VMware VSHIELD APP 1.0 - API Manual do Utilizador descarregar pdf (Página 47)

VMware, Inc. 47

Chapter 5 vShield Edge Management

</vshieldEdgeConfig>

Configure VPN

vShieldEdgeagentssupportsite‐to‐siteIPsecVPNbetweenanEdgeapplianceandremotesites.Onbothends,

staticone‐to‐oneNATisrequiredfortheVPNaddress.vShieldEdgeagentssupportpre‐sharedkeymode,

x/5‐0Certificatemode,IPunicasttraffic,andnodynamicroutingprotocolbetween

theEdgeandremoteVPN

routers.BehindeachremoteVPNrouter,youcanconfiguremultiplesubnetstoconnecttheinternalnetwork

behindavShieldEdgethroughIPSectunnels.SubnetsandtheinternalnetworkbehindvShieldEdgemust

havenon‐overlappingaddressranges.

YoucandeployavShieldEdgeagentbehinda

NATdevice,whichtranslatestheEdgeagent’sVPNaddress

intoapublicaccessibleaddressfacingtheInternet;remoteVPNroutersusethispublicaddresstoaccessthe

vShieldEdge.RemoteVPNrouterscanbelocatedbehindaNATdeviceaswell.Youmustprovideboththe

VPNnativeaddressand

theNATpublicaddresstosetupthetunnel.

AllVPNsettingsconfiguredbyusingRESTrequestsappearun der thevShieldEdge>VPNta b forthe

appropriatevShieldEdge inthevShieldManageruserinterfaceandinthevSphereClientplug‐in.

FortheVPNschema,see“vShieldEdgeSchemas”on

page 88.SampleXMLrequestbody:

Example 5-27. Configure a VPN

POST https://<vsm-ip>/api/2.0/networks/<internal-portgroup-vc-moref-id>/edge

<enableLog>false</enableLog>

</globalConfig>

</siteConfig>

</ipsecSiteToSiteConfig>

</vshieldEdgeConfig>

Forthedatapathtowork,youneedtochangethedefaultfirewallpolicytoallow,orpunchFirewallrulesto

allowdatatrafficonVPNandinternalinterfaces.Rules:

 The<id>isauniqueIDusedbyallpeerstoidentifythisvShieldEdgeVPNgateway.Intheexample,itis

thesameas<ipAddress>.

 SimilartothepreSharedKeyinsiteConfig,theoptionalpreSharedKeyForDynamicIpSitesin

globalConfigisapre‐sharedkeyforusebyallpeerswhenconnectingwithanunknownIPaddress.

 The<peerName>adescriptivenameofthepeer.

 The<peerId>isanIDtouniquelyidentifythepeer,usedtodefinepoliciesforthepeerandforpeer

authentication.Forpeersusingcertificateauthentication,thisIDmustbethecommonnameinthepeer’s

certificate.ForPSKpeers,thisIDcanbeanystring,butideallythepublicIP

addressoftheVPNorthe

FQDNfortheVPNservice.

1 2 ... 42 43 44 45 46 47 48 49 50 51 52 ... 103 104

Sem comentários

VMware VSHIELD APP 1.0 - API Manual do Utilizador Página 47