VMware VSHIELD APP 1.0 - Bedienungsanleitung

vShield Quick Start Guide

vShield Manager 4.1

vShield Edge 1.0

vShield App 1.0

vShield Endpoint 1.0

This document supports the version of each product listed and

supports all subsequent versions until the document is replaced

by a new edition. To check for more recent editions of this

document, see http://www.vmware.com/support/pubs.

EN-000375-00

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

2VMware, Inc.

vShield Quick Start Guide

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

intellectual property laws. VMware products are covered by one or more patents listed at

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks

and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3

Contents

AboutThisBook 5

1IntroductiontovShield 7

vShieldComponentsataGlance 7

vShieldManager 7

vShieldZones 7

vShieldEdge 8

StandardvShieldEdgeServices(IncludingCloudDirector) 8

AdvancedvShieldEdgeServices 8

vShieldApp 9

vShieldEndpoint 9

DeploymentScenarios 10

ProtectingtheDMZ 10

IsolatingandProtectingInternalNetworks 10

ProtectingVirtualMachinesinaCluster 11

CommonDeploymentsofvShieldEdge 11

CommonDeploymentsofvShieldApp 11

2PreparingforInstallation 13

SystemRequirements 13

Hardware 13

Software 13

ClientandUserAccess 14

DeploymentConsiderations 14

PreparingVirtualMachinesforvShieldProtection 14

HowAreMyVirtualMachinesGrouped? 14

AreMyVirtualMachinesStillProtectedifIvMotionThemtoAnotherESXHost? 14

HowDoIIsolateaGroupofVirtualMachines? 15

vShieldManagerUptime 15

CommunicationBetweenvShieldComponents 15

HardeningYourvShieldVirtualMachines 15

vShieldManagerUserInterface 15

CommandLineInterface 15

RESTRequests 16

3InstallingthevShieldManagerandvShieldZones 17

ObtainthevShieldManagerOVAFile 17

InstallthevShieldManagerVirtualAppliance 17

ConfiguretheNetworkSettingsofthevShieldManager 18

LogIntothevShieldManagerUserInterface 19

SynchronizethevShieldManagerwiththevCenterServer 19

ChangethePasswordofthevShieldManagerUserInterfaceDefaultAccount 20

InstallvShieldZones 20

WheretoGoNext 21

vShield Quick Start Guide

4VMware, Inc.

4InstallingvShieldEdge,vShieldApp,andvShieldEndpoint 23

RunningvShieldinEvaluationMode 23

PreparingYourVirtualInfrastructureforvShieldApp,vShieldEdge,andvShieldEndpoint 23

InstallvShieldComponentLicenses 24

PrepareAllESXHosts 24

PrepareavNetworkforPortGroupIsolation 25

InstallavShieldEdge 25

InstallingvShieldEndpoint 27

vShieldEndpointInstallationWorkflow 27

InstalltheThinAgentontheGuestVirtualMachine 27

Prerequisites 27

WheretoGoNext 28

Index 29

VMware, Inc. 5

ThevShieldQuickStartGuideprovidesinformationaboutinstallingVMware®vShield™intoyourVMware

VirtualInfrastructureenvironment.

Intended Audience

ThisbookisintendedforanyonewhowantstoinstalloruseVMwarevShield.Theinformationinthisbookis

writtenforexperiencedWindowsorLinuxsystemadministratorswhoarefamiliarwithvirtualmachine

technologyanddatacenteroperations.ThisbookalsoassumesfamiliaritywithVMwareVirtual

Infrastructure,includingvCenter™Server4.x,VMwareESX™4.x,andthevSphereClient.

VMware Technical Publications Glossary

VMwareTechnicalPublicationsprovidesaglossaryoftermsthatmightbeunfamiliartoyou.Fordefinitions

oftermsastheyareusedinVMwaretechnicaldocumentationgotohttp://www.vmware.com/support/pubs.

Document Feedback

VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhavecomments,sendyour

feedbacktodocfeedback@vmware.com.

