2. Computers & electronics
  3. Networking
  4. VMware vShield
  5. vShield 1.0

VMware vShield vShield 1.0 Quick start guide

  • Hello! I am an AI chatbot trained to assist you with the VMware vShield vShield 1.0 Quick start guide. I’ve already reviewed the document and can help you find the information you need or explain it in simple terms. Just ask your questions, and providing more details will help me assist you more effectively!
Quick Start Guide
vShield Zones 1.0 Update 1
EN-000166-00
VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2 VMware, Inc.
Quick Start Guide
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
docfeedback@vmware.com
© 2009 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property
laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents.
VMware, the VMware “boxes” logo and design, Virtual SMP, and VMotion are registered trademarks or trademarks of
VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks
of their respective companies.
VMware, Inc. 3
Contents
AboutThisBook 5
InstallingvShieldZones 7
Requirements 7
vShieldZonesComponents 8
EvaluatingESXNetworkConfigurationBeforeInstallingvShieldZones 8
InstallingvShieldZones 8
ObtainvShieldZonesVirtualAppliances 8
InstallthevShieldManagerasaVirtualMachineUsingthevSphereClient 9
InstallthevShieldAgentandConvertitintoaTemplate 10
LogIntothevShieldManagerUserInterfacetoConfiguretheSystem 10
Add
avShieldAgent 11
EnableContinuousDiscoverytoIdentifyYourGuestVirtualMachineTraffic 12
AdditionalvCenterConfigurationforvShieldAgents 12
PoweringoffvShieldZonesVirtualMachines 13
vShieldAgentAutomatedInstallationAt‐a‐Glance 14
UnderstandingthePortGroupsCreatedfromvShieldAgentInstallation 14
Quick Start Guide
4 VMware, Inc.
VMware, Inc. 5
TheQuickStartGuideprovidesinformationaboutinstallingvShieldZonesintoyourVMware
®
Virtual
Infrastructureenvironment.
Intended Audience
ThisbookisintendedforanyonewhowantstoinstallorusevShieldZones.Theinformationinthisbookis
writtenforexperiencedWindowsorLinuxsystemadministratorswhoarefamiliarwithvirtualmachine
technologyanddatacenteroperations.ThisbookalsoassumesfamiliaritywithVMwareVirtual
Infrastructure,includingvCenterServer4.0,
VMwareESX4.0,andthevSphereClient.
Document Feedback
VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhavecomments,sendyour
feedbacktodocfeedback@vmware.com.
VMware Infrastructure Documentation
ThefollowingdocumentscomprisethevShieldZonesdocumentationset:
vShieldZonesAdministrationGuide
vShieldZonesQuickStartGuide
IntroductiontovShieldZones
YoushouldalsohaveaccesstothecombinedvCenterServerandESXdocumentationset.
Technical Support and Education Resources
Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversion
ofthisbookandotherbooks,gotohttp://www.vmware.com/support/pubs.
Online and Telephone Support
Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and
registeryourproducts,gotohttp://www.vmware.com/support.
Customerswithappropriatesupportcontractsshouldusetelephonesupportforthefastestresponseon
priority1issues.Gotohttp://www.vmware.com/support/phone_support.
Support Offerings
TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto
http://www.vmware.com/support/services.
About This Book
Quick Start Guide
6 VMware, Inc.
VMware Professional Services
VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials
designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive
online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides
offeringsto helpyouassess,plan,
build,andmanageyourvirtualenvironment.Toaccessinformationabout
educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.
VMware, Inc. 7
vShieldZonesprovidesfirewallprotectionandtrafficanalysistoprotectyourVMwarevCenterServervirtual
infrastructure.vShieldZonesvirtualapplianceinstallationhasbeenautomatedformostvirtualdatacenters.
Thischapterincludesthefollowingtopics:
“Requirements”onpage 7
“vShieldZonesComponents”onpage 8
“EvaluatingESXNetworkConfigurationBeforeInstallingvShieldZones”onpage 8
“InstallingvShieldZones”onpage 8
“A d d i t i o n a lvCenterConfigurationforvShieldAgents”onpage 12
“PoweringoffvShieldZonesVirtualMachines”onpage 13
“vShieldAgentAutomatedInstallationAt‐a‐Glance”onpage 14
“UnderstandingthePortGroupsCreatedfromvShieldAgentInstallation”onpage 14
Requirements
BeforeinstallingvShieldZones,youmusthave:
AsystemrunningvCenterServer4.0orlater
AtleastonerunningESX4.0installation
APCwiththevSphereClient
Permissionstoaddandpoweronvirtualmachines
Accesstothedatastorewhereyoustorevirtualmachinefiles,andtheaccountpermissionstocopyfilesto
thatdatastore
vShieldManagerandvShieldagentOVFfiles
AstaticIPaddressforthemanagementinterfaceofeachvShieldagentyouinstall
AsinglestaticIPaddressforthevShieldManagermanagementinterface
EnablecookiesonyourWebbrowsertoaccessthevShieldManageruserinterface
Installing vShield Zones
Quick Start Guide
8 VMware, Inc.
vShield Zones Components
ThefollowingcomponentscomprisethevShieldZonessolution:
vShieldManager:ThevShieldZonesmanagementcenterthatmanagesallofthedistributedvShield
agents.Providesformonitoring,configuration,andsoftwareupdatingofyourvShieldagents.
vShieldagent:TheactivesecuritycomponentofvShieldZonesthatinspectstrafficflowandprovides
firewallprotection.YouinstallavShieldagentoneachESXhostyouwanttoprotect.AvShieldagent
installswithinthetrafficpathtomonitoralltrafficintoandoutofanESXhost,as
wellasbetweenvirtual
machinesonthehost.
Evaluating ESX Network Configuration Before Installing vShield Zones
PriortoinstallingvShieldZonesinyourvCenterServerenvironment,considerthenetworkconfigurationof
yourESXhosts.Ataminimum,eachhosthasatleastoneassociatedphysicalNICandonevSwitch,which
hoststheVMKernel,serviceconsole,andvirtualmachines.Inmorerobustenvironments,anESXhostmight
have
multiplededicatedphysicalNICsandmultiplevSwitchestoseparatetheVMKernelandserviceconsole
fromthevirtualmachines.
ThevShieldZonesappliancesinstallasvirtualmachinesonanESXhost.However,installationofavShield
agentrequiressomeplanning.YoucaninstallavShieldagentonanyvSwitchwithadedicated
NIC.vShield
agentinstallationmovesvirtualmachinesfromtheiroriginalvSwitchtoaclonedvSwitch.ThevShieldagent
theninstallsbetweentheoriginalvSwitchandtheclonedvSwitchtocapturealltraffictoandfromthevirtual
machines.TheoriginalvSwitchkeepstheNIC,whilethenewvSwitchdoesnot
associatewithaNIC.Thus,if
youhaveanESXhostwithmultiplevSwitcheshostingavarietyofvirtualmachines,youneedonevShield
agentpervSwitch.AnyvirtualmachinesconnectedtoavSwitchwhereavShieldagentisnotinstalledisnot
protectedbyvShieldZones.
Theinstallationofmultiple
vShieldagentsissimplifiedbyinstallingthevShieldagentOVFandthen
deployingtheoriginalvShieldagentvirtualmachineasatemplate.ThistemplateisreferencedbythevShield
Manager,allowingyoutoinstallmultiplevShieldagentsintoyourvCenterServerenvironmentfromthe
vShieldManageruserinterface.Formoreinformation
onthevShieldagentinstallationprocess,see“vShield
AgentAutomatedInstallationAt‐a‐Glance”onpage 14.
Installing vShield Zones
vShieldZonesinstallationisamulti‐stepprocess.PerformthefollowingtasksinsequencetocompletevShield
Zonesinstallationsuccessfully.
Obtain vShield Zones Virtual Appliances
vShieldZonesvirtualappliancesarepackagedusingtheOpenVirtualizationFormat(OVF).Thispackaging
simplifiestheinstallationbyallowingyoutousethevSphereClienttoimportthevirtualapplianceintothe
datastoreandvirtualmachineinventory.
ContactyourVMwareaccountteamtoobtainavShieldZonessoftwarepackage,whichconsists
ofonevShield
ManagerandonevShieldagent.OnevShieldagentvirtualappliancecanbeusedformultiplevShieldagent
installations.
Onceyouhaveobtainedthepackage,downloadittoaPCwherethevSphereClientisinstalled.
