VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Manuel d'utilisateur télécharger pdf (Page 76)

vShield Administration Guide

76 VMware, Inc.

5Double‐clicktherowandtypeanameforthegroup.

6ClickAdd.

Aftersecuritygroupcreationiscomplete,assignresourcestothegroup.

Assign Resources to a Security Group

Youcanassignvirtualmachinesandnetworkadapterstoasecuritygroup.TheseresourceshaveassociatedIP

addressesthatdefinethesourceordestinationparametersforwhichanAppFirewallruleenforcesanaccess

policy.

To assign resources to a security group

1ClickadatacenterresourcefromthevSphereClient.

2ClickthevShieldApptab.

3ClickSecurityGroups.

4Click

thearrownexttothenameofasecuritygrouptoexpandthedetailsofthegroup.

5 SelectavNICfromthedrop‐downlistandclickAdd.

TheselectedvNICappearsundervNICMembership.

RepeatthesestepsforeachvNICyouwanttoplaceinthissecuritygroup.

6ClickCommit.

Afterassigningresources,addthesecuritygrouptoafirewallruleasacontainer.See“CreateanApp

FirewallRule”onpage 73.

Validating Active Sessions against the Current App Firewall Rules

Bydefault,avShieldEdgematchesfirewallrulesagainsteachnewsession.Afterasessionhasbeen

established,anyfirewallrulechangesdonotaffectactivesessions.

TheCLIcommandvalidate sessionsenablesyoutovalidateactivesessionsthatareinviolationofthe

currentruleset.Youwouldusethisprocedure

forthefollowingscenarios:

 Youupdatedthefirewallruleset.Afterafirewallrulesetupdate,youshouldvalidateactivesessionsto

purgeanyexistingsessionsthatareinviolationoftheupdatedpolicy.

 YouviewedsessionsinFlowMonitoringanddeterminedthatanexistingorhistoricalflowrequiresanew

accessrule.Aftercreatingafirewallrulethatmatchestheoffendingsession,youshouldvalidateactive

sessionstopurgeanyexistingsessionsthatareinviolationoftheupdatedpolicy.

AftertheAppFirewall

updateiscomplete,issuethevalidate sessionscommandfromtheCLIofavShield

Apptopurgesessionsthatareinviolationofcurrentpolicy.

To validate active sessions against the current firewall rules

1 UpdateandcommittheAppFirew allrulesetattheappropriatecontainerlevel.

2OpenaconsolesessiononavShieldAppissuethevalidate sessionscommand.

vShieldApp> enable

Password:

vShieldApp# validate sessions

1 2 ... 71 72 73 74 75 76 77 78 79 80 81 ... 161 162

Pas de commentaire

VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Manuel d'utilisateur Page 76