VMware Infrastructure Documentation

ThefollowingdocumentscomprisetheVMwarevShielddocumentationset:

vShieldAdministrationGuide

vShieldQuickStartGuide

vShieldAPIProgrammingGuide

YoushouldalsohaveaccesstothecombinedvCenterServerandESXdocumentationset.

Technical Support and Education Resources

Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversion

ofthisbookandotherbooks,gotohttp://www.vmware.com/support/pubs.

Online and Telephone Support

Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and

Customerswithappropriatesupportcontractsshouldusetelephonesupportforthefastestresponseon

priority1issues.Gotohttp://www.vmware.com/support/phone_support.

About This Book

vShield Quick Start Guide

6VMware, Inc.

Support Offerings

TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto

http://www.vmware.com/support/services.

VMware Professional Services

VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials

designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive

online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides

offeringsto helpyouassess,plan,build,andmanageyourvirtualenvironment.Toaccessinformationabout

educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.

VMware, Inc. 7

ThischapterintroducestheVMware®vShield™componentsyouinstall.

Thechapterincludesthefollowingtopics:

“vShieldComponentsataGlance”onpage 7

“DeploymentScenarios”onpage 10

vShield Components at a Glance

VMwarevShieldisasuiteofsecurityvirtualappliancesbuiltforVMwarevCenter™Serverintegration.

vShieldisacriticalsecuritycomponentforprotectingvirtualizeddatacentersfromattacksandmisusehelping

youachieveyourcompliance‐mandatedgoals.

vShieldincludesvirtualappliancesandservicesessentialforprotectingvirtualmachines.vShieldcanbe

configuredthroughaweb‐baseduserinterface,avSphereClientplug‐in,acommandlineinterface(CLI),and

RESTAPI.

vCenterServerincludesvShieldManagerandvShieldZones.ThefollowingvShieldpackageseachrequirea

license:

vShieldEdgewithPortGroupIsolation

vShieldApp

vShieldEndpoint

OnevShieldManagermanagesmultiplevShieldZones,vShieldEdge,vShieldApp,andvShieldEndpoint

instances.

vShield Manager

ThevShieldManageristhecentralizednetworkmanagementcomponentofvShield,andisinstalledasa

virtualapplianceonanyESX™hostinyourvCenterServerenvironment.AvShieldManagercanrunona

differentESXhostfromyourvShieldagents.

UsingthevShieldManageruserinterfaceorvSphereClientplug‐in,administratorsinstall,configure,and

maintainvShieldcomponents.ThevShieldManageruserinterfaceleveragestheVMwareInfrastructureSDK

todisplayacopyofthevSphereClientinventorypanel,andincludestheHosts&ClustersandNetworks

views.

vShield Zones

vShieldZonesprovidesfirewallprotectionfortrafficbetweenvirtualmachines.ForeachZonesFirewallrule,

youcanspecifythesourceIP,destinationIP,sourceport,destinationport,andservice.

Introduction to vShield 1

vShield Quick Start Guide

8VMware, Inc.

vShield Edge

vShieldEdgeprovidesnetworkedgesecurityandgatewayservicestoisolatethevirtualmachinesinaport

group,vDSportgroup,orCisco®Nexus1000V.ThevShieldEdgeconnectsisolated,stubnetworkstoshared

(uplink)networksbyprovidingcommongatewayservicessuchasDHCP,VPN,NAT,andLoadBalancing.

CommondeploymentsofvShieldEdgeincludeintheDMZ,VPNExtranets,andmulti‐tenantCloud

environmentswherethevShieldEdgeprovidesperimetersecurityforVirtualDatacenters(VDCs).

Standard vShield Edge Services (Including Cloud Director)

Firewall:SupportedrulesincludeIP5‐tupleconfigurationwithIPandportrangesforstatefulinspection

forTCP,UDP,andICMP.

NetworkAddressTranslation:SeparatecontrolsforSourceandDestinationIPaddresses,aswellasTCP

andUDPporttranslation.

DynamicHostConfigurationProtocol(DHCP):ConfigurationofIPpools,gateways,DNSservers,and

searchdomains.

