VMware VSHIELD APP 1.0 - API Instrucciones de funcionamiento

vShield API Programming Guide

vShield Manager 4.1

vShield App 1.0

vShield Edge 1.0

vShield Endpoint 1.0

This document supports the version of each product listed and

supports all subsequent versions until the document is replaced

by a new edition. To check for more recent editions of this

document, see http://www.vmware.com/support/pubs.

EN-000434-00

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

2VMware, Inc.

vShield API Programming Guide

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

intellectual property laws. VMware products are covered by one or more patents listed at

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks

and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3

Contents

AboutThisBook 7

1OverviewofVMwarevShield 9

vShieldComponents 9

vShieldManager 9

vShieldApp 9

vShieldEdge 10

vShieldEndpoint 10

PortsRequiredforvShield 10

AnIntroductiontoRESTAPIforvShieldUsers 10

HowRESTWorks 10

UsingREST 10

vShieldAPIConventions 11

RESTfulWorkflowPatterns 12

ForMoreInformationAboutREST 13

2vShieldManagerManagement 15

SynchronizethevShieldManagerwithvCenterServerandDNS 15

RetrievingTechSupportLogs 16

GetthevShieldManagerTechnicalSupportLogFilePath 16

GetthevShieldEdgeTechnicalSupportLogFilePath 16

3ESXHostPreparationforvShieldApp,Endpoint,andIsolation 17

InstalltheLicensesforvShieldEdge,vShieldApp,andvShieldEndpoint 17

InstallvShieldApp,vShieldEndpoint,andPortGroupIsolationServicesonanESXHost 17

GettheInstallationStatusofvShieldServicesonanESXHost 19

UninstallingvShieldServicesfromanESXHost 20

4vNetworkPreparationandvShieldEdgeInstallation 21

EnablingPortGroupIsolation 21

EnablePortGroupIsolationonavDS 22

GetthePortGroupIsolationDebugStatisticsfromanESXHost 22

DisablePortGroupIsolationonavDS 22

InstallingavShieldEdge 23

GettheInstallParametersofavShieldEdge 24

UninstallavShieldEdge 24

5vShieldEdgeManagement 25

ForceavShieldEdgetoSynchronizewiththevShieldManager 26

ManageCLICredentialsonavShieldEdge 26

ManagingDHCP 26

GettheDHCPServerStatus 27

Start,Stop,orRestarttheDHCPService 27

PostaDHCPConfiguration 27

GettheConfigurationforAllDHCPHostsandPools 28

GetTimestampsofLast10DHCPConfigurations 28

GetaDHCPConfigurationbyTimestamp 28

vShield API Programming Guide

4VMware, Inc.

