VMware VSHIELD APP 1.0 - Manual de usuario

vShield Quick Start Guide

vShield Manager 4.1

vShield Edge 1.0

vShield App 1.0

vShield Endpoint 1.0

This document supports the version of each product listed and

supports all subsequent versions until the document is replaced

by a new edition. To check for more recent editions of this

document, see http://www.vmware.com/support/pubs.

EN-000375-00

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

2VMware, Inc.

vShield Quick Start Guide

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

intellectual property laws. VMware products are covered by one or more patents listed at

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks

and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3

Contents

AboutThisBook 5

1IntroductiontovShield 7

vShieldComponentsataGlance 7

vShieldManager 7

vShieldZones 7

vShieldEdge 8

StandardvShieldEdgeServices(IncludingCloudDirector) 8

AdvancedvShieldEdgeServices 8

vShieldApp 9

vShieldEndpoint 9

DeploymentScenarios 10

ProtectingtheDMZ 10

IsolatingandProtectingInternalNetworks 10

ProtectingVirtualMachinesinaCluster 11

CommonDeploymentsofvShieldEdge 11

CommonDeploymentsofvShieldApp 11

2PreparingforInstallation 13

SystemRequirements 13

Hardware 13

Software 13

ClientandUserAccess 14

DeploymentConsiderations 14

PreparingVirtualMachinesforvShieldProtection 14

HowAreMyVirtualMachinesGrouped? 14

AreMyVirtualMachinesStillProtectedifIvMotionThemtoAnotherESXHost? 14

HowDoIIsolateaGroupofVirtualMachines? 15

vShieldManagerUptime 15

CommunicationBetweenvShieldComponents 15

HardeningYourvShieldVirtualMachines 15

vShieldManagerUserInterface 15

CommandLineInterface 15

RESTRequests 16

3InstallingthevShieldManagerandvShieldZones 17

ObtainthevShieldManagerOVAFile 17

InstallthevShieldManagerVirtualAppliance 17

ConfiguretheNetworkSettingsofthevShieldManager 18

LogIntothevShieldManagerUserInterface 19

SynchronizethevShieldManagerwiththevCenterServer 19

ChangethePasswordofthevShieldManagerUserInterfaceDefaultAccount 20

InstallvShieldZones 20

WheretoGoNext 21

vShield Quick Start Guide

4VMware, Inc.

4InstallingvShieldEdge,vShieldApp,andvShieldEndpoint 23

RunningvShieldinEvaluationMode 23

PreparingYourVirtualInfrastructureforvShieldApp,vShieldEdge,andvShieldEndpoint 23

InstallvShieldComponentLicenses 24

PrepareAllESXHosts 24

PrepareavNetworkforPortGroupIsolation 25

InstallavShieldEdge 25

InstallingvShieldEndpoint 27

vShieldEndpointInstallationWorkflow 27

InstalltheThinAgentontheGuestVirtualMachine 27

Prerequisites 27

WheretoGoNext 28

Index 29

VMware, Inc. 5

ThevShieldQuickStartGuideprovidesinformationaboutinstallingVMware®vShield™intoyourVMware

VirtualInfrastructureenvironment.

Intended Audience

ThisbookisintendedforanyonewhowantstoinstalloruseVMwarevShield.Theinformationinthisbookis

writtenforexperiencedWindowsorLinuxsystemadministratorswhoarefamiliarwithvirtualmachine

technologyanddatacenteroperations.ThisbookalsoassumesfamiliaritywithVMwareVirtual

Infrastructure,includingvCenter™Server4.x,VMwareESX™4.x,andthevSphereClient.

VMware Technical Publications Glossary

VMwareTechnicalPublicationsprovidesaglossaryoftermsthatmightbeunfamiliartoyou.Fordefinitions

oftermsastheyareusedinVMwaretechnicaldocumentationgotohttp://www.vmware.com/support/pubs.

Document Feedback

VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhavecomments,sendyour

feedbacktodocfeedback@vmware.com.

VMware Infrastructure Documentation

ThefollowingdocumentscomprisetheVMwarevShielddocumentationset:

vShieldAdministrationGuide

vShieldQuickStartGuide

vShieldAPIProgrammingGuide

YoushouldalsohaveaccesstothecombinedvCenterServerandESXdocumentationset.

Technical Support and Education Resources

Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversion

ofthisbookandotherbooks,gotohttp://www.vmware.com/support/pubs.

Online and Telephone Support

Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and

Customerswithappropriatesupportcontractsshouldusetelephonesupportforthefastestresponseon

priority1issues.Gotohttp://www.vmware.com/support/phone_support.

About This Book

vShield Quick Start Guide

6VMware, Inc.

Support Offerings

TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto

http://www.vmware.com/support/services.

VMware Professional Services

VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials

designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive

online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides

offeringsto helpyouassess,plan,build,andmanageyourvirtualenvironment.Toaccessinformationabout

educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.

VMware, Inc. 7

ThischapterintroducestheVMware®vShield™componentsyouinstall.

Thechapterincludesthefollowingtopics:

“vShieldComponentsataGlance”onpage 7

“DeploymentScenarios”onpage 10

vShield Components at a Glance

VMwarevShieldisasuiteofsecurityvirtualappliancesbuiltforVMwarevCenter™Serverintegration.

vShieldisacriticalsecuritycomponentforprotectingvirtualizeddatacentersfromattacksandmisusehelping

youachieveyourcompliance‐mandatedgoals.

vShieldincludesvirtualappliancesandservicesessentialforprotectingvirtualmachines.vShieldcanbe

configuredthroughaweb‐baseduserinterface,avSphereClientplug‐in,acommandlineinterface(CLI),and

RESTAPI.

vCenterServerincludesvShieldManagerandvShieldZones.ThefollowingvShieldpackageseachrequirea

license:

vShieldEdgewithPortGroupIsolation

vShieldApp

vShieldEndpoint

OnevShieldManagermanagesmultiplevShieldZones,vShieldEdge,vShieldApp,andvShieldEndpoint

instances.

vShield Manager

ThevShieldManageristhecentralizednetworkmanagementcomponentofvShield,andisinstalledasa

virtualapplianceonanyESX™hostinyourvCenterServerenvironment.AvShieldManagercanrunona

differentESXhostfromyourvShieldagents.

UsingthevShieldManageruserinterfaceorvSphereClientplug‐in,administratorsinstall,configure,and

maintainvShieldcomponents.ThevShieldManageruserinterfaceleveragestheVMwareInfrastructureSDK

todisplayacopyofthevSphereClientinventorypanel,andincludestheHosts&ClustersandNetworks

views.

vShield Zones

vShieldZonesprovidesfirewallprotectionfortrafficbetweenvirtualmachines.ForeachZonesFirewallrule,

youcanspecifythesourceIP,destinationIP,sourceport,destinationport,andservice.

Introduction to vShield 1

vShield Quick Start Guide

8VMware, Inc.

vShield Edge

vShieldEdgeprovidesnetworkedgesecurityandgatewayservicestoisolatethevirtualmachinesinaport

group,vDSportgroup,orCisco®Nexus1000V.ThevShieldEdgeconnectsisolated,stubnetworkstoshared

(uplink)networksbyprovidingcommongatewayservicessuchasDHCP,VPN,NAT,andLoadBalancing.

CommondeploymentsofvShieldEdgeincludeintheDMZ,VPNExtranets,andmulti‐tenantCloud

environmentswherethevShieldEdgeprovidesperimetersecurityforVirtualDatacenters(VDCs).

Standard vShield Edge Services (Including Cloud Director)

Firewall:SupportedrulesincludeIP5‐tupleconfigurationwithIPandportrangesforstatefulinspection

forTCP,UDP,andICMP.

NetworkAddressTranslation:SeparatecontrolsforSourceandDestinationIPaddresses,aswellasTCP

andUDPporttranslation.

DynamicHostConfigurationProtocol(DHCP):ConfigurationofIPpools,gateways,DNSservers,and

searchdomains.

Advanced vShield Edge Services

Site‐to‐SiteVirtualPrivateNetwork(VPN):UsesstandardizedIPsecprotocolsettingstointeroperatewith

allmajorfirewallvendors.

LoadBalancing:SimpleanddynamicallyconfigurablevirtualIPaddressesandservergroups.

vShieldEdgesupportssyslogexportforallservicestoremoteservers.

Figure 1-1. vShield Edge Installed to Secure a vDS Port Group

VMware, Inc. 9

Chapter 1 Introduction to vShield

vShield App

vShieldAppisaninterior,vNIC‐levelfirewallthatallowsyoutocreateaccesscontrolpoliciesregardlessof

networktopology.AvShieldAppmonitorsalltrafficinandoutofanESXhost,includingbetweenvirtual

machinesinthesameportgroup.vShieldAppincludestrafficanalysisandcontainer‐basedpolicycreation.

vShieldAppinstallsasahypervisormoduleandfirewallservicevirtualappliance.vShieldAppintegrates

withESXhoststhroughVMsafeAPIsandworkswithVMwarevSphereplatformfeaturessuchasDRS,

vMotion,DPM,andmaintenancemode.

vShieldAppprovidesfirewallingbetweenvirtualmachinesbyplacingafirewallfilteroneveryvirtual

networkadapter.Thefirewallfilteroperatestransparentlyanddoesnotrequirenetworkchangesor

modificationofIPaddressestocreatesecurityzones.YoucanwriteaccessrulesbyusingvCentercontainers,

likedatacenters,cluster,resourcepoolsandvApps,ornetworkobjects,likePortGroupsandVLANs,to

reducethenumberoffirewallrulesandmaketheruleseasiertotrack.

YoushouldinstallvShieldAppinstancesonallESXhostswithinaclustersothatVMwarevMotion™

operationsworkandvirtualmachinesremainprotectedastheymigratebetweenESXhosts.Bydefault,a

vShieldAppvirtualappliancecannotbemovedbyusingvMotion.

TheFlowMonitoringfeaturedisplaysallowedandblockednetworkflowsattheapplicationprotocollevel.

Youcanusethisinformationtoauditnetworktrafficandtroubleshootoperational.

vShield Endpoint

vShieldEndpointdeliversanintrospection‐basedantivirussolution.vShieldEndpointusesthehypervisorto

scanguestvirtualmachinesfromtheoutsidewithoutabulkyagent.vShieldEndpointisefficientinavoiding

resourcebottleneckswhileoptimizingmemoryuse.

vShieldEndpointinstallsasahypervisormoduleandsecurityvirtualappliancefromathird‐partyantivirus

vendor(VMwarepartners)onanESXhost.

Figure 1-2. vShield Endpoint Installed on an ESX Host

vShield Quick Start Guide

10 VMware, Inc.

Deployment Scenarios

UsingvShield,youcanbuildsecurezonesforavarietyofvirtualmachinedeployments.Youcanisolatevirtual

machinesbasedonspecificapplications,networksegmentation,orcustomcompliancefactors.Onceyou

determineyourzoningpolicies,youcandeployvShieldtoenforceaccessrulestoeachofthesezones.

Protecting the DMZ

TheDMZisamixedtrustzone.ClientsenterfromtheInternetforWebandemailservices,whileservices

withintheDMZmightrequireaccesstoservicesinsidetheinternalnetwork.YoucanplaceDMZvirtual

machinesinaportgroupandsecurethatportgroupwithavShieldEdge.vShieldEdgeprovidesaccess

servicessuchasfirewall,NAT,andVPN,aswellasloadbalancingtosecureDMZservices.

AcommonexampleofaDMZservicerequiringaninternalserviceisMicrosoftExchange.MicrosoftOutlook

WebAccess(OWA)commonlyresidesintheDMZcluster,whiletheMicrosoftExchangebackendisinthe

internalcluster.Ontheinternalcluster,youcancreatefirewallrulestoallowonlyExchanged‐relatedrequests

fromtheDMZ,identifyingspecificsource‐to‐destinationparameters.FromtheDMZcluster,youcancreate

rulestoallowoutsideaccesstotheDMZonlytospecificdestinationsusingHTTP,FTP,orSMTP.

Isolating and Protecting Internal Networks

YoucanuseavShieldEdgewiththePortGroupIsolationfeaturetoisolateaninternalnetworkfromthe

externalnetwork.AvShieldEdgeprovidesperimeterfirewallprotectionandedgeservicestosecurevirtual

machinesinaportgroup,enablingcommunicationtotheexternalnetworkthroughDHCP,NAT,andVPN.

Withinthesecuredportgroup,youcaninstallavShieldAppinstanceoneachESXhostthatthevDSspansto

securecommunicationbetweenvirtualmachinesintheinternalnetwork.

IfyouutilizeVLANtagstosegmenttraffic,youcanuseAppFirewalltocreatesmarteraccesspolicies.Using

AppFirewallinsteadofaphysicalfirewallallowsyoutocollapseormixtrustzonesinsharedESXclusters.By

doingso,yougainoptimalutilizationandconsolidationfromfeaturessuchasDRSandHA,insteadofhaving

separate,fragmentedclusters.ManagementoftheoverallESXdeploymentasasinglepoolislesscomplex

thanhavingseparatelymanagedpools.

Forexample,youuseVLANstosegmentvirtualmachinezonesbasedonlogical,organizational,ornetwork

boundaries.LeveragingtheVirtualInfrastructureSDK,thevShieldManagerinventorypaneldisplaysaview

ofyourVLANnetworksundertheNetworksview.YoucanbuildaccessrulesforeachVLANnetworkto

isolatevirtualmachinesanddropuntaggedtraffictothesemachines.

Otros manuales para VSHIELD APP 1.0 -

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Software de VMware

VMware

VMware VIEW 4.5 - GUIDE DE MISE A NIVEAU Manual de usuario

VMware

VMware VCM 5.3 - CONFIGURATION MANAGER SECURITY ENVIRONMENT... Guía rápida

VMware

VMware VSHIELD APP 1.0.0 UPDATE 1 - API Manual de usuario

VMware

VMware CONVERTER STANDALONE 4.3 Manual de usuario

VMware

VMware VSHIELD APP 1.0.0 UPDATE 1 - API Instrucciones de funcionamiento

VMware

VMware CLOUD DIRECTOR 1.0 Manual

VMware

VMware VmWare ESX Server 2.12 Deployment Guía de referencia rápida

VMware

VMware VSHIELD ENDPOINT Manual de usuario

VMware

VMware VCLOUD SDK 1.0 - FOR NET DEVELOPERS GUIDE Manual de usuario

VMware

VMware VCM 5.3 - TRANSPORT LAYER SECURITY... Manual de usuario

VMware

VMware APPSPEED SERVER 1.5 - VCENTER APPSPEED INSTALLATION... Manual de instalación y operación

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Manual de usuario

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Instrucciones generales

VMware

VMware VCM 5.3 Manual de usuario

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.0 Manual de usuario

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER Manual de usuario

VMware

VMware VCLOUD API 1.0 - TECHNICAL NOTE Instrucciones de funcionamiento

VMware

VMware VCENTER CAPACITYIQ 1.5 Manual de usuario

VMware

VMware vSphere 4 Manual de usuario

VMware

VMware VIEW 4.5 Manual de instalación y operación

VMware

VMware VIEW MANAGER 4.X - EXTENDING VIRTUAL MACHINE DELECTION WITH... Manual de usuario

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.1 -... Manual de usuario

VMware

VMware VCENTER CHARGEBACK 1.5 - API Manual de usuario

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.1 -... Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario