VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Uživatelský manuál stáhnout pdf (Strana 72)

vShield Administration Guide

72 VMware, Inc.

AsecuritygroupisatrustzonethatyoucreateandassignresourcestoforAppFirewallprotection.Security

groupsarecontainers,likeavApporacluster.Securitygroupsenablesyoutocreateacontainerbyassigning

resourcesarbitrarily,suchasvirtualmachinesandnetworkadapters.Afterthesecuritygroup

isdefined,you

addthegroupasacontainerinthesourceordestinationfieldofanAppFirewallrule.See“Creatingand

ProtectingSecurityGroups”onpage 75.

Default Rules

Bydefault,theAppFirewallenforcesasetofrulesallowingtraffictopassthroughallvShieldAppinstances.

TheserulesappearintheDefaultRulessectionoftheAppFirewalltable.Thedefaultrulescannotbedeleted

oraddedto.However,youcanchangetheActionelementofeachrule

fromAllowtoDeny.

Layer 4 Rules and Layer 2/Layer 3 Rules

TheAppFirewalltabofferstwosetsofconfigurablerules:L4(Layer4)rulesandL2/L3(Layer2/Layer3)rules.

LayersrefertolayersoftheOpenSystemsInterconnection(OSI)ReferenceModel.

Layer4rulesgovernTCPandUDPtransportofLayer7,orapplication‐specific,traffic.Layer2/Layer3rules

monitortrafficfromICMP,ARP,andotherLayer2andLayer3protocols.YoucanconfigureLayer2/Layer 3

rulesatthedatacenterlevelonly.Bydefault,allLayer4andLayer2/Layer3trafficisallowedtopass.

Hierarchy of App Firewall Rules

EachvShieldAppenforcesAppFirewa llrulesintop‐to‐bottomordering.AvShieldAppcheckseachtraffic

sessionagainstthetopruleintheAppFirewalltablebeforemovingdownthesubsequentrulesinthetable.

Thefirstruleinthetablethatmatchesthetrafficparametersisenforced.

The

rulesareenforcedinthefollowinghierarchy:

1 DataCenterHighPrecedenceRules

2 ClusterLevelRules

3 DataCenterLowPrecedenceRules(seenasRulesbelowthislevelhavelowerprecedencethancluster

levelruleswhenadatacenterresourceisselected)

4 SecurePortGroupRules

5 DefaultRules

AppFirewallofferscontainer‐leveland

custompriorityprecedenceconfigurations:

 Container‐levelprecedencereferstorecognizingthedatacenterlev elasbeinghigherinprioritythanthe

clusterlevel.Whenaruleisconfiguredatthedatacenterlevel,theruleisinheritedbyallclustersand

vShieldagentstherein.Acluster‐levelruleisonlyappliedtothevShieldAppwithinthe

cluster.

 Custompriorityprecedencereferstotheoptionofassigninghighorlowprecedencetorulesatthe

datacenterlevel.Highprecedencerulesworkasnotedinthecontainer‐levelprecedencedescription.Low

precedencerulesincludetheDefaultRulesandtheconfigurationofDataCenterLowPrecedencerules.

Thisflexibilityallowsyou

torecognizemultiplelayersofappliedprecedence.

Attheclusterlevel,youconfigurerulesthatapplytoallvShieldAppinstanceswithinthecluster.Because

DataCenterHighPrecedenceRulesareaboveClusterLevelRules,ensureyourClusterLevelRulesare

notinconflictwithDataCenterHighPrecedenceRules.

Planning App Firewall Rule Enforcement

UsingAppFirewall,youcanconfigureallowanddenyrulesbasedonyournetworkpolicy.Thefollowing

examplesrepresenttwocommonfirewallpolicies:

 Allowalltrafficbydefault.YoukeepthedefaultallowallrulesandadddenyrulesbasedonFlow

MonitoringdataormanualAppFirewallruleconfiguration.Inthisscenario,ifasessiondoesnotmatch

anyofthedenyrules,thevShieldAppallowsthetraffictopass.

1 2 ... 67 68 69 70 71 72 73 74 75 76 77 ... 161 162

Komentáře k této Příručce

Žádné komentáře

VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Uživatelský manuál Strana 72

Komentáře k této Příručce

Související produkty a manuály pro Software pro správu systému VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API