug remove (packet-traces|tcpdumps) ( |all) Option Description packet-traces Remove one or all packet trace files. tcpdumps Remove one or all tcpdump files. filename Identify a specific packet trace or tcpdump file to export. Remove all packet trace or tcpdump files. CLI Mode Privileged Usage Guidelines vShield App CLI Example vShield# debug remove tcpdumps all VMware, Inc.
Page 107: Debug Service
Usage Guidelines vShield App CLI Example vShield# debug 2050001_SAFLOW-FTPD-Dynamic-Port-Detection sysmgr high Related Commands show services debug service flow src Debugs messages for a service that is processing traffic between a specific source‐to‐destination pair. You can run the show services command to view the list of running services. To disable logging, use no before the command. Syntax [no] debug service flow src A.B.C.D W.X.Y.Z Option Description service The name of the service. A.B.C.D Source IP address to use. Source subnet mask to use. Source port to use. W.X.Y.Z Destination IP address of use. VMware, Inc.
Page 108: Debug Show Files
Example vShield_Zones_host_49_269700# debug show files total 0 -rw-r--r-- 1 0 Jun 23 16:04 tcpdump.d0.0 Related Commands debug copy debug remove Show Commands show alerts Shows system alerts as they relate to the protocol decoders or network events. If no alerts have been raised, no output is returned. Syntax show alerts (vulnerability|decoder|events) Option Description vulnerability Deprecated. decoder Alerts raised by protocol decoder errors. events Alerts raised by network events. VMware, Inc.
Page 109: Show Arp
Wed Feb 9 13:04:50 UTC 2005 Related Commands ntp server set clock show configuration Shows either the current global configuration or the configuration for a specified service on a vShield Edge. Syntax show configuration (dhcp | firewall | ipsec | lb | nat | syslog | system) Option Description dhcp Show the current DHCP configuration. firewall Show the current firewall configuration. VMware, Inc.
Page 110: Show Debug
Show the debug processes that are enabled. You must enable a debug path by running the debug packet or one of the debug service commands. Syntax show debug CLI Mode Basic, Privileged Usage Guidelines vShield App CLI Example vShield# show debug No debug logs enabled Related Commands debug service debug service flow src show ethernet Shows Ethernet information for virtual machine interfaces. Syntax show ethernet CLI Mode Basic, Privileged VMware, Inc.
Page 111: Show Filesystem
Proxy Id = 1, Service Name = proxy-zombie, Num Threads = 0 ACTION=FORWARD Proxy Id = 2, Service Name = vproxy-forward-allow, Num Threads = 0 ACTION=VPROXY Proxy Id = 3, Service Name = vproxy-reverse-allow, Num Threads = 0 ACTION=UNKNOWN VMware, Inc.
Page 112: Show Hardware
Intel Corporation 82371AB/EB/MB PIIX4 ISA +-07.1 Intel Corporation 82371AB/EB/MB PIIX4 IDE +-07.3 Intel Corporation 82371AB/EB/MB PIIX4 ACPI +-07.7 VMware Inc Virtual Machine Communication Interface +-0f.0 VMware Inc Abstract SVGA II Adapter +-10.0 BusLogic BT-946C (BA80C30) [MultiMaster 10] +-11.0-[0000:02]----00.0 Intel Corporation 82545EM Gigabit Etherne t Controller (Copper) +-15.0-[0000:03]--...
Page 113: Show Ip Addr
Codes: K - kernel route, C - connected, S - static, > - selected route, * - FIB route S>* 0.0.0.0/0 [1/0] via 192.168.110.1, mgmt C>* 192.168.110.0/24 is directly connected, mgmt Related Commands ip route show iptables Shows the IP routing table. VMware, Inc.
Page 114: Show Kernel Message
Related Commands show kernel message last show kernel message last Shows last n kernel messages for a vShield Edge. Syntax show kernel message last CLI Mode Basic, Privileged Usage Guidelines vShield Edge CLI Example vshieldEdge# show kernel message last 20 Related Commands show kernel message VMware, Inc.
Page 115: Show Log
Shows the log of firewall rule alerts. Syntax show log alerts CLI Mode Basic, Privileged Usage Guidelines vShield App CLI Example vShield# show log alerts Related Commands show log show log events Shows the log of vShield App system events. Syntax show log events VMware, Inc.
Page 116: Show Log Last
Shows the system log of the vShield Manager. Syntax show manager log [follow | reverse] Option Description follow Update the displayed log every 5 seconds. Show the log in reverse chronological order. reverse CLI Mode Basic, Privileged Usage Guidelines vShield Manager CLI Example vShield# show manager log SEM Debug Nov 15, 2005 02:46:23 PM PropertyUtils Prefix:applicationDir VMware, Inc.
Page 117: Show Manager Log Last
