VMware VSHIELD APP 1.0 - API Manuel d'utilisateur télécharger pdf (Page 60)

vShield API Programming Guide

60 VMware, Inc.

Example 6-1. Retrieve the datacenter state

Example:

GET https://<vsm-ip>/api/2.0/app/firewall/datacenter-2/state

TheXMLresponserepresentstheDatacenterStateobject,containinganenumerationofdatacenterstatus.The

statecouldberegular,upgrading,migrating,backwardCompatible,orbackwardCompatibleReadyForSwitch.

Modify Datacenter State

YoucanchangethestateofadatacenteronlyifitisinthebackwardCompatibleReadyForSwitchstate.

Example 6-2. Change datacenter state to migrating

Example:

POST https://<vsm-ip>/api/2.0/app/firewall/datacenter-2/state

Configuring Firewall Rules for vCenter

TheprimaryfunctionofavShieldAppistoprovidefirewallprotectiononanESXhostbyinspectingeach

sessionandreturningdetailstothevShieldManager.Trafficdetailsincludesources,destinations,directionof

sessions,applications,andportsbeingused.Trafficdetailscanbeusedtocreatefirewallallowordeny

rules.

InthevShieldManageruserinterfaceorvSphereClientplug‐in,theAppFirewalltabcontainsthefirewall

rulesenforcedbyvShieldAppinstances.YoucanmanageAppFirewallrulesatthedatacenter,cluster,and

portgrouplevelstoprovideaconsistentsetofrulesacrossmultiplevShieldApp

instances.Asmembership

inthesecontainerscanchangedynamically,AppFirewallmaintainsthestateofexistingsessionswithout

requiringreconfigurationoffirewallrules.Inthisway,AppFirewalleffectivelyhasacontinuousfootprinton

eachESXhostunderthemanagedcontainers.

WhencreatingAppFirewallrules,youcancreategeneralrules

basedonincomingoroutgoingtrafficatthe

containerlev el.Forexample,youcancreatearuletodenyanytrafficfromout si de ofadatacenterthattargetsa

destinationwithinthedatacenter.Youcancreatearuletodenyanyincomingtrafficthatisnottaggedwitha

VLANID.

Allfirew allrulesconfiguredbyusingRESTrequestsappearundertheAppFirewalltabfortheapprop ria te 

containerinthevShieldManageruserinterfaceandvSphereClientplug‐in.

ForthecompletefirewallXMLschema,see“vShieldAppFirewallSchema”onpage 110.

Configuring the vShield App Firewall

Firewallprecedenceishierarchicalateachlevel.Atthedatacenterlevel,choicesareDEFAULT,HIGH,orLOW.

AttheclusteranddvPortgrouplevel,firewallprecedenceisoftensettoNONE.

EachvShieldAppenforcesthefirewallrulesintop‐to‐bottomordering.AvShieldAppcheckseachtraffic

sessionagainstthe

topruleinthefirewalltablebeforemovingdownthesubsequentrulesinthetable.Thefirst

ruleinthetablethatmatchesthetrafficparametersisenforced.SeethevShieldAdministrationGuideformore

informationaboutthehierarchyofvShieldAppfirewallrules.

Query Firewall Configuration

Youcanretrievethefirewallconfigurationassociatedwithadatacenter,cluster,ordvPortGroup.Thetemplate

fortheAPIisasfollows:

GET

https://<vsm-ip>/api/2.0/app/firewall/<context>/config?list=<L>&precedence=<P>&rulesType=<R>

&configId=<C>

Where

1 2 ... 55 56 57 58 59 60 61 62 63 64 65 ... 131 132

Commentaires sur ces manuels

Pas de commentaire

VMware VSHIELD APP 1.0 - API Manuel d'utilisateur Page 60

Commentaires sur ces manuels

Produits connexes et manuels pour Logiciel de gestion du système VMware VSHIELD APP 1.0 - API