N
OTEThevShieldZonessystemwasbuilttoprotectvirtualmachines,andnottheVMKernelorservice
console.
VMware, Inc. 9
Installing vShield Zones
Install the vShield Manager as a Virtual Machine Using the vSphere Client
vShieldManagervirtualmachineinstallationrequirescreatingaportgroupforthevShieldManager.
To add the vShield Manager to your vCenter Server inventory as a virtual machine
1LogintothevSphereClient.
2 SelectanESXhostfromtheinventorypanel.
3GotoFile>DeployOVFTemplate.
TheDeployOVFTemplatewizardopens.
4ClickDeployfromfileandclickBrowsetolocatethefolder
onyourPCcontainingthevShieldManager
OVFfile.
5Completethewizard.
ThevShieldManagerisinstalledintoyourinventory.
6 CreateaportgroupnamedvsmgmtforthevShieldManagerontheESXhostwherethevShieldManager
installed.
EachinstalledvShieldagentrecognizesthisportgroupname,whichpreventsthevShieldagent
from
movingthevShieldManagervirtualmachineduringvShieldagentinstallation.
7EditthesettingsofthevShieldManagervirtualmachinetoconnectatpoweronandsetthenetworklabel
tothevsmgmtportgroup.
aRight‐clickthevShieldManagervirtualmachineandclickEditSettings.
ThevShieldManager‐VirtualMachine
Propertiesdialogboxopens.
bUndertheHardwaretab,clickNetworkAdapter1.
c SelectConnectatpoweronunderDeviceStatus.
dIntheNetworklabeldrop‐downlistandselectvsmgmt.
eClickOKtoclosethewindow.
8PoweronthevShieldManagervirtualmachine.
9ClicktheConsoletabfromtheright‐handpanetoopenthevShieldManagerCLI.
Thebootingprocessmighttakeacoupleofminutes.
10 Afterthemanager loginpromptappears,logintotheCLIbyusingtheusernameadmin andthe
passworddefault.
11 RunthesetupcommandtolaunchtheCLIsetupwizard.
TheCLIsetupwizardguidesyouthrough
IPaddressassignmentforthevShieldManager’smanagement
interfaceandidentificationofthedefaultnetworkgateway.TheIPaddressofthemanagementinterface
mustbereachablebyallinstalledvShieldagents,aswellasbyaWebbrowserforsystemmanagement.
manager> setup
Use ctrl-d to abort configuration dialog at any prompt.
Default settings are in square brackets '[]'.
Hostname [manager]:
IP Address [10.115.216.66/255.255.255.0]:
Default gateway [10.115.219.253]:
Old configuration will be lost, and system needs to be rebooted
Do you want to save new configuration (y/[n]): y
Please log out and log back in again.
Youdonotneedtologoutatthistime.vShieldManagerinstallationiscomplete.
Quick Start Guide
10 VMware, Inc.
12 Pingthedefaultgatewaytoverifynetworkconnectivity.
manager> ping 10.115.219.253
13 FromyourPC,pingthevShieldManagerIPaddresstovalidatethattheIPaddressisreachable.
14 InstallVMwareToolsonthevShieldManagervirtualmachine.
Install the vShield Agent and Convert it into a Template
InstallthevShieldagentasavirtualmachineandconvertitintoatemplate.AfterthevShieldagentvirtual
machineisconvertedtotemplateformat,thetemplatecanbereferencedbythevShieldManagerforvShield
agentinstallationonmultipleESXinstances.
To add the vShield agent to vCenter Server and convert it to a template
1LogintothevSphereClient.
2 SelectanESX
hostfromtheinventorypanel.
3GotoFile>DeployOVFTemplate.
TheDeployOVFTemplatewizardopens.
4ClickDeployfromfileandclickBrowsetolocatethefolderonyourclientmachinecontainingthevShield
agentOVFfile.
5Completethewizard.
ThevShieldagentisinstalledintoyourinventory.
6Afterthe
wizardcompletesinstallation,convertthevShieldagentintoavirtualmachinetemplate.
ThetemplateenablesautomatedinstallationofmultiplevShieldagentsfromthevShieldManageruser
interface.