Usage Guidelines vShield Manager CLI Example manager# show manager log last 10 Related Commands show manager log show ntp Shows the IP address of the network time protocol (NTP) server. You set the NTP server IP address by using the vShield Manager user interface. Syntax show ntp CLI Mode Basic, Privileged Usage Guidelines vShield Manager CLI Example manager# show ntp NTP server: 192.168.110.199 Related Commands ntp server VMware, Inc.
Page 118: Show Process
Shows the current routes configured on a vShield Edge. Syntax show route CLI Mode Basic, Privileged Usage Guidelines vShield Edge CLI Example vShieldEdge# show route show running-config Shows the current running configuration. Syntax show running-config CLI Mode Basic, Privileged Example vShield# show running-config Building configuration... Current configuration: segment 0 default bypass VMware, Inc.
Page 119: Show Service
Shows the current status of all services on a vShield Edge. Details include the running status for VPN and the Load Balancer, DHCP leases, and iptable entries for firewall and NAT. Syntax show service statistics CLI Mode Basic, Privileged Usage Guidelines vShield Edge CLI Example vShieldEdge# show service statistics show services Shows the services protected by a vShield App. Syntax show services CLI Mode Basic, Privileged Usage Guidelines vShield App CLI. In the example, 2050001_SAFLOW‐FTPD‐Dynamic‐Port‐Detection is the full name of a service. You must copy and paste this string into the debug service command as the service name. VMware, Inc.
Page 120: Show Session-Manager Counters
Usage Guidelines vShield App CLI Example vShield# show session-manager counters sa_tcp_sockets_allocated_high_water_mark 8 sa_tcp_tw_count_high_water_mark 3 SA_TCP_STATS_OpenreqCreated 61 SA_TCP_STATS_SockCreated 61 SA_TCP_STATS_NewSynReceived 61 SA_TCP_STATS_RetransSynReceived 0 Related Commands show session-manager sessions show session-manager sessions Shows the current sessions in process on a vShield App. Syntax show session-manager sessions CLI Mode Basic, Privileged Usage Guidelines vShield App CLI VMware, Inc.
Page 121: Show Slots
Recovery: System Recovery v0.3.2 Slot 1: 13Aug09-09.49PDT Slot 2: * 16Aug09-23.52PDT (Boot) show stacktrace Shows the stack traces of failed components. If no components have failed, no output is returned. Syntax show stacktrace CLI Mode Basic, Privileged Example vShield# show stacktrace show startup-config Shows the startup configuration. Syntax show startup-config CLI Mode Basic, Privileged Example vShield# show startup-config VMware, Inc.
Page 122: Show Syslog
Syntax show system events [follow | reverse] Option Description Update the displayed log every 5 seconds. follow reverse Show the log in reverse chronological order. CLI Mode Basic, Privileged Usage Guidelines vShield Edge CLI Example vShieldEdge# show system events show system load Shows the average processing load on a vShield Edge. Syntax show system memory CLI Mode Basic, Privileged Usage Guidelines vShield Edge CLI VMware, Inc.
Page 123: Show System Memory
Shows the currently opened network connections and listening interfaces for a vShield Edge. Syntax show system network_connections CLI Mode Basic, Privileged Usage Guidelines vShield Edge CLI Example vShield# show system network_connections show system storage Shows the disk usage details for a vShield Edge. Syntax show system storage CLI Mode Basic, Privileged Usage Guidelines vShield Edge CLI Example vShield# show system storage VMware, Inc.
Page 124: Show System Uptime
Shows the sessions that matched a firewall rule. Syntax show vmwall log [follow | reverse] CLI Mode Basic, Privileged Usage Guidelines vShield App CLI Example vShield# show vmwall log Related Commands show vmwall rules show vmwall rules Shows the firewall rules that are active on the vShield App. Syntax show vmwall rules CLI Mode Basic, Privileged Usage Guidelines vShield App CLI VMware, Inc.
Page 125: Diagnostics And Troubleshooting Commands
CLI Mode Basic and Privileged Example vShield# export tech-support scp user123@host123:file123 link-detect Enables link detection for an interface. Link detection checks the status of an interface as enabled or disabled. Link detection is enabled by default. To disable link detection for an interface, use no before the command. Syntax [no] link-detect CLI Mode Interface Configuration Example vShield(config-if)# link-detect vShield(config-if)# no link-detect ping Pings a destination by its hostname or IP address. Syntax hostname A.B.C.D ping ( Option Description hostname | A.B.C.D The hostname or IP address of the target system. VMware, Inc.
Page 126: Ping Interface Addr
