VMware VSHIELD APP 1.0 - API Mode d'emploi

vShield API Programming Guide

vShield Manager 4.1

vShield App 1.0

vShield Edge 1.0

vShield Endpoint 1.0

This document supports the version of each product listed and

supports all subsequent versions until the document is replaced

by a new edition. To check for more recent editions of this

document, see http://www.vmware.com/support/pubs.

EN-000434-00

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

2VMware, Inc.

vShield API Programming Guide

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

intellectual property laws. VMware products are covered by one or more patents listed at

http://www.vmware.com/go/patents.

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks

and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3

Contents

AboutThisBook 7

1OverviewofVMwarevShield 9

vShieldComponents 9

vShieldManager 9

vShieldApp 9

vShieldEdge 10

vShieldEndpoint 10

PortsRequiredforvShield 10

AnIntroductiontoRESTAPIforvShieldUsers 10

HowRESTWorks 10

UsingREST 10

vShieldAPIConventions 11

RESTfulWorkflowPatterns 12

ForMoreInformationAboutREST 13

2vShieldManagerManagement 15

SynchronizethevShieldManagerwithvCenterServerandDNS 15

RetrievingTechSupportLogs 16

GetthevShieldManagerTechnicalSupportLogFilePath 16

GetthevShieldEdgeTechnicalSupportLogFilePath 16

3ESXHostPreparationforvShieldApp,Endpoint,andIsolation 17

InstalltheLicensesforvShieldEdge,vShieldApp,andvShieldEndpoint 17

InstallvShieldApp,vShieldEndpoint,andPortGroupIsolationServicesonanESXHost 17

GettheInstallationStatusofvShieldServicesonanESXHost 19

UninstallingvShieldServicesfromanESXHost 20

4vNetworkPreparationandvShieldEdgeInstallation 21

EnablingPortGroupIsolation 21

EnablePortGroupIsolationonavDS 22

GetthePortGroupIsolationDebugStatisticsfromanESXHost 22

DisablePortGroupIsolationonavDS 22

InstallingavShieldEdge 23

GettheInstallParametersofavShieldEdge 24

UninstallavShieldEdge 24

5vShieldEdgeManagement 25

ForceavShieldEdgetoSynchronizewiththevShieldManager 26

ManageCLICredentialsonavShieldEdge 26

ManagingDHCP 26

GettheDHCPServerStatus 27

Start,Stop,orRestarttheDHCPService 27

PostaDHCPConfiguration 27

GettheConfigurationforAllDHCPHostsandPools 28

GetTimestampsofLast10DHCPConfigurations 28

GetaDHCPConfigurationbyTimestamp 28

vShield API Programming Guide

4VMware, Inc.

ReverttoaDHCPConfigurationbyTimestamp 29

DeletetheDHCPConfigurationonavShieldEdge 29

ManagingNAT 29

ManagingSNATRules 29

GettheSNATRuleSet 29

PostanSNATRuleSet 30

GetTimestampsofLast10SNATRuleConfigurationsforavShieldEdge 31

GetSNATConfigurationbySnapshotTimestamp 31

ReverttoanSNATConfigurationbySnapshotTimestamp 31

DeleteAllSNATRulesonavShieldEdge 32

ManagingDNATRules 32

GettheDNATRuleSet 32

PostaDNATRuleSet 32

GetTimestampsofLast10DNATRuleConfigurationsforavShieldEdge 34

GetDNATConfigurationbySnapshotTimestamp 34

ReverttoanDNATConfigurationbySnapshotTimestamp 34

DeleteAllDNATRules 35

ConfiguringthevShieldEdgeFirewall 35

GettheFirewallRuleSetforavShieldEdge 35

PostaFirewallRuleSet 35

GettheStatusoftheDefaultPolicyforavShieldEdge 37

ChangetheDefaultFirewallPolicyAction 37

GetDetailsofaSpecificFirewallRule 37

GetTimestampsofLast10FirewallRuleSetsforavShieldEdge 38

GetFirewallRuleSetbyTimestamp 38

ReverttoaFirewallRuleSetbyTimestamp 38

DeleteAllFirewallRulesonavShieldEdge 38

ConfiguringVPNs 39

GettheStatusofVPNService 39

StartorStoptheVPNServiceonavShieldEdge 40

ConfigureVPNParametersonavShieldEdge 40

AddaRemoteSite 41

AddTunnelsforaVPNSite 42

GettheDetailedIPSecConfigurationsforaNetwork 42

GettheDetailedConfigurationforaVPNSite 42

GettheDetailedTunnelConfiguration 43

DeleteaTunnelforaVPNSite 43

DeleteaRemoteSite 43

GettheCurrentVPNConfigurationonavShieldEdge 43

GetTimestampsofLast10VPNConfigurations 44

GetaVPNConfigurationbyTimestamp 44

ReverttoaVPNConfigurationbyTimestamp 44

DeletetheVPNConfigurationonavShieldEdge 44

LoadBalancer 45

GettheStatusofLoadBalancerServiceonavShieldEdge 45

StartorStoptheLoadBalancerServiceonavShieldEdge 46

AddaListenerforLoadBalancingService 46

GettheCurrentLoadBalancerConfigurationonavShieldEdge 47

GettheConfigurationofaSpecificLoadBalancingServer 47

GetTimestampsofLast10LoadBalancerConfigurations 47

GetaLoadBalancerConfigurationbyTimestamp 48

ReverttoaLoadBalancerConfigurationbyTimestamp 48

DeletetheLoadBalancerConfigurationonavShieldEdge 48

ManagingtheMTUThresholdforavShieldEdge 48

ViewTrafficStatistics 49

VMware, Inc. 5

DebugvShieldEdgeServicesUsingServiceStatistics 49

ManagingtheConnectiontoaSyslogServer 50

PostaSyslogServerConfiguration 50

GettheCurrentSyslogServerConfiguration 50

GetTimestampsofLast10SyslogServerConfigurations 50

GetaSyslogServerConfigurationbyTimestamp 51

ReverttoaSyslogServerConfigurationbyTimestamp 51

DeletetheCurrentSyslogServerConfiguration 51

6vShieldAppManagement 53

ConfiguringFirewallRulesforavCenterContainer 53

ViewAllFirewallRulesforaContainer 53

PostanAppFirewallRuleSetforaContainer 54

ViewaListofTimestampsIdentifyingAppFirewallRuleSetChanges 57

ViewaPreviousFirewallRuleSetbyTimestamp 57

ReverttoaPreviousFirewallRuleSet 57

DeleteAllFirewallRulesunderaContainer 58

ManagingSecurityGroups 58

AddaSecurityGroup 58

AddaVirtualMachinetoaSecurityGroup 59

GettheListofAllSecurityGroupsunderaBaseNode 60

GettheDetailsforaSingleSecurityGroupunderaBaseNode 60

GetIPAddressesfortheVirtualMachinesinaSecurityGroup 60

GetthePropertiesfromaVirtualMachine 60

DeleteaVirtualMachinefromaSecurityGroup 61

DeleteaSingleSecurityGroup 61

DeleteAllSecurityGroupsunderaBaseNode 61

ConfiguringSyslogServiceforavShieldApp 62

7vShieldEndpointManagement 63

RetrieveSVM‐SpecificNetworkInformation 64

RetrievevShieldEndpointServiceStatusonanESXHost 65

UninstallingthevShieldEndpointServicefromanESXHost 65

UnregisteranSVMfromvShieldEndpoint 65

UninstallvShieldEndpointfromthevShieldManager 66

ErrorSchema 66

8Appendix:RESTAPISchemas 67

vShieldManagerSchemas 67

vShieldManagertovCenterServerSynchronizationSchema 67

DNSServiceSchema 68

VirtualMachineInformationSchema 68

SecurityGroupsSchema 69

ESXHostPreparationandUninstallationSchema 70

vShieldAppSchemas 71

vShieldAppConfigurationSchema 71

vShieldAppFirewallSchema 72

PortGroupIsolationManagementSchema 73

PortGroupIsolationStatisticsSchema 74

vShieldEdgeSchemas 74

BasevShieldEdgeConfigurationSchema 74

vShieldEdgeInstallationSchema 74

vShieldEdgeGlobalConfigurationSchema 75

vShieldEdgeCLILoginCredentialsSchema 76

VMware, Inc. 6

vShieldEdgeFirewallSchema 77

NATSchema 79

DHCPSchema 81

VPNSchema 83

LoadBalancerSchema 86

MTUThresholdSchema 87

TrafficStatsSchema 87

SyslogSchema 88

ErrorMessageSchema 89

Index 91

VMware, Inc. 7

Thismanual,thevShieldAPIProgrammingGuide,describeshowtoinstall,configure,monitor,andmaintainthe

VMware®vShield™systembyusingRESTAPIrequests.Theinformationincludesstep‐by‐stepconfiguration

instructionsandexamples.

Intended Audience

ThismanualisintendedforanyonewhowantstouseRESTAPItoinstallorusevShieldinaVMware

vCenter™environment.Theinformationinthismanualiswrittenforexperiencedsystemadministratorswho

arefamiliarwithvirtualmachinetechnologyandvirtualdatacenteroperations.Thismanualassumes

familiaritywithvShield.

VMware Technical Publications Glossary

VMwareTechnicalPublicationsprovidesaglossaryoftermsthatmightbeunfamiliartoyou.Fordefinitions

oftermsastheyareusedinVMwaretechnicaldocumentationgotohttp://www.vmware.com/support/pubs.

Document Feedback

VMwarewelcomesyoursuggestionsforimprovingourdocumentation.Ifyouhavecomments,sendyour

feedbacktodocfeedback@vmware.com.

vShield Documentation

ThefollowingdocumentscomprisethevShielddocumentationset:

vShieldAdministrationGuide

vShieldQuickStartGuide

vShieldAPIProgrammingGuide,thisguide

Technical Support and Education Resources

Thefollowingsectionsdescribethetechnicalsupportresourcesavailabletoyou.Toaccessthecurrentversion

ofthisbookandotherbooks,gotohttp://www.vmware.com/support/pubs.

Online and Telephone Support

Touseonlinesupporttosubmittechnicalsupportrequests,viewyourproductandcontractinformation,and

Customerswithappropriatesupportcontractsshouldusetelephonesupportforthefastestresponseon

priority1issues.Gotohttp://www.vmware.com/support/phone_support.

About This Book

vShield API Programming Guide

8VMware, Inc.

Support Offerings

TofindouthowVMwaresupportofferingscanhelpmeetyourbusinessneeds,goto

http://www.vmware.com/support/services.

VMware Professional Services

VMwareEducationServicescoursesofferextensivehands‐onlabs,casestudyexamples,andcoursematerials

designedtobeusedason‐the‐jobreferencetools.Coursesareavailableonsite,intheclassroom,andlive

online.Foronsitepilotprograms andimplementationbestpractices,VMwareConsultingServicesprovides

offeringsto helpyouassess,plan,build,andmanageyourvirtualenvironment.Toaccessinformationabout

educationclasses,certificationprograms,andconsultingservices,gotohttp://www.vmware.com/services.

VMware, Inc. 9

VMware®vShield™isasuiteofnetworkedgeandapplication‐awarefirewallsbuiltforVMwarevCenter™

Serverintegration.vShieldinspectsclient‐servercommunicationsandinter‐virtual‐machinecommunication

toprovidedetailedtrafficanalyticsandapplication‐awarefirewallprotection.vShieldisacriticalsecurity

componentforprotectingvirtualizeddatacentersfromattacksandmisusehelpingyouachieveyour

compliance‐mandatedgoals.

ThisguideassumesyouhaveadministratoraccesstotheentirevShieldsystem.Ifyouareunabletoaccessa

screenorperformaparticulartask,consultyourvShieldadministrator.

Thischapterincludesthefollowingtopics:

“vShieldComponents”onpage 9

“PortsRequiredforvShield”onpage 10

“A n IntroductiontoRESTAPIforvShieldUsers”onpage 10

vShield Components

vShieldincludescomponentsandservicesessentialforprotectingvirtualmachines.vShieldcanbeconfigured

throughaweb‐baseduserinterface,acommandlineinterface(CLI),andRESTAPI.

TorunvShield,youneedonevShieldManagervirtualmachineandatleastonevShieldZones,vShieldApp,

orvShieldEdgevirtualmachine.

vShield Manager

ThevShieldManageristhecentralizedmanagementcomponentofvShieldandisinstalledfromOVAasa

virtualmachinebyusingthevSphereClient.UsingthevShieldManageruserinterfaceorvSphereClient

plug‐in,administratorscaninstall,configure,andmaintainvShieldcomponents.

ThevShieldManagervirtualmachinecanrunonadifferentESXhostfromyourvShieldAppandvShield

Edgevirtualmachines.

ThevShieldManageruserinterfaceleveragestheVMwareInfrastructureSDKtodisplayacopyofthevSphere

Clientinventorypanel.

FormoreontheusingthevShieldManageruserinterface,seethevShieldAdministrationGuide.

vShield App

AvShieldAppmonitorsalltrafficintoandoutofanESXhost,andbetweenvirtualmachinesonthehost.

vShieldAppprovidesapplication‐awaretrafficanalysisandstatefulfirewallprotection.vShieldApp

regulatestrafficbasedonasetofrules,similartoanaccesscontrollist(ACL).

Overview of VMware vShield 1

vShield API Programming Guide

10 VMware, Inc.

AstrafficpassesthroughavShieldApp,eachsessionheaderisinspectedtocatalogthedata.ThevShieldApp

createsaprofileforeachvirtualmachinedetailingtheoperatingsystem,applications,andportsusedin

networkcommunication.Basedonthisinformation,thevShieldAppallowsephemeralportusageby

permittingdynamicprotocolssuchasFTPandRPCtopassthrough,whilemaintaininglockdownonports

1024andhigher.

YoucannotprotecttheServiceConsoleorVMkernelwithavShieldAppbecausethesecomponentsarenot

virtualmachines.

vShield Edge

AvShieldEdgeprovidesnetworkedgesecuritytoprotectthevirtualmachinesinavCloudtenant’snetwork

fromattacksoriginatingfromthepublicnetwork.ThevShieldEdgeconnectstheisolated,privatenetworksof

cloudtenantstothepublicsideoftheserviceprovidernetworkthroughcommonedgeservicessuchasDHCP,

VPN,NAT,andloadbalancing.

YouinstallavShieldEdgefromthevShieldManager.YoucaninstallonevShieldEdgeinstancepertenantport

grouponavNetworkDistributedSwitch(vDS).

YouconfigureavShieldEdgebyusingRESTAPI.

vShield Endpoint

vShieldEndpointdeliversanintrospection‐basedantivirussolution.vShieldEndpointusesthehypervisorto

scanguestvirtualmachinesfromtheoutsidewithoutabulkyagent.vShieldEndpointisefficientinavoiding

resourcebottleneckswhileoptimizingmemoryuse.

Ports Required for vShield

ThevShieldManagerrequiresports80/TCPand443/TCPforRESTAPIrequests.

An Introduction to REST API for vShield Users

REST,anacronymforRepresentationalStateTransfer,isatermthathasbeenwidelyemployedtodescribean

architecturalstylecharacteristicofprogramsthatrelyontheinherentpropertiesofhypermediatocreateand

modifythestateofanobjectthatisaccessibleataURL.

How REST Works

OnceaURLofsuchanobjectisknowntoaclient,theclientcanuseanHTTPGETrequesttodiscoverthe

propertiesoftheobject.ThesepropertiesaretypicallycommunicatedinastructureddocumentwithanHTTP

Content‐TypeofXMLorJSON,thatprovidesarepresentationofthestateoftheobject.InaRESTfulworkflow,

documents(representationsofobjectstate)arepassedbackandforth(transferred)betweenaclientanda

servicewiththeexplicitassumptionthatneitherpartyneedknowanythingaboutanentityotherthanwhatis

presentedinasinglerequestorresponse.TheURLsatwhichthesedocumentsareavailableareoften“sticky,”

inthattheypersistbeyondthelifetimeoftherequestorresponsethatincludesthem.Theothercontentofthe

documentsisnominallyvaliduntiltheexpirationdatenotedintheHTTPExpiresheader.

Using REST

RESTAPIusesHTTPrequests(whichareoftenexecutedbyascriptorotherhigher‐levellanguage)asaway

ofmakingwhatareessentiallyidempotentremoteprocedurecallsthatcreate,modify,ordeletetheobjects

definedbytheAPI.ThisRESTAPI(andothers)isdefinedbyacollectionofXMLdocumentsthatrepresent

theobjectsonwhichtheAPIoperates.Theoperationsthemselves(HTTPrequests)aregenerictoallHTTP

clients.

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels VMware Logiciel

VMware

VMware 4817V62 - vSphere - PC Mode d’emploi

VMware

VMware VIEW 4.5 - GUIDE DE MISE A NIVEAU Manuel utilisateur

VMware

VMware THINAPP 4.6 - MIGRATING APPLICATIONS TECHNICAL... Manuel utilisateur

VMware

VMware vSphere ESXi 4.0 Manuel de programmation

VMware

VMware VCLOUD REQUEST MANAGER 1.0.0 Manuel utilisateur

VMware

VMware VLM3-ENG-CP - Lab Manager - PC Manuel utilisateur

VMware

VMware FUS3-ENG-M-10-CP - Fusion For Mac OS X Manuel utilisateur

VMware

VMware THINAPP Manuel utilisateur

VMware

VMware VSHIELD APP 1.0.0 UPDATE 1 - API Manuel utilisateur

VMware

VMware VIEW 4.5 Manuel utilisateur

VMware

VMware VC-SRM4-A - vCenter Site Recovery Manager Mode d’emploi

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.1 -... Manuel utilisateur

VMware

VMware VCENTER CONFIGURATION MANAGER Guide rapide

VMware

VMware ACE Manuel d'utilisation et d'entretien

VMware

VMware VIEW MANAGER 4.X - EXTENDING VIRTUAL MACHINE DELECTION WITH... Manuel utilisateur

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.0 Manuel utilisateur

VMware

VMware VFABRIC TC SERVER Manuel utilisateur

VMware

VMware GSX Server 3 Administration Mode d’emploi

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Manuel utilisateur

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 Manuel utilisateur

VMware

VMware VCLOUD DIRECTOR Manuel utilisateur

VMware

VMware VCENTER CONFIGURATION MANAGER 5.3 Manuel utilisateur

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.1 -... Manuel utilisateur

VMware

VMware VCENTER CONFIGURATION MANAGER 5.3 - SOFTWARE REQUIEREMENTS... Guide rapide

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur