VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Manuale Utente Scaricare il pdf (Pagina 71)

VMware, Inc. 71

vShieldAppprovidesfirewallprotectionthroughaccesspolicyenforcement.TheAppFirewalltabrepresents

thevShieldAppfirewallaccesscontrollist.

Thischapterincludesthefollowingtopics:

 “UsingAppFirewall”onpage 71

 “CreateanAppFirewallRule”onpage 73

 “CreateaLayer2/Layer3AppFirewallRule”onpage 75

 “CreatingandProtectingSecurityGroups”onpage 75

 “ValidatingActiveSessionsagainsttheCurrentAppFirewallRules”onpage 76

 “ReverttoaPreviousAppFirewallConfiguration”onpage 77

 “DeleteanAppFirewallRule”onpage 77

 “UsingSpoofGuard”onpage 77

Using App Firewall

TheAppFirewallserviceisacentralized,hierarchicalfirewallforESXhosts.AppFirewallenablesyouto

createrulesthatallowordenyaccesstoandfromyourvirtualmachines.EachinstalledvShieldAppenforces

theAppFirewallrules.

YoucanmanageAppFirewallrulesatthedatacenter,cluster,andport

grouplevelstoprovideaconsistentset

ofrulesacrossmultiplevShieldAppinstancesunderthesecontainers.Asmembershipinthesecontainerscan

changedynamically,AppFirewallmaintainsthestateofexistingsessionswithoutrequiringreconfiguration

offirewallrules.Inthisway,AppFirewalleffectivelyhasacontinuousfootprintoneach

ESXhostunderthe

managedcontainers.

Securing Containers and Designing Security Groups

WhencreatingAppFirewallrules,youcancreaterulesbasedontraffictoorfromaspecificcontainerthat

encompassesalloftheresourceswithinthatcontainer.Forexample,youcancreatearuletodenyanytraffic

frominsideofaclusterthattargetsaspecificdestinationoutsideofthe

cluster.Youcancreatearuletodeny

anyincomingtrafficthatisnottaggedwithaVLANID.Whenyouspecifyacontainerasthesourceor

destination,allIPaddresseswithinthatcontainerareincludedintherule.

App Firewall Management

NOTEAppFirewallrulesapplytovShieldAppinstances,butnotvShieldEdgeorvShieldEndpointinstances.

TheZonesFirewalltabbecomestheAppFirewalltabwhenthevShieldApplicenseisactivated.

1 2 ... 66 67 68 69 70 71 72 73 74 75 76 ... 161 162

Nessun commento

VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Manuale Utente Pagina 71