
VMware, Inc. 17
Chapter 3 ESX Host Preparation for vShield App, Endpoint, and Isolation
Afterinstallationofallcomponentsiscomplete,dothefollowing:
vShieldApp:Atthispoint,vShieldAppinstallationiscomplete.EachvShieldAppinheritsglobal
firewallrulessetinthevShieldManager.Thedefaultfirewallrulesetallowsalltraffictopass.Youmust
configureblockingrulestoexplicitlyblocktraffic.ToconfigureAppFirewallrules,see“Configuring
FirewallRules
foravCenterContainer”onpage 51.
PortGroupIsolation:YoumustenablethePortGroupIsolationfeatureoneachvDS.Afterenablement
iscomplete,installavShieldEdgeoneachportgroup.See“vNetworkPreparationandvShieldEdge
Installation”onpage 19.
vShieldEndpoint:Tocompleteinstallation,see“vShieldEndpointManagement”onpage 61.
YoucaninstallasingleservicebyidentifyingonlythatserviceinthePOSTbody.InExample 3‐2,onlyvShield
Appisinstalled,asidentifiedbyinclusionoftheVszInstallParamselementonly.
Example 3-2. Installing a vShield App Only
Request:
POST <vshield_manager-uri>/api/1.0/vshield/<host-id>/vsz
Example:
POST /api/1.0/vshield/host-5126 HTTP/1.1
Content-type: application/xml; charset=UTF-8
Authorization: Basic YWRtaW46ZGVmYXVsdA==
Cache-Control: no-cache
Pragma: no-cache
Host: 10.112.196.244
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
Content-Length: 368
<VshieldConfiguration><VszInstallParams><DatastoreId>datastore-5131</DatastoreId>
<ManagementPortSwitchId>network-5134</ManagementPortSwitchId><MgmtInterface>
<IpAddress>10.112.196.245</IpAddress><NetworkMask>255.255.252.0</NetworkMask>
<DefaultGw>10.112.199.253</DefaultGw></MgmtInterface></VszInstallParams>
<InstallAction>install</InstallAction></VshieldConfiguration>
Get the Installation Status of vShield Services on an ESX Host
YoucanretrievetheinstallationoruninstallationstatusofvShieldservicesonanESXhosttotrackprogressas
completeornotinitiated.Ifneitheroftheseoperationsisinprogress,theresponseincludesthelistofinstalled
servicesontheESXhost.
Example 3-3. Getting vShield Service Installation Status on an ESX Host
Request:
GET <vshield_manager-uri>/api/1.0/vshield/<host-id>
CAUTIONDonotinstallvShieldZones/AppontheESXhostwherevCenterServerisrunning.
Commentaires sur ces manuels