CLI Mode Basic, Privileged Usage Guidelines vShield Edge only This command is useful for debugging IPSec‐related issues. Enter CTRL+C to end ping replies. Example vshieldEdge# ping interface addr 192.168.1.1 69.147.76.15 show tech support Shows the system diagnostic log that can be sent to technical support by running the export tech-support scp command. Syntax show tech support CLI Mode Basic, Privileged Example vShield# show tech support Related Commands export tech-support scp Opens an SSH connection to a remote system. VMware, Inc.
Page 127: Telnet
10.16.67.118 (10.16.67.118), 30 hops max, 40 byte packets 10.115.219.253 (10.115.219.253) 128.808 ms 74.876 ms 74.554 ms 10.17.248.51 (10.17.248.51) 0.873 ms 0.934 ms 0.814 ms 10.16.101.150 (10.16.101.150) 0.890 ms 0.913 ms 0.713 ms 10.16.67.118 (10.16.67.118) 1.120 ms 1.054 ms 1.273 ms VMware, Inc.
Page 128: User
Example vShieldApp# validate sessions User Administration Commands default web-manager password Resets the vShield Manager user interface admin user account password to default. Syntax default web-manager password CLI Mode Privileged mode Usage Guidelines vShield Manager CLI Example manager# default web-manager password Password reset user Adds a CLI user account. The user admin is the default user account. The CLI admin account and password are separate from the vShield Manager user interface admin account and password. You cannot change the password for a CLI user. You must delete a user account and re‐add it to change the password. If you must change a password, create a new user account to prevent CLI lockout. Each vShield virtual machine has two built‐in CLI user accounts for system use: nobody and MPORTANT vs_comm. Do not delete or modify these accounts. If these accounts are deleted or modified, the virtual machine will not work. To remove a CLI user account, use no before the command. VMware, Inc.
Page 129 Starts the Web service on the vShield Manager. The Web service is started after the vShield Manager is installed. To stop the web service (HTTP daemon) on the vShield Manager, use no before the command. This command makes the vShield Manager unavailable to Web Console browser sessions. Syntax [no] web-manager CLI Mode Configuration Usage Guidelines vShield Manager CLI. You can use this command after you have run the no web-manager command to stop and then restart the HTTP services of the vShield Manager. Example manager(config)# no web-manager manager(config)# web-manager Terminal Commands clear vty Clears all other VTY connections to the CLI. Syntax clear vty CLI Mode Privileged Example manager# clear vty VMware, Inc.
Page 130: Reset
CLI Mode Privileged Example manager# terminal length 50 Related Commands reset terminal no length terminal no length Negates the terminal length command. Syntax terminal no length CLI Mode Privileged Example manager# terminal no length Related Commands reset terminal length VMware, Inc.
Page 131 (half|full) speed (10|100|1000) ip policy-address linkwatch interval <5-60> mode policy-based-forwarding open support-tunnel set support key show raid show raid detail VMware, Inc.
Page 132 Administration Guide VMware, Inc.
Page 133: B Troubleshooting
“Troubleshooting vShield Endpoint Issues” on page 139 Troubleshooting vShield Manager Installation vShield OVA File Extracted to a PC Where vSphere Client Is Not Installed Problem I obtained the vShield OVA file and downloaded it to my PC. If I do not have the vSphere Client on my PC, how do I install vShield? Solution You must have the vSphere Client to install vShield. vShield OVA File Cannot Be Installed in vSphere Client Problem When I try to install the vShield OVA file, the install fails. Solution If a vShield OVA file cannot be installed, an error window in the vSphere Client notes the line where the failure occurred. Send this error information with the vSphere Client build information to VMware technical support. VMware, Inc.
Page 134: Problem
Troubleshooting Operation Issues vShield Manager Cannot Communicate with a vShield App Problem I cannot configure a vShield App from the vShield Manager. Solution If you cannot configure the vShield App from the vShield Manager, there is a break in connectivity between the two virtual machines. The vShield management interface cannot talk to the vShield Manager management interface. Make sure that the management interfaces are in the same subnet. If VLANs are used, make sure that the management interfaces are in the same VLAN. Another reason could be that the vShield App or vShield Manager virtual machine is powered off. Cannot Configure a vShield App Problem I cannot configure a vShield App. Solution This might be the result of one of the following conditions.  The vShield App virtual machine is corrupt. Uninstall the offending vShield App from the vShield Manager user interface. Install a new vShield App to protect the ESX host.  The vShield Manager cannot communicate with the vShield App.  The storage/LUN hosting the vShield configuration file has failed. When this happens, you cannot make any configuration changes. However, the firewall continues to run. You can store vShield virtual machines to local storage if remote storage is not reliable. Take a snapshot or create a TAR of the affected vShield App by using the vSphere Client. Send this information to VMware technical support. VMware, Inc.
