VMware VSHIELD APP 1.0 - User manual

vShield Quick Start Guide
vShield Manager 4.1
vShield Edge 1.0
vShield App 1.0
vShield Endpoint 1.0
This document supports the version of each product listed and
supports all subsequent versions until the document is replaced
by a new edition. To check for more recent editions of this
document, see http://www.vmware.com/support/pubs.
EN-000375-00

VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2VMware, Inc.
vShield Quick Start Guide
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
[e-mail]
Copyright © 2010 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and
intellectual property laws. VMware products are covered by one or more patents listed at
http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks
and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3
Contents
AboutThisBook 5
1IntroductiontovShield 7
vShieldComponentsataGlance 7
vShieldManager 7
vShieldZones 7
vShieldEdge 8
StandardvShieldEdgeServices(IncludingCloudDirector) 8
AdvancedvShieldEdgeServices 8
vShieldApp 9
vShieldEndpoint 9
DeploymentScenarios 10
ProtectingtheDMZ 10
IsolatingandProtectingInternalNetworks 10
ProtectingVirtualMachinesinaCluster 11
CommonDeploymentsofvShieldEdge 11
CommonDeploymentsofvShieldApp 11
2PreparingforInstallation 13
SystemRequirements 13
Hardware 13
Software 13
ClientandUserAccess 14
DeploymentConsiderations 14
PreparingVirtualMachinesforvShieldProtection 14
HowAreMyVirtualMachinesGrouped? 14
AreMyVirtualMachinesStillProtectedifIvMotionThemtoAnotherESXHost? 14
HowDoIIsolateaGroupofVirtualMachines? 15
vShieldManagerUptime 15
CommunicationBetweenvShieldComponents 15
HardeningYourvShieldVirtualMachines 15
vShieldManagerUserInterface 15
CommandLineInterface 15
RESTRequests 16
3InstallingthevShieldManagerandvShieldZones 17
ObtainthevShieldManagerOVAFile 17
InstallthevShieldManagerVirtualAppliance 17
ConfiguretheNetworkSettingsofthevShieldManager 18
LogIntothevShieldManagerUserInterface 19
SynchronizethevShieldManagerwiththevCenterServer 19
RegisterthevShieldManagerPlug‐InwiththevSphereClient 20
ChangethePasswordofthevShieldManagerUserInterfaceDefaultAccount 20
InstallvShieldZones 20
WheretoGoNext 21

vShield Quick Start Guide
4VMware, Inc.
4InstallingvShieldEdge,vShieldApp,andvShieldEndpoint 23
RunningvShieldinEvaluationMode 23
PreparingYourVirtualInfrastructureforvShieldApp,vShieldEdge,andvShieldEndpoint 23
InstallvShieldComponentLicenses 24
PrepareAllESXHosts 24
PrepareavNetworkforPortGroupIsolation 25
InstallavShieldEdge 25
InstallingvShieldEndpoint 27
vShieldEndpointInstallationWorkflow 27
InstalltheThinAgentontheGuestVirtualMachine 27
Prerequisites 27
WheretoGoNext 28
Index 29

VMware, Inc. 5
ThevShieldQuickStartGuideprovidesinformationaboutinstallingVMware®vShield™intoyourVMware
VirtualInfrastructureenvironment.
Intended Audience
ThisbookisintendedforanyonewhowantstoinstalloruseVMwarevShield.Theinformationinthisbookis
writtenforexperiencedWindowsorLinuxsystemadministratorswhoarefamiliarwithvirtualmachine
technologyanddatacenteroperations.ThisbookalsoassumesfamiliaritywithVMwareVirtual
Infrastructure,includingvCenter™Server4.x,VMwareESX™4.x,andthevSphereClient.
VMware Technical Publications Glossary
VMwareTechnicalPublicationsprovidesaglossaryoftermsthatmightbeunfamiliartoyou.Fordefinitions
oftermsastheyareusedinVMwaretechnicaldocumentationgotohttp://www.vmware.com/support/pubs.
Document Feedback
VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhavecomments,sendyour
feedbackto[e-mail].
VMware Infrastructure Documentation
ThefollowingdocumentscomprisetheVMwarevShielddocumentationset:
vShieldAdministrationGuide
vShieldQuickStartGuide
vShieldAPIProgrammingGuide
YoushouldalsohaveaccesstothecombinedvCenterServerandESXdocumentationset.
Technical Support and Education Resources
Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversion
ofthisbookandotherbooks,gotohttp://www.vmware.com/support/pubs.
Online and Telephone Support
Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and
registeryourproducts,gotohttp://www.vmware.com/support.
Customerswithappropriatesupportcontractsshouldusetelephonesupportforthefastestresponseon
priority1issues.Gotohttp://www.vmware.com/support/phone_support.
About This Book

vShield Quick Start Guide
6VMware, Inc.
Support Offerings
TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto
http://www.vmware.com/support/services.
VMware Professional Services
VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials
designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive
online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides
offeringsto helpyouassess,plan,build,andmanageyourvirtualenvironment.Toaccessinformationabout
educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.

VMware, Inc. 7
1
ThischapterintroducestheVMware®vShield™componentsyouinstall.
Thechapterincludesthefollowingtopics:
“vShieldComponentsataGlance”onpage 7
“DeploymentScenarios”onpage 10
vShield Components at a Glance
VMwarevShieldisasuiteofsecurityvirtualappliancesbuiltforVMwarevCenter™Serverintegration.
vShieldisacriticalsecuritycomponentforprotectingvirtualizeddatacentersfromattacksandmisusehelping
youachieveyourcompliance‐mandatedgoals.
vShieldincludesvirtualappliancesandservicesessentialforprotectingvirtualmachines.vShieldcanbe
configuredthroughaweb‐baseduserinterface,avSphereClientplug‐in,acommandlineinterface(CLI),and
RESTAPI.
vCenterServerincludesvShieldManagerandvShieldZones.ThefollowingvShieldpackageseachrequirea
license:
vShieldEdgewithPortGroupIsolation
vShieldApp
vShieldEndpoint
OnevShieldManagermanagesmultiplevShieldZones,vShieldEdge,vShieldApp,andvShieldEndpoint
instances.
vShield Manager
ThevShieldManageristhecentralizednetworkmanagementcomponentofvShield,andisinstalledasa
virtualapplianceonanyESX™hostinyourvCenterServerenvironment.AvShieldManagercanrunona
differentESXhostfromyourvShieldagents.
UsingthevShieldManageruserinterfaceorvSphereClientplug‐in,administratorsinstall,configure,and
maintainvShieldcomponents.ThevShieldManageruserinterfaceleveragestheVMwareInfrastructureSDK
todisplayacopyofthevSphereClientinventorypanel,andincludestheHosts&ClustersandNetworks
views.
vShield Zones
vShieldZonesprovidesfirewallprotectionfortrafficbetweenvirtualmachines.ForeachZonesFirewallrule,
youcanspecifythesourceIP,destinationIP,sourceport,destinationport,andservice.
Introduction to vShield 1

vShield Quick Start Guide
8VMware, Inc.
vShield Edge
vShieldEdgeprovidesnetworkedgesecurityandgatewayservicestoisolatethevirtualmachinesinaport
group,vDSportgroup,orCisco®Nexus1000V.ThevShieldEdgeconnectsisolated,stubnetworkstoshared
(uplink)networksbyprovidingcommongatewayservicessuchasDHCP,VPN,NAT,andLoadBalancing.
CommondeploymentsofvShieldEdgeincludeintheDMZ,VPNExtranets,andmulti‐tenantCloud
environmentswherethevShieldEdgeprovidesperimetersecurityforVirtualDatacenters(VDCs).
Standard vShield Edge Services (Including Cloud Director)
Firewall:SupportedrulesincludeIP5‐tupleconfigurationwithIPandportrangesforstatefulinspection
forTCP,UDP,andICMP.
NetworkAddressTranslation:SeparatecontrolsforSourceandDestinationIPaddresses,aswellasTCP
andUDPporttranslation.
DynamicHostConfigurationProtocol(DHCP):ConfigurationofIPpools,gateways,DNSservers,and
searchdomains.
Advanced vShield Edge Services
Site‐to‐SiteVirtualPrivateNetwork(VPN):UsesstandardizedIPsecprotocolsettingstointeroperatewith
allmajorfirewallvendors.
LoadBalancing:SimpleanddynamicallyconfigurablevirtualIPaddressesandservergroups.
vShieldEdgesupportssyslogexportforallservicestoremoteservers.
Figure 1-1. vShield Edge Installed to Secure a vDS Port Group

VMware, Inc. 9
Chapter 1 Introduction to vShield
vShield App
vShieldAppisaninterior,vNIC‐levelfirewallthatallowsyoutocreateaccesscontrolpoliciesregardlessof
networktopology.AvShieldAppmonitorsalltrafficinandoutofanESXhost,includingbetweenvirtual
machinesinthesameportgroup.vShieldAppincludestrafficanalysisandcontainer‐basedpolicycreation.
vShieldAppinstallsasahypervisormoduleandfirewallservicevirtualappliance.vShieldAppintegrates
withESXhoststhroughVMsafeAPIsandworkswithVMwarevSphereplatformfeaturessuchasDRS,
vMotion,DPM,andmaintenancemode.
vShieldAppprovidesfirewallingbetweenvirtualmachinesbyplacingafirewallfilteroneveryvirtual
networkadapter.Thefirewallfilteroperatestransparentlyanddoesnotrequirenetworkchangesor
modificationofIPaddressestocreatesecurityzones.YoucanwriteaccessrulesbyusingvCentercontainers,
likedatacenters,cluster,resourcepoolsandvApps,ornetworkobjects,likePortGroupsandVLANs,to
reducethenumberoffirewallrulesandmaketheruleseasiertotrack.
YoushouldinstallvShieldAppinstancesonallESXhostswithinaclustersothatVMwarevMotion™
operationsworkandvirtualmachinesremainprotectedastheymigratebetweenESXhosts.Bydefault,a
vShieldAppvirtualappliancecannotbemovedbyusingvMotion.
TheFlowMonitoringfeaturedisplaysallowedandblockednetworkflowsattheapplicationprotocollevel.
Youcanusethisinformationtoauditnetworktrafficandtroubleshootoperational.
vShield Endpoint
vShieldEndpointdeliversanintrospection‐basedantivirussolution.vShieldEndpointusesthehypervisorto
scanguestvirtualmachinesfromtheoutsidewithoutabulkyagent.vShieldEndpointisefficientinavoiding
resourcebottleneckswhileoptimizingmemoryuse.
vShieldEndpointinstallsasahypervisormoduleandsecurityvirtualappliancefromathird‐partyantivirus
vendor(VMwarepartners)onanESXhost.
Figure 1-2. vShield Endpoint Installed on an ESX Host

vShield Quick Start Guide
10 VMware, Inc.
Deployment Scenarios
UsingvShield,youcanbuildsecurezonesforavarietyofvirtualmachinedeployments.Youcanisolatevirtual
machinesbasedonspecificapplications,networksegmentation,orcustomcompliancefactors.Onceyou
determineyourzoningpolicies,youcandeployvShieldtoenforceaccessrulestoeachofthesezones.
Protecting the DMZ
TheDMZisamixedtrustzone.ClientsenterfromtheInternetforWebandemailservices,whileservices
withintheDMZmightrequireaccesstoservicesinsidetheinternalnetwork.YoucanplaceDMZvirtual
machinesinaportgroupandsecurethatportgroupwithavShieldEdge.vShieldEdgeprovidesaccess
servicessuchasfirewall,NAT,andVPN,aswellasloadbalancingtosecureDMZservices.
AcommonexampleofaDMZservicerequiringaninternalserviceisMicrosoftExchange.MicrosoftOutlook
WebAccess(OWA)commonlyresidesintheDMZcluster,whiletheMicrosoftExchangebackendisinthe
internalcluster.Ontheinternalcluster,youcancreatefirewallrulestoallowonlyExchanged‐relatedrequests
fromtheDMZ,identifyingspecificsource‐to‐destinationparameters.FromtheDMZcluster,youcancreate
rulestoallowoutsideaccesstotheDMZonlytospecificdestinationsusingHTTP,FTP,orSMTP.
Isolating and Protecting Internal Networks
YoucanuseavShieldEdgewiththePortGroupIsolationfeaturetoisolateaninternalnetworkfromthe
externalnetwork.AvShieldEdgeprovidesperimeterfirewallprotectionandedgeservicestosecurevirtual
machinesinaportgroup,enablingcommunicationtotheexternalnetworkthroughDHCP,NAT,andVPN.
Withinthesecuredportgroup,youcaninstallavShieldAppinstanceoneachESXhostthatthevDSspansto
securecommunicationbetweenvirtualmachinesintheinternalnetwork.
IfyouutilizeVLANtagstosegmenttraffic,youcanuseAppFirewalltocreatesmarteraccesspolicies.Using
AppFirewallinsteadofaphysicalfirewallallowsyoutocollapseormixtrustzonesinsharedESXclusters.By
doingso,yougainoptimalutilizationandconsolidationfromfeaturessuchasDRSandHA,insteadofhaving
separate,fragmentedclusters.ManagementoftheoverallESXdeploymentasasinglepoolislesscomplex
thanhavingseparatelymanagedpools.
Forexample,youuseVLANstosegmentvirtualmachinezonesbasedonlogical,organizational,ornetwork
boundaries.LeveragingtheVirtualInfrastructureSDK,thevShieldManagerinventorypaneldisplaysaview
ofyourVLANnetworksundertheNetworksview.YoucanbuildaccessrulesforeachVLANnetworkto
isolatevirtualmachinesanddropuntaggedtraffictothesemachines.