Advanced vShield Edge Services

Site‐to‐SiteVirtualPrivateNetwork(VPN):UsesstandardizedIPsecprotocolsettingstointeroperatewith

allmajorfirewallvendors.

LoadBalancing:SimpleanddynamicallyconfigurablevirtualIPaddressesandservergroups.

vShieldEdgesupportssyslogexportforallservicestoremoteservers.

Figure 1-1. vShield Edge Installed to Secure a vDS Port Group

VMware, Inc. 9

Chapter 1 Introduction to vShield

vShield App

vShieldAppisaninterior,vNIC‐levelfirewallthatallowsyoutocreateaccesscontrolpoliciesregardlessof

networktopology.AvShieldAppmonitorsalltrafficinandoutofanESXhost,includingbetweenvirtual

machinesinthesameportgroup.vShieldAppincludestrafficanalysisandcontainer‐basedpolicycreation.

vShieldAppinstallsasahypervisormoduleandfirewallservicevirtualappliance.vShieldAppintegrates

withESXhoststhroughVMsafeAPIsandworkswithVMwarevSphereplatformfeaturessuchasDRS,

vMotion,DPM,andmaintenancemode.

vShieldAppprovidesfirewallingbetweenvirtualmachinesbyplacingafirewallfilteroneveryvirtual

networkadapter.Thefirewallfilteroperatestransparentlyanddoesnotrequirenetworkchangesor

modificationofIPaddressestocreatesecurityzones.YoucanwriteaccessrulesbyusingvCentercontainers,

likedatacenters,cluster,resourcepoolsandvApps,ornetworkobjects,likePortGroupsandVLANs,to

reducethenumberoffirewallrulesandmaketheruleseasiertotrack.

YoushouldinstallvShieldAppinstancesonallESXhostswithinaclustersothatVMwarevMotion™

operationsworkandvirtualmachinesremainprotectedastheymigratebetweenESXhosts.Bydefault,a

vShieldAppvirtualappliancecannotbemovedbyusingvMotion.

TheFlowMonitoringfeaturedisplaysallowedandblockednetworkflowsattheapplicationprotocollevel.

Youcanusethisinformationtoauditnetworktrafficandtroubleshootoperational.

vShield Endpoint

vShieldEndpointdeliversanintrospection‐basedantivirussolution.vShieldEndpointusesthehypervisorto

scanguestvirtualmachinesfromtheoutsidewithoutabulkyagent.vShieldEndpointisefficientinavoiding

resourcebottleneckswhileoptimizingmemoryuse.

vShieldEndpointinstallsasahypervisormoduleandsecurityvirtualappliancefromathird‐partyantivirus

vendor(VMwarepartners)onanESXhost.

Figure 1-2. vShield Endpoint Installed on an ESX Host

vShield Quick Start Guide

10 VMware, Inc.

Deployment Scenarios

UsingvShield,youcanbuildsecurezonesforavarietyofvirtualmachinedeployments.Youcanisolatevirtual

machinesbasedonspecificapplications,networksegmentation,orcustomcompliancefactors.Onceyou

determineyourzoningpolicies,youcandeployvShieldtoenforceaccessrulestoeachofthesezones.

Protecting the DMZ

TheDMZisamixedtrustzone.ClientsenterfromtheInternetforWebandemailservices,whileservices

withintheDMZmightrequireaccesstoservicesinsidetheinternalnetwork.YoucanplaceDMZvirtual

machinesinaportgroupandsecurethatportgroupwithavShieldEdge.vShieldEdgeprovidesaccess

servicessuchasfirewall,NAT,andVPN,aswellasloadbalancingtosecureDMZservices.

AcommonexampleofaDMZservicerequiringaninternalserviceisMicrosoftExchange.MicrosoftOutlook

WebAccess(OWA)commonlyresidesintheDMZcluster,whiletheMicrosoftExchangebackendisinthe

internalcluster.Ontheinternalcluster,youcancreatefirewallrulestoallowonlyExchanged‐relatedrequests

fromtheDMZ,identifyingspecificsource‐to‐destinationparameters.FromtheDMZcluster,youcancreate

rulestoallowoutsideaccesstotheDMZonlytospecificdestinationsusingHTTP,FTP,orSMTP.

