VMware VSHIELD APP 1.0.0 UPDATE 1 - API Manual

vShield Administration Guide
vShield Manager 4.1.0 Update 1
vShield Zones 4.1.0 Update 1
vShield Edge 1.0.0 Update 1
vShield App 1.0.0 Update 1
vShield Endpoint 1.0.0 Update 1
This document supports the version of each product listed and
supports all subsequent versions until the document is replaced
by a new edition. To check for more recent editions of this
document, see http://www.vmware.com/support/pubs.
EN-000374-01

VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2VMware, Inc.
vShield Administration Guide
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
[e-mail]
Copyright © 2010 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and
intellectual property laws. VMware products are covered by one or more patents listed at
http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks
and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3
Contents
About This Book 7
vShield Manager and vShield Zones
1Overview of vShield 11
vShield Components 11
vShield Manager 11
vShield Zones 11
vShield Edge 12
vShield App 12
vShield Endpoint 13
Migration of vShield Components 13
VMware Tools 13
Ports Required for vShield Communication 13
2vShield Manager User Interface Basics 15
Logging in to the vShield Manager User Interface 15
Accessing the Online Help 16
vShield Manager User Interface 16
vShield Manager Inventory Panel 16
vShield Manager Configuration Panel 17
3Management System Settings 19
Identify Your vCenter Server 19
Register the vShield Manager as a vSphere Client Plug-in 20
Identify DNS Services 20
Set the vShield Manager Date and Time 21
Identify a Proxy Server 21
Download a Technical Support Log from a Component 21
Back Up vShield Manager Data 22
View vShield Manager System Status 22
Add an SSL Certificate to Identify the vShield Manager Web Service 22
4Zones Firewall Management 25
Using Zones Firewall 25
Default Rules 26
Layer 4 Rules and Layer 2/Layer 3 Rules 26
Hierarchy of Zones Firewall Rules 26
Planning Zones Firewall Rule Enforcement 26
Create a Zones Firewall Rule 27
Create a Layer 2/Layer 3 Zones Firewall Rule 28
Validating Active Sessions against the Current Zones Firewall Rules 29
Revert to a Previous Zones Firewall Configuration 29
Delete a Zones Firewall Rule 30

vShield Administration Guide
4VMware, Inc.
5User Management 31
Managing User Rights 31
Managing the Default User Account 32
Add a User 32
Assign a Role and Rights to a User 32
Edit a User Account 32
Delete a User Account 33
6Updating System Software 35
View the Current System Software 35
Upload an Update 35
Review the Update History 36
7Backing Up vShield Manager Data 37
Back Up Your vShield Manager Data on Demand 37
Schedule a Backup of vShield Manager Data 38
Restore a Backup 38
8System Events and Audit Logs 39
View the System Event Report 39
System Event Notifications 40
vShield Manager Virtual Appliance Events 40
vShield App Events 40
Syslog Format 40
View the Audit Log 41
9Uninstalling vShield Components 43
Uninstall a vShield App or vShield Zones 43
Uninstall a vShield Edge from a Port Group 44
Uninstall Port Group Isolation from an ESX Host 44
Uninstall a vShield Endpoint Module 45
Unregister an SVM from a vShield Endpoint Module 45
Uninstall the vShield Endpoint Module from the vSphere Client 45
vShield Edge and Port Group Isolation
10 vShield Edge Management 49
View the Status of a vShield Edge 49
Specify a Remote Syslog Server 50
Managing the vShield Edge Firewall 50
Create a vShield Edge Firewall Rule 50
Validate Active Sessions Against Current vShield Edge Firewall Rules 51
Manage NAT Rules 51
Manage DHCP Service 52
Manage VPN Service 53
Manage Load Balancer Service 55
Start or Stop vShield Edge Services 56
Upgrade vShield Edge Software 56

VMware, Inc. 5
vShield App and vShield Endpoint
11 vShield App Management 59
Send vShield App System Events to a Syslog Server 59
Back Up the Running CLI Configuration of a vShield App 60
View the Current System Status of a vShield App 60
Force a vShield App to Synchronize with the vShield Manager 60
Restart a vShield App 61
View Traffic Statistics by vShield App Interface 61
12 Flow Monitoring 63
Using Flow Monitoring 63
View a Specific Application in the Flow Monitoring Charts 64
Change the Date Range of the Flow Monitoring Charts 64
View the Flow Monitoring Report 64
Add an App Firewall Rule from the Flow Monitoring Report 65
Delete All Recorded Flows 66
Editing Port Mappings 66
Add an Application-Port Pair Mapping 66
Delete an Application-Port Pair Mapping 67
Hide the Port Mappings Table 67
13 App Firewall Management 69
Using App Firewall 69
Securing Containers and Designing Security Groups 69
Default Rules 70
Layer 4 Rules and Layer 2/Layer 3 Rules 70
Hierarchy of App Firewall Rules 70
Planning App Firewall Rule Enforcement 70
Create an App Firewall Rule 71
Create a Layer 2/Layer 3 App Firewall Rule 73
Creating and Protecting Security Groups 73
Add a Security Group 73
Assign Resources to a Security Group 74
Validating Active Sessions against the Current App Firewall Rules 74
Revert to a Previous App Firewall Configuration 75
Delete an App Firewall Rule 75
Using SpoofGuard 75
SpoofGuard Screen Options 76
Enable SpoofGuard 76
Approve IP Addresses 76
Edit an IP Address 77
Delete an IP Address 77
14 vShield Endpoint Events and Alarms 79
View vShield Endpoint Status 79
Alarms 80
Host Alarms 80
SVM Alarms 80
VM Alarms 81
Events 81
Audit Messages 84

VMware, Inc. 6
Appendixes
ACommand Line Interface 87
Logging In and Out of the CLI 87
CLI Command Modes 87
CLI Syntax 88
Moving Around in the CLI 88
Getting Help within the CLI 89
Securing CLI User Accounts and the Privileged Mode Password 89
Add a CLI User Account 89
Delete the admin User Account from the CLI 90
Change the CLI Privileged Mode Password 90
Command Reference 91
Administrative Commands 91
CLI Mode Commands 92
Configuration Commands 95
Debug Commands 102
Show Commands 107
Diagnostics and Troubleshooting Commands 123
User Administration Commands 126
Terminal Commands 128
Deprecated Commands 129
BTroubleshooting 131
Troubleshooting vShield Manager Installation 131
vShield OVA File Extracted to a PC Where vSphere Client Is Not Installed 131
vShield OVA File Cannot Be Installed in vSphere Client 131
Cannot Log In to CLI After the vShield Manager Virtual Machine Starts 132
Cannot Log In to the vShield Manager User Interface 132
Troubleshooting Operation Issues 132
vShield Manager Cannot Communicate with a vShield App 132
Cannot Configure a vShield App 132
Firewall Block Rule Not Blocking Matching Traffic 133
No Flow Data Displaying in Flow Monitoring 133
Troubleshooting Port Group Isolation Issues 133
Validate Installation of Port Group Isolation 133
Verify Install or Uninstall Script 134
Validate the Data Path 134
Details of the fence-util Utility 135
Troubleshooting vShield Edge Issues 136
Virtual Machines Are Not Getting IP Addresses from the DHCP Server 136
Load-Balancer Does Not Work 136
Load-Balancer Throws Error 502 Bad Gateway for HTTP Requests 137
VPN Does Not Work 137
Troubleshooting vShield Endpoint Issues 137
Thin Agent Logging 137
Component Version Compatibility 138
Index 139

VMware, Inc. 7
This manual, the vShield Administration Guide, describes how to install, configure, monitor, and maintain the
VMware®vShield™ system by using the vShield Manager user interface, the vSphere Client plug-in, and
command line interface (CLI). The information includes step-by-step configuration instructions, and
suggested best practices.
Intended Audience
This manual is intended for anyone who wants to install or use vShield in a VMware vCenter environment.
The information in this manual is written for experienced system administrators who are familiar with virtual
machine technology and virtual datacenter operations. This manual assumes familiarity with VMware
Infrastructure 4.x, including VMware ESX, vCenter Server, and the vSphere Client.
VMware Technical Publications Glossary
VMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For definitions
of terms as they are used in VMware technical documentation go to http://www.vmware.com/support/pubs.
Document Feedback
VMware welcomes your suggestions for improving our documentation. If you have comments, send your
feedback to [e-mail].
vShield Documentation
The following documents comprise the vShield documentation set:
vShield Administration Guide, this guide
vShield Quick Start Guide
vShield API Programming Guide
Technical Support and Education Resources
The following sections describe the technical support resources available to you. To access the current version
of this book and other books, go to http://www.vmware.com/support/pubs.
Online and Telephone Support
To use online support to submit technical support requests, view your product and contract information, and
register your products, go to http://www.vmware.com/support.
Customers with appropriate support contracts should use telephone support for the fastest response on
priority 1 issues. Go to http://www.vmware.com/support/phone_support.
About This Book

vShield Administration Guide
8VMware, Inc.
Support Offerings
To find out how VMware support offerings can help meet your business needs, go to
http://www.vmware.com/support/services.
VMware Professional Services
VMware Education Services courses offer extensive hands-on labs, case study examples, and course materials
designed to be used as on-the-job reference tools. Courses are available onsite, in the classroom, and live
online. For onsite pilot programs and implementation best practices, VMware Consulting Services provides
offerings to help you assess, plan, build, and manage your virtual environment. To access information about
education classes, certification programs, and consulting services, go to http://www.vmware.com/services.

VMware, Inc. 9
vShield Manager and vShield Zones

vShield Administration Guide
10 VMware, Inc.