
VMware, Inc. 45
Chapter 5 vShield Edge Management
Ifaserviceconfigurationtagispresent,itmeansreplacetheconfiguration.Ifaserviceconfigurationtag’sblock
isempty,itmeansdeletetheconfiguration.Ifaserviceconfigurationtagisabsent,itmeansdonotchange
anything,andhencethepreviousconfigurationforthatserviceisretainedasis.
Example 5-6. Change configuration of a vShield Edge
Request:
POST https://<vsm-ip>/api/2.0/networks/<internal-portgroup-vc-moref-id>/edge
RequestBody:
seeexamplesbelow.
Install vShield Edge
ThepostcallconfiguresavShieldEdge,asdescribein“InstallingavShieldEdge”onpage 39.
Delete vShield Edge
ThedeletecalluninstallsvShieldEdge,asdescribedin“UninstallingavShieldEdge”onpage 42.
Configuring Edge Services
YouconfigureEdgeservicessuchasNAT,Firewall,DHCP,staticrouting.LoadBalancer,andVPNwiththe
APIshowninExample 5‐6.ThefollowingrequestbodiesshowvariousconfigurationsmadeonvShieldEdge.
Configure DHCP
vShieldEdgeprovidesDHCPservicetobindassignedIPaddressestoMACaddresses,helpingtoprevent
MACspoofingattacks.AllvirtualmachinesprotectedbyavShieldEdgecanobtainIPaddressesdynamically
fromthevShieldEdgeDHCPservice.
vShieldEdgesupportsIPaddresspoolingandone‐to‐onestaticIPaddress
allocationbasedonthevCenter
managedobjectID(vmId)andinterfaceID(interfaceId)oftherequestingclient.AllDHCPsettings
configuredbyRESTrequestsappearunderthevShieldEdge>DHCPtabfortheappropriatevShieldEdgein
thevShieldMana ge ruserinterf a c eandinvSphereClient plug‐in.
vShieldEdgeDHCPserviceadherestothefollowingrules:
ListensonthevShieldEdgeinternalinterface(non‐uplinkinterface)forDHCPdiscovery.
Asstatedabove,vmIDspecifiesthevc-moref-idofthevirtualmachine,andinterfaceIdspecifiesthe
indexofthevNicfortherequestingclient.ThehostNameisanidentificationofthebindingbeingcreated.
ThishostNameisnotpushedasthespecifiedhostnameofthevirtualmachine.
Bydefault,allclientsusetheIPaddressoftheinternalinterfaceofthevShieldEdgeasthedefaultgateway
address.Tooverrideit,specifydefaultGwundertheconfigParamsInterface,perbindingorperpool.
Theclient’sbroadcastandsubnetMaskvaluesarefromtheinternalinterfaceforthecontainernetwork.
configParamsanditselementsareoptional.
leaseTimecanbeinfinite,oranumberofseconds.Ifnotspecified,thedefaultleasetimeis1day.
Loggingisdisabledbydefault.Toenablelogging,adda<log/>elementwithinthe<dhcpConfig>block.
FortheDHCPschema,see“vShieldEdgeSchemas”onpage 116.SampleXMLrequestbody:
Example 5-7. Configure DHCP service
POST https://<vsm-ip>/api/2.0/networks/<internal-portgroup-vc-moref-id>/edge
IMPORTANTWhenyouconfigureavShieldEdgeservice,theserviceisstartedontheappliance.Ifyoudonot
wanttheservicerunning,youmuststoptheserviceusinganappropriatesystemcommand.
Commentaires sur ces manuels