Page 135: Solution
There is no traffic to the virtual machines protected by a vShield App.  Check the system status of each vShield App for out‐of‐sync issues. Troubleshooting Port Group Isolation Issues Validate Installation of Port Group Isolation To validate installation of Port Group Isolation Make sure that the same port group and virtual machines are not also configured for vCloud Service Director network isolation or LabManager cross‐host fencing. Double encapsulation mode is not supported currently. Verify that the Port Group Isolation bundle is installed: esxupdate query Verify that vshd is running.  ESXi: ps | grep vsh. The results might contain more than one instance, which is ok.  ESX Classic: ps –eaf | grep vshd VMware, Inc.
Page 136 Adds an entry to the services list on ESX to expose VSHD services. You can verify this entry by opening the file /etc/vmware/hostd/proxy.xml and searching for word vsh. The removal script removes all of the operations created by the installation script.  Removes user vslauser.  Removes the role vslauser.  Removes the init entries for vshd and svm-autostart.  Removes the vshd entry from proxy.xml. Validate the Data Path To troubleshoot packet drops, such as a ping between virtual machines in the same isolated port group Make sure that addresses, routes, netmasks, and gateways are configured correctly. Install tcpdump on a virtual machine in the isolated port group. Run a packet capture inside that virtual machine. Ping from the problematic virtual machine to the virtual machine where captures are running. If an ARP packet is received, that means that broadcast packets are received. If you do not receive an ARP packet, that means none of the packets were received. VMware, Inc.
Page 137 Appendix B Troubleshooting To troubleshoot if broadcast packets are being received but unicast packets are being dropped Run /opt/vmware/vslad/fence-util setSwitchMode 1 on all ESX hosts in question. This command instructs the vshd module to broadcast all fenced packets. If after running the command on all hosts things start working, most of the times, this means that the issue lies with mirror virtual machines because mirror virtual machines are required to be configured correctly for the unicast packet delivery to work. For more on fence-util, see “Details of the fence‐util Utility” on page 137. On each ESX host, check the mirror virtual machine’s NICs to make sure that at least one NIC is connected to the vSwitch to which these virtual machines are connected. Confirm that the filter entries for this NIC in the mirror virtual machines VMX files are correct. All of the entries for that vSwitch should have the same LanId? value. After fixing the problem, reset the mode to 0 by running /opt/vmware/vslad/fence-util setSwitchMode 0. Confirm that the packets are reaching the other ESX host. If the mirror virtual machines are misconfigured, packets are dropped at the destination ESX host, not by the source host. If still things are not working, this would most likely mean that the unicast switching is broken somewhere on the physical boxes in the network. This is rare because if broadcast packets are reaching, that means physical connectivity is present between the virtual machines communicating with each other. If broadcast is working and unicast is not working even after putting all vshd modules in broadcast mode using fence‐utils, then problems may be present in the physical network for such unicasts.
Page 138 To determine why protected virtual machines are not being assigned IP addresses by a vShield Edge Verify DHCP configuration was successful on the vShield Edge by running the CLI command: show configuration dhcp. Check whether DHCP service is running on the vShield Edge by running CLI command: show service dhcp Ensure that vmnic on virtual machine and vShield Edge is connected (vCenter > Virtual Machine > Edit Settings > Network Adapter > Connected/Connect at Power On check boxes). When both a vShield App and vShield Edge are installed on the same ESX host, disconnection of NICs can occur if a vShield App is installed after a vShield Edge. Load-Balancer Does Not Work To determine why the load balancer service on a vShield Edge is not working Verify that the Load balancer is running by running the CLI command: show service lb. Load balancer can be started by issuing the start command. Verify the load‐balancer configuration by running command: show configuration lb. This command also shows on which external interfaces the listeners are running. VMware, Inc.
Page 139 Verify the configuration at both ends (vShield Edge and remoteEnd), notably the shared keys. Debug MTU or fragmentation related issues by using ping with small and big packet sizes.  ping -s 500 ip-at-end-of-the-tunnel  ping -s 2000 ip-at-end-of-the-tunnel Troubleshooting vShield Endpoint Issues Thin Agent Logging vShield Endpoint thin agent logging is done inside the protected virtual machines. Two registry values are read at boot time from the windows registry. They are polled again periodically. There are two registry values, log_dest and log_level. The two entries are located in the following registry locations: HKLM\System\CurrentControlSet\Services\VFileScsiFilter\Parameters\log_dest HKLM\System\CurrentControlSet\Services\VFileScsiFilter\Parameters\log_level Both are DWORD bit masks that can be any combination of the following values: log_dest WINDBLOG VMWARE_LOG log_level AUDIT ERROR WARN INFO DEBUG 0x10 VMware, Inc.
Page 140 Administration Guide By default, the values in release builds are set to VMWARE_LOG and AUDIT. For more on monitoring vShield Endpoint health, see Chapter 14, “vShield Endpoint Events and Alarms,” on page 81. Component Version Compatibility The SVM version and the thin agent version must be compatible. (There will be a compatibility matrix available after 1.0 for version compatibility checking.) To retrieve version numbers for the various components, do the following:  SVM: strings libEPSec.so | grep BUILD_NUMBER provides the build number. Also, the audit logs prints the build number when libEPSec.so is initialized.  GVM: Right‐click on the properties of the driver files to get the build number. Also, the audit logs prints the build number (vmware.log for release).  vShield Endpoint Module: The esxupdate command provides the installed module version. Also, the audit logs print the build number. VMware, Inc.
Page 141: Index
63 syntax 90 syslog format 42 Cluster Level Rules 28, 74 vShield App 42 command syntax 90 vShield Manager 42 configuration mode of CLI 90 events for vShield Endpoint 83 configure terminal 94 connecting to vCenter Server 21 VMware, Inc.
Page 142 96 interface mode of CLI 90 inventory panel 18 reboot 93 ip address 99 reports ip name server 99 audit log 43, 77, 78 ip route 100 system events 41 reset 130 restarting a vShield App 65 VMware, Inc.
Page 143 116 system time 23 Show Logs 65 show manager log 116 show manager log last 117 technical support log 23 show ntp 117 telnet 127 show process 118 terminal length 130 Show Report 68 terminal no length 130 VMware, Inc.
Page 144 Server 21 CLI configuration 64 system events 41 firewall logs 65 user interface panels 18 forcing sync 64 vSphere Plug-in 22 notification based on events 42 restarting 65 sending events to syslog server 63 System Status 64 VMware, Inc.
Page 145 Plug-in 22 web-manager 129 write 103 write erase 104 write memory 104 Zones Firewall 27 adding L2/L3 rules 30 adding L4 rules 29 deleting rules 32 hierarchy of rules 28 planning rule enforcement 28 validate sessions 31 VMware, Inc.
Page 146 Administration Guide VMware, Inc.

This manual is also suitable for:

Vshield manager 4.1 Vshield edge 1.0 Vshield endpoint security 1.0

VMware VSHIELD APP 1.0 Admin Manual

Vshield Manager and Vshield Zones

1 Overview of Vshield

2 Vshield Manager User Interface Basics

3 Management System Settings

4 Zones Firewall Management

5 User Management

6 Updating System Software

7 Backing up Vshield Manager Data

8 System Events and Audit Logs

9 Uninstalling Vshield Components

Vshield Edge and Port Group Isolation

10 Vshield Edge Management

Vshield App and Vshield Endpoint

11 Vshield App Management

12 Flow Monitoring

13 App Firewall Management

14 Vshield Endpoint Events and Alarms

Appendixes

Command Line Interface

Quick Links

Troubleshooting

Need help?

Questions and answers

Subscribe to Our Youtube Channel

Related Manuals for VMware VSHIELD APP 1.0

Summary of Contents for VMware VSHIELD APP 1.0

This manual is also suitable for:

Table of Contents