Log In to the vShield Manager User Interface to Configure the System
AfterthevShieldManagervirtualappliancehasbeeninstalledandthevShieldagenthasbeenconvertedtoa
template,logintothevShieldManageruserinterfaceandconfigurethevShieldManagertoauthenticatewith
thevCenterServer.ThisauthenticationallowsthevShieldManagertodisplayyourvCenterServerinventory,
install
vShieldagents,andconfigurethefirewalltoprotectyourresources.
To log in to the vShield Manager user interface
1OpenaWebbrowserwindowandtypetheIPaddressassignedtothevShieldManager.
YoumustprependtheIPaddresswithhttps.
2Acceptthesecuritycertificate.
ThevShieldManagerloginscreenappears.
3LogintothevShieldManageruserinterfaceby
usingtheusernameadminandthepassworddefault.
ThevShieldManageruserinterfaceopenstotheConfiguration>vCentertabcontentintheright‐side
frame.Uponinitiallogin,noinformationisdisplayedinthevShieldManagerasyouhavenotyet
synchronizedcommunicationwiththevCenterServer.
CAUTIONDonotpoweronoreditthevShieldagentvirtualmachineatthistime.Poweringonorediting
thevirtualmachineatthispointcancausenetworkissues,suchasanendlessloop.
VMware, Inc. 11
Installing vShield Zones
4CompletethevCentertabformasfollows:
5ClickCommit.
ThevShieldManagerconnectstothevCenterServer,logsin,andaccessestheVMwareVirtual
InfrastructureSDK.TheinventorytreeontheleftsideofthevShieldManagerscreenshouldmatchyour
vSphereClientHosts&Clustersinventorytreeview.
Add a vShield Agent
YoucanaddvShieldagentstothevCenterServerandvShieldZonesinventoriesbycreatingclonesfromthe
vShieldagenttemplate.
YoushouldinstallonevShieldagentpervSwitchwithanattachedNIC.Anyvirtualmachinesconnectedtoa
vSwitchwhereavShieldagentisnotinstalledarenotprotectedby
vShieldZones.
To add a vShield agent
1LogintothevShieldManager.
2Fromtheinventorytree,clicktheESXhostthatyouwanttoprotect.
3ClicktheInstallvShieldtabthatappearsabovetherightframe.
4ClickConfigureinstallparameters.
5Completetheformasfollows:
Field Action
IPaddress/Name TypetheIPaddressofyourvCenterServer.
UserName TypeyourvSphereClientusername.
Password TypethepasswordassociatedwithyourvSphereClientusername.
NOTEThevShieldManagerdoesnotappearinthevShieldZonesinventorypanel.TheSettings&
ReportsobjectrepresentsthevShieldManagerintheinventorypanel.
NOTEToinstallavShieldagentonavNetworkDistributedSwitch(vNDS),refertothevShieldZones
AdministrationGuide.
Field Action
SelectfromavailablevShields Leavethisfieldblank.UsethisfieldonlywhenyouareaddingavShield
agentwithoutanestablishedtemplate.
Selecttemplatetoclone Clickthisdrop‐downmenuandselectthevShieldagenttemplate.
Selectadatastoretoplaceclone Clickthisdrop‐downmenuandselectthedatastore
onwhichtostorethe
vShieldagentclone.
Enteranamefortheclone TypeauniquenameforthevShieldagentclone.Thisnameappearsinyour
vSphereClientandvShieldManagerinventories.
SpecifyIPAddressofvShieldVM TypetheIPaddresstobeassignedtothevShieldagent’smanagement
port.
SpecifyIPMaskforvShield TypetheIPsubnetmaskassociatedwiththeassignedIPaddress.
SpecifyIPAddressofDefault
GatewayforvShield
TypetheIPaddressofthedefaultnetworkgateway
SpecifySecureKeyforvShield
(leaveblankfordefault)
(Optional)TypeakeytobeusedbetweenthevShieldagent
andthevShield
Managerforsecurecommunication.Bydefault,thisentryinthisfieldis
masked.Thisdefaultseedisusedforencryptedcommunicationbetweenthe
vShieldagentandthevShieldManager.Keysarenotsharedacrossthe
network.
SelectavSwitchtoshield Clickthisdrop‐downmenuandselect
thevSwitchtoprotect.ThevSwitches
eligibleforprotectionarehighlightedingreenintheaccompanyingtable.
Quick Start Guide
12 VMware, Inc.
6ClickContinue.
Theinstallationsummaryscreenappears.Thisscreendisplaysbeforeandafterexampleillustrationsof
installingavShieldagentontheESX.
7ClickInstall.
YoucanfollowthevShieldagentinstallationstepsfromtheRecentTasksstatuspanelocatedatthebottom
ofthevSphereClientwindow.Formoredetails
ontheinstallationprocess,see“vShieldAgentAutomated
InstallationAt‐a‐Glance”onpage 14.
vShieldagentinstallationiscomplete.
8Afterinstallationhascompleted,openyourvSphereClient.
9 LocatethevShieldagentinyourinventory.
Notethatitispoweredon.
10 InstallVMwareToolsonthevShieldManagervirtualmachine.
Enable Continuous Discovery to Identify Your Guest Virtual Machine Traffic
AfteryourvShieldManagerandvShieldagentareinstalled,andyourvShieldagentcommunicateswithyour
vShieldManager,youmustenablethecontinuousdiscoveryoperationforthevShieldagenttoprotectyour
virtualmachines.
To enable continuous discovery of virtual machine traffic
1LogintothevShieldManager.
2ClickthevShieldagentfromtheinventorytree.
3ClicktheVMDiscovery
tab.
4ClicktheAutomatedsubhead.
5IntheScheduledDiscoveryStatusdrop‐downmenu,selectContinuous.
Donotcompleteanyotherfieldsintheform.
6ClickOK.
Thediscoveryoperationbegins.Discoveryrunscontinuously,identifyingtrafficflowsbyapplicationand
protocolspecifications.
7GotoVMDiscovery>Resultstoviewthediscoveryoutput.
DiscoveredtrafficisseparatedbyvirtualmachineIPaddress.Eachdiscoveredvirtualmachineissaved
undertheVMInventorytab,whichisavailableatthedatacenterandclustercontainerlevels,aswellas
atthevirtualmachinelevelwithinthevShieldManager.
Additional vCenter Configuration for vShield Agents
IfyouhaveenabledtheVMwareHAorVMwareDRSfeatures,youmustdisablemovementofvShieldagent
virtualmachines.ThismustbeperformedafterinstallationofeachvShieldagentvirtualmachine.
YoucanmigratethevShieldManagervirtualappliancebyusingVMotionwithoutconsequence.
To disable VMware HA or VMware DRS from moving the vShield agent virtual machines
1LogintothevSphereClient.
2Right‐clicktheclustercontainingyourvShieldagentvirtualmachinesandclickEditProperties.
N
OTETheexampleillustrationsarestaticanddonotdirectlyreflectyourvirtualnetwork.Thenumbered
installationscriptontheright‐handsideofthescreendetailstheactualinstallationsteps.
VMware, Inc. 13
Installing vShield Zones
TheAdminSettingsdialogboxopens.
3UnderVMwareHA,clickVirtualMachineOptions.
LocatethevShieldagentsinthelist.
4ForeachvShieldagentvirtualmachine,selectthefollowingvalues:
VMRestartPriority:Disabled
HostIsolationResponse:LeaveVMpoweredon
5IfyouhaveenabledDRS,clickVirtualMachineOptionsunderVMwareDRS.
LocatethevShieldagentsinthelist.
6ForeachvShieldagentvirtualmachine,selectDisabledforAutomationLevel.
7ClickOKafterallvShieldagentvirtualmachineshavebeenconfigured.
Indefaultoperation,a
vShieldagentraisesanerrorduringattemptedvirtualmachinemigrationbythe
operatororVMotion.Theerrorstatesthattheserverisconnectedtoavirtualintranet.Thisvirtualintranetis
thevSwitchthatavirtualmachineconnectstoontheprotectedsideofthevShieldagent.ThisvSwitchdoes
not
homeaphysicalNIC.ThevShieldagentbridgestraffictotheunprotectedsideofthenetworkthatis
connectedtoaphysicalNIC.
To enable VMotion to disable the virtual intranet check
1 Locatethevpxd.cfgfileonthemachinerunningvCenterServer.Bydefault,thisfileisinstalledat
C:\Documents and Settings\All Users\Application Data\VMware\VMware vCenter Server.
2Editthevpxd.cfgfileinatexteditor.
Addthe
followinglinesasasub‐leveltotheconfigsection,andatthesamelevelasthevpxdsection.
<migrate>
<test>
<CompatibleNetworks>
<VMOnVirtualIntranet>false</VMOnVirtualIntranet>
</CompatibleNetworks>
</test>
</migrate>
3 Savethevpxd.cfgfile.
4RestarttheVMwarevCenterServerservice.YoucanaccesstheservicemenubygoingtoControlPanel
>AdministrativeTools>Services.
TofurtherconfigurevShieldZones,refertothevShieldZonesAdministrationGuide.
Powering off vShield Zones Virtual Machines
YoucanpoweroffvShieldZonesvirtualmachinesatanytime.WhenyoupoweroffavShieldZonesvirtual
machine,thelastsavedconfigurationisusedwhenthevirtualmachineispoweredon.
To power off vShield Zones virtual machines
1InthevSphereClient,selectthevShieldZonesvirtualmachinesfromtheinventorypanel.
2ClicktheConsoletab
toopenthevShieldZonesCLI.
3LogintotheCLI.
4Afterloggingin,typeenabletoenterPrivilegedmode.
5Typeshutdown.
6AfterCLIshutdowniscompleted,right‐clickthevirtualmachinefromtheinventorypanelandselect
Power>PowerOff.
Quick Start Guide
14 VMware, Inc.
vShield Agent Automated Installation At-a-Glance
Wheninstalledfromareferencedtemplate,thevShieldagentinstallationprocessperformsthefollowing
steps:
1CreatesacloneofthevSwitchhost.
ThisvSwitchclonedoesnotincludeaNIC.ThenameofthevSwitchcloneincludesthenameofthe
vSwitchhostwith_VSappended:vSwitch1_VS.
2Createsaprotectedzoneport
group,VSprot_vShieldagent‐name,andattachesthisportgrouptothevSwitch
host.
3Createsamanagementportgroup,VSmgmt_vShieldagent‐name,onthevSwitchhostforthevShield
agent’smanagementinterface.
4Createsanunprotectedzoneportgroup,VSunprot_vShieldagent‐name,andattachesthisportgrouptothe
vSwitchclone.
5 Connectsandpowers
onthevShieldagent.
6 AttachesthevirtualinterfacesonthevShieldagenttotheprotectedandunprotectedportgroups.
7MovesthevirtualmachinesfromthevSwitchhosttothevSwitchclone.
IfthevShieldManagervirtualmachineresidesonthesamevSwitch,itisnotmoved.DuringvShield
Managerinstallation,youcreated
aportgroupcalledvsmgmtinwhichtoplacethevShieldManager.
vShieldagentinstallationrecognizesthisportgroupnameandignoresanyvirtualmachinesinthisport
group.
Figure 1. Installation of a vShield agent on a vSwitch
Understanding the Port Groups Created from vShield Agent Installation
vShieldagentinstallationrequiresthecreationoftwoportgroups.Theseportgroupsdelineatezonesoftrust:
unprotectedandprotected.Theunprotectedzonemonitorsincomingtraffic,whiletheprotectedzone
monitorsoutgoingtraffic.EachportgrouphomesavShieldagentinterface:U0fortheunprotectedzoneand
P0fortheprotected
zone.ConnectingtheseinterfacestothecreatedportgroupsenablesthevShieldagentto
monitorallincomingandoutgoingtraffic.
I
MPORTANTDonotaddvirtualmachinestotheprotectedorunprotectedportgroups.Theseportgroups
areconfiguredwithpromiscuousmodeturnedon,whichallowsthevShieldagenttoseeallpassing
traffic.
ESX
VMkernel
service
console
virtual
machine
vShield
vSwitch0
vSwitch1
vSwitch1_VS
virtual
machine
VMware, Inc. 15
Installing vShield Zones
Theunprotectedandprotectedportgroupsareconfiguredwithpromiscuousmodeenabled.Inpromiscuous
mode,aguestadaptercanlistentoallpassingpackets.Innon‐promiscuousmode,aguestadapterlistensto
trafficonlyonitsownMACaddress.Bydefault,guestadaptersaresettonon‐promiscuousmode.For
protectionpurposes,thevShieldagentmustbeabletoseeallpassingtraffic.Donotaddanyothervirtual
machinestotheseportgroups.
Quick Start Guide
16 VMware, Inc.
/