VMware VSHIELD APP 1.0 - Manual

vShield Administration Guide
vShield Manager 4.1
vShield Edge 1.0
vShield App 1.0
vShield Endpoint Security 1.0
This document supports the version of each product listed and
supports all subsequent versions until the document is replaced
by a new edition. To check for more recent editions of this
document, see http://www.vmware.com/support/pubs.
EN-000374-00

VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2VMware, Inc.
vShield Administration Guide
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
[e-mail]
Copyright © 2010 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and
intellectual property laws. VMware products are covered by one or more patents listed at
http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks
and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3
Contents
AboutThisBook 9
vShieldManagerandvShieldZones
1OverviewofvShield 13
vShieldComponents 13
vShieldManager 13
vShieldZones 13
vShieldEdge 14
StandardvShieldEdgeservices(includingCloudDirector) 14
AdvancedvShieldEdgeservices 14
vShieldApp 14
vShieldEndpoint 15
MigrationofvShieldComponents 15
VMwareTools 15
PortsRequiredforvShieldCommunication 15
2vShieldManagerUserInterfaceBasics 17
LoggingintothevShieldManagerUserInterface 17
AccessingtheOnlineHelp 18
vShieldManagerUserInterface 18
vShieldManagerInventoryPanel 18
RefreshingtheInventoryPanel 18
SearchingtheInventoryPanel 18
vShieldManagerConfigurationPanel 19
3ManagementSystemSettings 21
IdentifyYourvCenterServer 21
RegisterthevShieldManagerasavSphereClientPlug‐in 22
IdentifyDNSServices 22
SetthevShieldManagerDateandTime 23
IdentifyaProxyServer 23
DownloadaTechnicalSupportLogfromaComponent 23
BackUpvShieldManagerData 24
ViewvShieldManagerSystemStatus 24
AddanSSLCertificatetoIdentifythevShieldManagerWebService 24
4ZonesFirewallManagement 27
UsingZonesFirewall 27
DefaultRules 28
Layer4RulesandLayer2/Layer3Rules 28
HierarchyofZonesFirewallRules 28
PlanningZonesFirewallRuleEnforcement 28
CreateaZonesFirewallRule 29
CreateaLayer2/Layer3ZonesFirewallRule 30

vShield Administration Guide
4VMware, Inc.
ValidatingActiveSessionsagainsttheCurrentZonesFirewallRules 31
ReverttoaPreviousZonesFirewallConfiguration 31
DeleteaZonesFirewallRule 32
5UserManagement 33
ManagingUserRights 33
ManagingtheDefaultUserAccount 34
AddaUser 34
AssignaRoleandRightstoaUser 34
EditaUserAccount 34
DeleteaUserAccount 35
6UpdatingSystemSoftware 37
ViewtheCurrentSystemSoftware 37
UploadanUpdate 37
ReviewtheUpdateHistory 38
7BackingUpvShieldManagerData 39
BackUpYourvShieldManagerDataonDemand 39
ScheduleaBackupofvShieldManagerData 40
RestoreaBackup 40
8SystemEventsandAuditLogs 41
ViewtheSystemEventReport 41
SystemEventNotifications 42
vShieldManagerVirtualApplianceEvents 42
vShieldAppEvents 42
SyslogFormat 42
ViewtheAuditLog 43
9UninstallingvShieldComponents 45
UninstallavShieldApporvShieldZones 45
UninstallavShieldEdgefromaPortGroup 46
UninstallPortGroupIsolationfromanESXHost 46
UninstallavShieldEndpointModule 47
UnregisteranSVMfromavShieldEndpointModule 47
UninstallthevShieldEndpointModulefromthevSphereClient 47
vShieldEdgeandPortGroupIsolation
10 vShieldEdgeManagement 51
ViewtheStatusofavShieldEdge 51
SpecifyaRemoteSyslogServer 52
ManagingthevShieldEdgeFirewall 52
CreateavShieldEdgeFirewallRule 52
ValidateActiveSessionsAgainstCurrentvShieldEdgeFirewallRules 53
ManageNATRules 53
ManageDHCPService 54
ManageVPNService 56
ManageLoadBalancerService 58
StartorStopvShieldEdgeServices 59

VMware, Inc. 5
vShieldAppandvShieldEndpoint
11 vShieldAppManagement 63
SendvShieldAppSystemEventstoaSyslogServer 63
BackUptheRunningCLIConfigurationofavShieldApp 64
ViewtheCurrentSystemStatusofavShieldApp 64
ForceavShieldApptoSynchronizewiththevShieldManager 64
RestartavShieldApp 65
ViewTrafficStatisticsbyvShieldAppInterface 65
DownloadtheFirewallLogsofavShieldApp 65
12 FlowMonitoring 67
UsingFlowMonitoring 67
ViewaSpecificApplicationintheFlowMonitoringCharts 68
ChangetheDateRangeoftheFlowMonitoringCharts 68
ViewtheFlowMonitoringReport 68
AddanAppFirewallRulefromtheFlowMonitoringReport 69
DeleteAllRecordedFlows 70
EditingPortMappings 70
AddanApplication‐PortPairMapping 70
DeleteanApplication‐PortPairMapping 71
HidethePortMappingsTable 71
13 AppFirewallManagement 73
UsingAppFirewall 73
SecuringContainersandDesigningSecurityGroups 73
DefaultRules 74
Layer4RulesandLayer2/Layer3Rules 74
HierarchyofAppFirewallRules 74
PlanningAppFirewallRuleEnforcement 74
CreateanAppFirewallRule 75
CreateaLayer2/Layer3AppFirewallRule 77
CreatingandProtectingSecurityGroups 77
AddaSecurityGroup 77
AssignResourcestoaSecurityGroup 78
ValidatingActiveSessionsagainsttheCurrentAppFirewallRules 78
ReverttoaPreviousAppFirewallConfiguration 79
DeleteanAppFirewallRule 79
14 vShieldEndpointEventsandAlarms 81
ViewvShieldEndpointStatus 81
Alarms 82
HostAlarms 82
SVMAlarms 82
VMAlarms 83
Events 83
AuditMessages 86

VMware, Inc. 6
Appendixes
ACommandLineInterface 89
LoggingInandOutoftheCLI 89
CLICommandModes 89
CLISyntax 90
MovingAroundintheCLI 90
GettingHelpwithintheCLI 91
SecuringCLIUserAccountsandthePrivilegedModePassword 91
AddaCLIUserAccount 91
DeletetheadminUserAccountfromtheCLI 92
ChangetheCLIPrivilegedModePassword 92
CommandReference 93
AdministrativeCommands 93
list 93
reboot 93
shutdown 94
CLIModeCommands 94
configureterminal 94
disable 94
enable 95
end 95
exit 95
interface 96
quit 96
ConfigurationCommands 97
clearvmwallrules 97
clisshallow 97
copyrunning‐configstartup‐config 97
databaseerase 98
enablepassword 98
hostname 99
ipaddress 99
ipnameserver 99
iproute 100
managerkey 100
ntpserver 101
setclock 101
setup 102
ssh 102
syslog 103
write 103
writeerase 104
writememory 104
DebugCommands 104
debugcopy 104
debugpacketcapture 105
debugpacketdisplayinterface 105
debugremove 106
debugservice 107
debugserviceflowsrc 107
debugshowfiles 108

VMware, Inc. 7
ShowCommands 108
showalerts 108
showarp 109
showclock 109
showconfiguration 109
showdebug 110
showethernet 110
showfilesystem 111
showgatewayrules 111
showhardware 112
showhostname 112
showinterface 112
showipaddr 113
showiproute 113
showiptables 113
showkernelmessage 114
showkernelmessagelast 114
showlog 115
showlogalerts 115
showlogevents 115
showloglast 116
showmanagerlog 116
showmanagerloglast 117
showntp 117
showprocess 118
showroute 118
showrunning‐config 118
showservice 119
showservicestatistics 119
showservices 119
showsession‐managercounters 120
showsession‐managersessions 120
showslots 121
showstacktrace 121
showstartup‐config 121
showsyslog 122
showsystemevents 122
showsystemload 122
showsystemmemory 123
showsystemnetwork_connections 123
showsystemstorage 123
showsystemuptime 124
showversion 124
showvmwalllog 124
showvmwallrules 124
DiagnosticsandTroubleshootingCommands 125
exporttech‐supportscp 125
link‐detect 125
ping 125
pinginterfaceaddr 126
showtechsupport 126
ssh 126
telnet 127

VMware, Inc. 8
traceroute 127
validatesessions 128
UserAdministrationCommands 128
defaultweb‐managerpassword 128
user 128
web‐manager 129
TerminalCommands 129
clearvty 129
reset 130
terminallength 130
terminalnolength 130
DeprecatedCommands 131
BTroubleshooting 133
TroubleshootingvShieldManagerInstallation 133
vShieldOVAFileExtractedtoaPCWherevSphereClientIsNotInstalled 133
Problem 133
Solution 133
vShieldOVAFileCannotBeInstalledinvSphereClient 133
Problem 133
Solution 133
CannotLogIntoCLIAfterthevShieldManagerVirtualMachineStarts 134
Problem 134
Solution 134
CannotLogIntothevShieldManagerUserInterface 134
Problem 134
Solution 134
TroubleshootingOperationIssues 134
vShieldManagerCannotCommunicatewithavShieldApp 134
Problem 134
Solution 134
CannotConfigureavShieldApp 134
Problem 134
Solution 134
FirewallBlockRuleNotBlockingMatchingTraffic 135
Problem 135
Solution 135
NoFlowDataDisplayinginFlowMonitoring 135
TroubleshootingPortGroupIsolationIssues 135
ValidateInstallationofPortGroupIsolation 135
TovalidateinstallationofPortGroupIsolation 135
VerifyInstallorUninstallScript 136
ValidatetheDataPath 136
Detailsofthefence‐utilUtility 137
TroubleshootingvShieldEdgeIssues 138
VirtualMachinesAreNotGettingIPAddressesfromtheDHCPServer 138
Load‐BalancerDoesNotWork 138
Load‐BalancerThrowsError502BadGatewayforHTTPRequests 139
VPNDoesNotWork 139
TroubleshootingvShieldEndpointIssues 139
ThinAgentLogging 139
ComponentVersionCompatibility 140
Index 141

VMware, Inc. 9
Thismanual,thevShieldAdministrationGuide,describeshowtoinstall,configure,monitor,andmaintainthe
VMware®vShield™systembyusingthevShieldManageruserinterface,thevSphereClientplug‐in,and
commandlineinterface(CLI).Theinformationincludesstep‐by‐stepconfigurationinstructions,and
suggestedbestpractices.
Intended Audience
ThismanualisintendedforanyonewhowantstoinstallorusevShieldinaVMwarevCenterenvironment.
Theinformationinthismanualiswrittenforexperiencedsystemadministratorswhoarefamiliarwithvirtual
machinetechnologyandvirtualdatacenteroperations.ThismanualassumesfamiliaritywithVMware
Infrastructure4.x,includingVMwareESX,vCenterServer,andthevSphereClient.
VMware Technical Publications Glossary
VMwareTechnicalPublicationsprovidesaglossaryoftermsthatmightbeunfamiliartoyou.Fordefinitions
oftermsastheyareusedinVMwaretechnicaldocumentationgotohttp://www.vmware.com/support/pubs.
Document Feedback
VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhavecomments,sendyour
feedbackto[e-mail].
vShield Documentation
ThefollowingdocumentscomprisethevShielddocumentationset:
vShieldAdministrationGuide,thisguide
vShieldQuickStartGuide
vShieldAPIProgrammingGuide
Technical Support and Education Resources
Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversion
ofthisbookandotherbooks,gotohttp://www.vmware.com/support/pubs.
Online and Telephone Support
Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and
registeryourproducts,gotohttp://www.vmware.com/support.
Customerswithappropriatesupportcontractsshouldusetelephonesupportforthefastestresponseon
priority1issues.Gotohttp://www.vmware.com/support/phone_support.
About This Book

vShield Administration Guide
10 VMware, Inc.
Support Offerings
TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto
http://www.vmware.com/support/services.
VMware Professional Services
VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials
designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive
online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides
offeringsto helpyouassess,plan,build,andmanageyourvirtualenvironment.Toaccessinformationabout
educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.