Isolating and Protecting Internal Networks

YoucanuseavShieldEdgewiththePortGroupIsolationfeaturetoisolateaninternalnetworkfromthe

externalnetwork.AvShieldEdgeprovidesperimeterfirewallprotectionandedgeservicestosecurevirtual

machinesinaportgroup,enablingcommunicationtotheexternalnetworkthroughDHCP,NAT,andVPN.

Withinthesecuredportgroup,youcaninstallavShieldAppinstanceoneachESXhostthatthevDSspansto

securecommunicationbetweenvirtualmachinesintheinternalnetwork.

IfyouutilizeVLANtagstosegmenttraffic,youcanuseAppFirewalltocreatesmarteraccesspolicies.Using

AppFirewallinsteadofaphysicalfirewallallowsyoutocollapseormixtrustzonesinsharedESXclusters.By

doingso,yougainoptimalutilizationandconsolidationfromfeaturessuchasDRSandHA,insteadofhaving

separate,fragmentedclusters.ManagementoftheoverallESXdeploymentasasinglepoolislesscomplex

thanhavingseparatelymanagedpools.

Forexample,youuseVLANstosegmentvirtualmachinezonesbasedonlogical,organizational,ornetwork

boundaries.LeveragingtheVirtualInfrastructureSDK,thevShieldManagerinventorypaneldisplaysaview

ofyourVLANnetworksundertheNetworksview.YoucanbuildaccessrulesforeachVLANnetworkto

isolatevirtualmachinesanddropuntaggedtraffictothesemachines.

Andere Handbücher für VSHIELD APP 1.0 -

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere VMware Software Handbücher

VMware

VMware vSphere 4 Bedienungsanleitung

VMware

VMware VCLOUD SDK 1.0 - FOR NET DEVELOPERS GUIDE Bedienungsanleitung

VMware

VMware VCENTER CONVERTER EN-000158-02 Bedienungsanleitung

VMware

VMware VCLOUD API 1.0 - TECHNICAL NOTE Betriebsanleitung

VMware

VMware VCENTER CHARGEBACK 1.5 - API Leitfaden

VMware

VMware vSphere 4 Installations- und Betriebshandbuch

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Allgemeine Anweisungen

VMware

VMware VSPHERE 4.0 - SOFTWARE COMPATIBILITY MATRIX Bedienungsanleitung

VMware

VMware SUSE LINUX ENTERPRISE SERVER Bedienungsanleitung

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Bedienungsanleitung

VMware

VMware VCENTER CHARGEBACK Bedienungsanleitung

VMware

VMware FUS3-ENG-M-10-CP - Fusion For Mac OS X Bedienungsanleitung

VMware

VMware VSHIELD APP 1.0 - API Betriebsanleitung

VMware

VMware vSphere ESXi 4.0 Programmierhandbuch

VMware

VMware VCM 5.3 - RECOVERY GUIDE Bedienungsanleitung

VMware

VMware VIEW 4.5 - ARCHITECTURE PLANNING... Bedienungsanleitung

VMware

VMware VCLOUD SDK 1.0 - FOR NET DEVELOPERS GUIDE Bedienungsanleitung

VMware

VMware VFABRIC TC SERVER Bedienungsanleitung

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Bedienungsanleitung

VMware

VMware VFABRIC GEMFIRE Bedienungsanleitung

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER Bedienungsanleitung

VMware

VMware VIRTUALIZATION AND CLOUD MANAGEMENT Installationsanleitung

VMware

VMware VCLOUD REQUEST MANAGER 1.0.0 Bedienungsanleitung

VMware

VMware VCENTER CONFIGURATION MANAGER 5.3 Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Novell

Novell GROUPWISE 8 - INTERNET AGENT Bedienungsanleitung

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung