VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Manual do Utilizador descarregar pdf (Página 73)

VMware, Inc. 73

Chapter 13 App Firewall Management

 Denyalltrafficbydefault.YoucanchangetheActionstatusofthedefaultrulesfromAllowtoDeny,and

addallowrulesexplicitlyforspecificsystemsandapplications.Inthisscenario,ifasessiondoesnot

matchanyoftheallowrules,thevShieldAppdropsthesessionbeforeit

reachesitsdestination.Ifyou

changeallofthedefaultrulestodenyanytraffic,thevShieldAppdropsallincomingandoutgoingtraffic.

Create an App Firewall Rule

AppFirewallrulesallowordenytrafficbasedonthefollowingcriteria:

YoucanadddestinationandsourceportrangestoarulefordynamicservicessuchasFTPandRPC,which

requiremultipleportstocompleteatransmission.

To create a firewall rule at the datacenter level

1InthevSphereClient,gotoInventory>HostsandClusters.

2 Select

adatacenterresourcefromtheresourcetree.

3ClickthevShieldApptab.

4ClickAppFirewall.

Bydefault,theL4Rulesoptionisselected.

TocreateL2/L3rules,see“CreateaLayer2/Layer3AppFirewallRule”onpage 75.

5Dooneofthefollowing:

 ClickAddtoaddanewruletotheDataCenterLowPrecedenceRules(Rulesbelowthislevelhave

lowerprecedence...).

 SelectarowintheDataCenterHighPrecedenceRulessectionofthetableandclickAdd.Anew

appearsbelowtheselectedrow.

6Double‐clickeachcellinthenewrowtoselecttheappropriateinformation.

YoucantypeIPaddressesintheSourceandDestinationfields,andportnumbers

intheSourcePortand

DestinationPortfields.

7 (Optional)SelectthenewrowandclickUptomovetheruleupinpriority.

8 (Optional)SelecttheLogcheckboxtologallsessionsmatchingthisrule.

9ClickCommittosavetherule.

Criteria Description

Source(A.B.C.D/nn) Container,directioninrelationtocontainer,orIPaddresswithnetmask(nn)from

whichthecommunicationoriginated.

SourcePort Portorrangeofportsfromwhichthecommunicationoriginated.Toenteraport

range,separatethelowandhighendoftherangewithacolon.Forexample,

1000:1100.

Destination

(A.B.C.D/nn) Container,directioninrelationtocontainer,orIPaddresswithnetmask(nn)which

thecommunicationistargeting.

DestinationApplication Theapplicationonthedestinationthesourceistargeting.Ifyouselectaprotocol

fromthedrop‐downlist,thewell‐knownportfortheselectedprotocolappearsin

theDestinationPort

field.

DestinationPort Portorrangeofportswhichthecommunicationistargeting.Toenteraportrange,

separatethelowandhighendoftherangewithacolon.Forexample,1000:1100.

Protocol Transportprotocolusedforcommunication.

NOTELayer4firewallrulescanalsobecreatedfromtheFlowMonitoringreport.See“A d d anAppFirewall

RulefromtheFlowMonitoringReport”onpage 67.

1 2 ... 68 69 70 71 72 73 74 75 76 77 78 ... 161 162

Comentários a estes Manuais

Sem comentários

VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API Manual do Utilizador Página 73

Comentários a estes Manuais

Manuais e produtos relacionados com Software de gestão do sistema VMware VSHIELD MANAGER 4.1.0 UPDATE 1 - API