Validate Active Sessions Against Current Vshield Edge Firewall Rules; Manage Nat Rules - VMware VSHIELD APP 1.0.0 UPDATE 1 Admin Manual

5 Click Add.
A new row appears in the table.
6 Double-click each cell in the row to enter or select the appropriate information.
You must type IP addresses in the Source and Destination fields.
7 (Optional) Click Log to send log events to a specified syslog server when the firewall rule is violated.
8 (Optional) Select the new row and click Move Up to move the rule up in priority.
9 Click Commit to save the rule.

Validate Active Sessions Against Current vShield Edge Firewall Rules

By default, a vShield Edge matches firewall rules against each new session. After a session has been
established, any firewall rule changes do not affect active sessions.
The CLI command validate sessions enables you to validate active sessions against the current vShield
Edge firewall rule set to purge any sessions that are in violation of the current rule set. After a firewall rule set
update, you should validate active sessions to purge any existing sessions that are in violation of the updated
policy.
After a vShield Edge firewall update is complete, issue the validate sessions command from the CLI of a
vShield Edge instance to purge sessions that are in violation of current policy.
To validate active sessions against the current firewall rules
1 Update and commit the vShield Edge firewall rule set.
2 Open a console session on a vShield Edge instance to issue the validate sessions command.
vShieldEdge> validate sessions

Manage NAT Rules

The vShield Edge provides network address translation (NAT) service to protect the IP addresses of internal,
private networks from the public network. You must configure NAT rules to provide access to services
running on privately addressed virtual machines.
The NAT service configuration is separated into SNAT and DNAT rules. An SNAT rule translates a private
internal IP address into a public IP address for outbound traffic. A DNAT rule maps a public IP address to a
private internal IP address.
To configure an SNAT rule for a vShield Edge
1 In to the vSphere Client, go to Inventory > Networking.
2 Select an Internal port group where a vShield Edge has been installed.
3 Click the vShield Edge tab.
4 Click the NAT link.
5 Under Direction OUT (SNAT), click Add.
A new row appears in the table.
6 Double-click each cell in the row to enter the appropriate information.
7 Click Commit to save the rule.
VMware, Inc.
Chapter 10 vShield Edge Management
51