ReverttoaDHCPConfigurationbyTimestamp 29

DeletetheDHCPConfigurationonavShieldEdge 29

ManagingNAT 29

ManagingSNATRules 29

GettheSNATRuleSet 29

PostanSNATRuleSet 30

GetTimestampsofLast10SNATRuleConfigurationsforavShieldEdge 31

GetSNATConfigurationbySnapshotTimestamp 31

ReverttoanSNATConfigurationbySnapshotTimestamp 31

DeleteAllSNATRulesonavShieldEdge 32

ManagingDNATRules 32

GettheDNATRuleSet 32

PostaDNATRuleSet 32

GetTimestampsofLast10DNATRuleConfigurationsforavShieldEdge 34

GetDNATConfigurationbySnapshotTimestamp 34

ReverttoanDNATConfigurationbySnapshotTimestamp 34

DeleteAllDNATRules 35

ConfiguringthevShieldEdgeFirewall 35

GettheFirewallRuleSetforavShieldEdge 35

PostaFirewallRuleSet 35

GettheStatusoftheDefaultPolicyforavShieldEdge 37

ChangetheDefaultFirewallPolicyAction 37

GetDetailsofaSpecificFirewallRule 37

GetTimestampsofLast10FirewallRuleSetsforavShieldEdge 38

GetFirewallRuleSetbyTimestamp 38

ReverttoaFirewallRuleSetbyTimestamp 38

DeleteAllFirewallRulesonavShieldEdge 38

ConfiguringVPNs 39

GettheStatusofVPNService 39

StartorStoptheVPNServiceonavShieldEdge 40

ConfigureVPNParametersonavShieldEdge 40

AddaRemoteSite 41

AddTunnelsforaVPNSite 42

GettheDetailedIPSecConfigurationsforaNetwork 42

GettheDetailedConfigurationforaVPNSite 42

GettheDetailedTunnelConfiguration 43

DeleteaTunnelforaVPNSite 43

DeleteaRemoteSite 43

GettheCurrentVPNConfigurationonavShieldEdge 43

GetTimestampsofLast10VPNConfigurations 44

GetaVPNConfigurationbyTimestamp 44

ReverttoaVPNConfigurationbyTimestamp 44

DeletetheVPNConfigurationonavShieldEdge 44

LoadBalancer 45

GettheStatusofLoadBalancerServiceonavShieldEdge 45

StartorStoptheLoadBalancerServiceonavShieldEdge 46

AddaListenerforLoadBalancingService 46

GettheCurrentLoadBalancerConfigurationonavShieldEdge 47

GettheConfigurationofaSpecificLoadBalancingServer 47

GetTimestampsofLast10LoadBalancerConfigurations 47

GetaLoadBalancerConfigurationbyTimestamp 48

ReverttoaLoadBalancerConfigurationbyTimestamp 48

DeletetheLoadBalancerConfigurationonavShieldEdge 48

ManagingtheMTUThresholdforavShieldEdge 48

ViewTrafficStatistics 49

VMware, Inc. 5

DebugvShieldEdgeServicesUsingServiceStatistics 49

ManagingtheConnectiontoaSyslogServer 50

PostaSyslogServerConfiguration 50

GettheCurrentSyslogServerConfiguration 50

GetTimestampsofLast10SyslogServerConfigurations 50

GetaSyslogServerConfigurationbyTimestamp 51

ReverttoaSyslogServerConfigurationbyTimestamp 51

DeletetheCurrentSyslogServerConfiguration 51

6vShieldAppManagement 53

ConfiguringFirewallRulesforavCenterContainer 53

ViewAllFirewallRulesforaContainer 53

PostanAppFirewallRuleSetforaContainer 54

ViewaListofTimestampsIdentifyingAppFirewallRuleSetChanges 57

ViewaPreviousFirewallRuleSetbyTimestamp 57

ReverttoaPreviousFirewallRuleSet 57

DeleteAllFirewallRulesunderaContainer 58

ManagingSecurityGroups 58

AddaSecurityGroup 58

AddaVirtualMachinetoaSecurityGroup 59

GettheListofAllSecurityGroupsunderaBaseNode 60

GettheDetailsforaSingleSecurityGroupunderaBaseNode 60

GetIPAddressesfortheVirtualMachinesinaSecurityGroup 60

GetthePropertiesfromaVirtualMachine 60

DeleteaVirtualMachinefromaSecurityGroup 61

DeleteaSingleSecurityGroup 61

DeleteAllSecurityGroupsunderaBaseNode 61

ConfiguringSyslogServiceforavShieldApp 62

7vShieldEndpointManagement 63

RetrieveSVM‐SpecificNetworkInformation 64

RetrievevShieldEndpointServiceStatusonanESXHost 65

UninstallingthevShieldEndpointServicefromanESXHost 65

UnregisteranSVMfromvShieldEndpoint 65

UninstallvShieldEndpointfromthevShieldManager 66

ErrorSchema 66

8Appendix:RESTAPISchemas 67

vShieldManagerSchemas 67

vShieldManagertovCenterServerSynchronizationSchema 67

DNSServiceSchema 68

VirtualMachineInformationSchema 68

SecurityGroupsSchema 69

ESXHostPreparationandUninstallationSchema 70

vShieldAppSchemas 71

vShieldAppConfigurationSchema 71

vShieldAppFirewallSchema 72

PortGroupIsolationManagementSchema 73

PortGroupIsolationStatisticsSchema 74

vShieldEdgeSchemas 74

BasevShieldEdgeConfigurationSchema 74

vShieldEdgeInstallationSchema 74

vShieldEdgeGlobalConfigurationSchema 75

vShieldEdgeCLILoginCredentialsSchema 76

VMware, Inc. 6

vShieldEdgeFirewallSchema 77

NATSchema 79

DHCPSchema 81

VPNSchema 83

LoadBalancerSchema 86

MTUThresholdSchema 87

TrafficStatsSchema 87

SyslogSchema 88

ErrorMessageSchema 89

Index 91

VMware, Inc. 7

Thismanual,thevShieldAPIProgrammingGuide,describeshowtoinstall,configure,monitor,andmaintainthe

VMware®vShield™systembyusingRESTAPIrequests.Theinformationincludesstep‐by‐stepconfiguration

instructionsandexamples.

Intended Audience

ThismanualisintendedforanyonewhowantstouseRESTAPItoinstallorusevShieldinaVMware

vCenter™environment.Theinformationinthismanualiswrittenforexperiencedsystemadministratorswho

arefamiliarwithvirtualmachinetechnologyandvirtualdatacenteroperations.Thismanualassumes

familiaritywithvShield.

VMware Technical Publications Glossary

VMwareTechnicalPublicationsprovidesaglossaryoftermsthatmightbeunfamiliartoyou.Fordefinitions

oftermsastheyareusedinVMwaretechnicaldocumentationgotohttp://www.vmware.com/support/pubs.

Document Feedback

VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhavecomments,sendyour

feedbacktodocfeedback@vmware.com.

vShield Documentation

ThefollowingdocumentscomprisethevShielddocumentationset:

vShieldAdministrationGuide

vShieldQuickStartGuide

vShieldAPIProgrammingGuide,thisguide

Technical Support and Education Resources

Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversion

ofthisbookandotherbooks,gotohttp://www.vmware.com/support/pubs.

Online and Telephone Support

Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and

Customerswithappropriatesupportcontractsshouldusetelephonesupportforthefastestresponseon

priority1issues.Gotohttp://www.vmware.com/support/phone_support.

About This Book

vShield API Programming Guide

8VMware, Inc.

Support Offerings

TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto

http://www.vmware.com/support/services.

VMware Professional Services

VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials

designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive

online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides

offeringsto helpyouassess,plan,build,andmanageyourvirtualenvironment.Toaccessinformationabout

educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.

VMware, Inc. 9

VMware®vShield™isasuiteofnetworkedgeandapplication‐awarefirewallsbuiltforVMwarevCenter™

Serverintegration.vShieldinspectsclient‐servercommunicationsandinter‐virtual‐machinecommunication

toprovidedetailedtrafficanalyticsandapplication‐awarefirewallprotection.vShieldisacriticalsecurity

componentforprotectingvirtualizeddatacentersfromattacksandmisusehelpingyouachieveyour

compliance‐mandatedgoals.

ThisguideassumesyouhaveadministratoraccesstotheentirevShieldsystem.Ifyouareunabletoaccessa

screenorperformaparticulartask,consultyourvShieldadministrator.

Thischapterincludesthefollowingtopics:

“vShieldComponents”onpage 9

“PortsRequiredforvShield”onpage 10

“A n IntroductiontoRESTAPIforvShieldUsers”onpage 10

vShield Components

vShieldincludescomponentsandservicesessentialforprotectingvirtualmachines.vShieldcanbeconfigured

throughaweb‐baseduserinterface,acommandlineinterface(CLI),andRESTAPI.

TorunvShield,youneedonevShieldManagervirtualmachineandatleastonevShieldZones,vShieldApp,

orvShieldEdgevirtualmachine.

vShield Manager

ThevShieldManageristhecentralizedmanagementcomponentofvShieldandisinstalledfromOVAasa

virtualmachinebyusingthevSphereClient.UsingthevShieldManageruserinterfaceorvSphereClient

plug‐in,administratorscaninstall,configure,andmaintainvShieldcomponents.

ThevShieldManagervirtualmachinecanrunonadifferentESXhostfromyourvShieldAppandvShield

Edgevirtualmachines.

ThevShieldManageruserinterfaceleveragestheVMwareInfrastructureSDKtodisplayacopyofthevSphere

Clientinventorypanel.

FormoreontheusingthevShieldManageruserinterface,seethevShieldAdministrationGuide.

vShield App

AvShieldAppmonitorsalltrafficintoandoutofanESXhost,andbetweenvirtualmachinesonthehost.

vShieldAppprovidesapplication‐awaretrafficanalysisandstatefulfirewallprotection.vShieldApp

regulatestrafficbasedonasetofrules,similartoanaccesscontrollist(ACL).

Overview of VMware vShield 1

vShield API Programming Guide

10 VMware, Inc.

AstrafficpassesthroughavShieldApp,eachsessionheaderisinspectedtocatalogthedata.ThevShieldApp

createsaprofileforeachvirtualmachinedetailingtheoperatingsystem,applications,andportsusedin

networkcommunication.Basedonthisinformation,thevShieldAppallowsephemeralportusageby

permittingdynamicprotocolssuchasFTPandRPCtopassthrough,whilemaintaininglockdownonports

1024andhigher.

YoucannotprotecttheServiceConsoleorVMkernelwithavShieldAppbecausethesecomponentsarenot

virtualmachines.

vShield Edge

AvShieldEdgeprovidesnetworkedgesecuritytoprotectthevirtualmachinesinavCloudtenant’snetwork

fromattacksoriginatingfromthepublicnetwork.ThevShieldEdgeconnectstheisolated,privatenetworksof

cloudtenantstothepublicsideoftheserviceprovidernetworkthroughcommonedgeservicessuchasDHCP,

VPN,NAT,andloadbalancing.

YouinstallavShieldEdgefromthevShieldManager.YoucaninstallonevShieldEdgeinstancepertenantport

grouponavNetworkDistributedSwitch(vDS).

YouconfigureavShieldEdgebyusingRESTAPI.

vShield Endpoint

vShieldEndpointdeliversanintrospection‐basedantivirussolution.vShieldEndpointusesthehypervisorto

scanguestvirtualmachinesfromtheoutsidewithoutabulkyagent.vShieldEndpointisefficientinavoiding

resourcebottleneckswhileoptimizingmemoryuse.

Ports Required for vShield

ThevShieldManagerrequiresports80/TCPand443/TCPforRESTAPIrequests.

An Introduction to REST API for vShield Users

REST,anacronymforRepresentationalStateTransfer,isatermthathasbeenwidelyemployedtodescribean

architecturalstylecharacteristicofprogramsthatrelyontheinherentpropertiesofhypermediatocreateand

modifythestateofanobjectthatisaccessibleataURL.

How REST Works

OnceaURLofsuchanobjectisknowntoaclient,theclientcanuseanHTTPGETrequesttodiscoverthe

propertiesoftheobject.ThesepropertiesaretypicallycommunicatedinastructureddocumentwithanHTTP

Content‐TypeofXMLorJSON,thatprovidesarepresentationofthestateoftheobject.InaRESTfulworkflow,

documents(representationsofobjectstate)arepassedbackandforth(transferred)betweenaclientanda

servicewiththeexplicitassumptionthatneitherpartyneedknowanythingaboutanentityotherthanwhatis

presentedinasinglerequestorresponse.TheURLsatwhichthesedocumentsareavailableareoften“sticky,”

inthattheypersistbeyondthelifetimeoftherequestorresponsethatincludesthem.Theothercontentofthe

documentsisnominallyvaliduntiltheexpirationdatenotedintheHTTPExpiresheader.

Using REST

RESTAPIusesHTTPrequests(whichareoftenexecutedbyascriptorotherhigher‐levellanguage)asaway

ofmakingwhatareessentiallyidempotentremoteprocedurecallsthatcreate,modify,ordeletetheobjects

definedbytheAPI.ThisRESTAPI(andothers)isdefinedbyacollectionofXMLdocumentsthatrepresent

theobjectsonwhichtheAPIoperates.Theoperationsthemselves(HTTPrequests)aregenerictoallHTTP

clients.

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Software de VMware

VMware

VMware VCLOUD SDK FOR JAVA 1.0 - DEVELOPER S GUIDE Manual de usuario

VMware

VMware VCLOUD DIRECTOR Manual de usuario

VMware

VMware VS4-STD-C - vSphere Standard - PC Hoja de instrucciones

VMware

VMware VFABRIC TC SERVER Manual de usuario

VMware

VMware SPRINGSOURCE HYPERIC HQ Manual de usuario

VMware

VMware VSHIELD APP 1.0.0 UPDATE 1 - API Manual

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.1 -... Manual de usuario

VMware

VMware ACE EN-000042-00 Manual de uso y cuidado

VMware

VMware VIEW 4.5 - GUIDE DE MISE A NIVEAU Manual de usuario

VMware

VMware VS4-ENT-PL-A - vSphere Enterprise Plus Manual de usuario

VMware

VMware VIEW 4.5 Guía de configuración rápida

VMware

VMware VC-SRM4-A - vCenter Site Recovery Manager Manual de instrucciones

VMware

VMware VIEW MANAGER 4.X - EXTENDING VIRTUAL MACHINE DELECTION WITH... Manual de usuario

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Instrucciones generales

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER Manual de usuario

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Manual de usuario

VMware

VMware vSphere 4 Manual de instalación y operación

VMware

VMware 454885-B21 - Lab Manager Standard Foundation... Manual de usuario

VMware

VMware COMPLIANCE CHECKER - DATASHEET FOR PCI DSS... Manual de usuario

VMware

VMware VSHIELD ENDPOINT Manual de usuario

VMware

VMware VCENTER CONFIGURATION MANAGER 5.3 Manual de usuario

VMware

VMware THINAPP 4.6 - MIGRATING APPLICATIONS TECHNICAL... Guía del usuario

VMware

VMware VCLOUD REQUEST MANAGER 1.0.0 Manual de usuario

VMware

VMware VSHIELD APP 1.0 - Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario