Zones Firewall Management; Using Zones Firewall - VMware VSHIELD APP 1.0 Admin Manual

4

Zones Firewall Management

vShield Zones provides firewall protection access policy enforcement. Traffic details include sources,
destinations, direction of sessions, applications, and ports being used. Traffic details can be used to create
firewall allow or deny rules.
N You can upgrade vShield Zones to vShield App by obtaining a vShield App license. vShield App
OTE
enhances vShield Zones protection by offering Flow Monitoring, custom container creation (Security Groups),
and container‐based access policy creation and enforcement.
You do not have to uninstall vShield Zones to install vShield App. All vShield Zones instances become vShield
App instances, the Zones Firewall becomes App Firewall, and the additional vShield App features are enabled.
This chapter includes the following topics:

"Using Zones Firewall" on page 27

"Create a Zones Firewall Rule" on page 29

"Create a Layer 2/Layer 3 Zones Firewall Rule" on page 30

"Validating Active Sessions against the Current Zones Firewall Rules" on page 31

"Revert to a Previous Zones Firewall Configuration" on page 31

"Delete a Zones Firewall Rule" on page 32

Using Zones Firewall

Zones Firewall is a centralized, hierarchical firewall for ESX hosts. Zones Firewall enables you to create rules
that allow or deny access to and from your virtual machines. Each installed vShield Zones enforces the App
Zones rules.
You can manage Zones Firewall rules at the datacenter, cluster, and port group levels to provide a consistent
set of rules across multiple vShield Zones instances under these containers. As membership in these containers
can change dynamically, Zones Firewall maintains the state of existing sessions without requiring
reconfiguration of firewall rules. In this way, Zones Firewall effectively has a continuous footprint on each ESX
host under the managed containers.
When creating Zones Firewall rules, you create 5‐tuple firewall rules based on specific source and destination IP
addresses.
VMware, Inc.
4
27