VMware VSHIELD APP 1.0.0 UPDATE 1 - API, Admin Manual, Page: 69 / 144

VMware, Inc. 69
13
vShield App provides firewall protection through access policy enforcement. The App Firewall tab represents
the vShield App firewall access control list.
This chapter includes the following topics:

“Using App Firewall” on page 69

“Create an App Firewall Rule” on page 71

“Create a Layer 2/Layer 3 App Firewall Rule” on page 73

“Creating and Protecting Security Groups” on page 73

“Validating Active Sessions against the Current App Firewall Rules” on page 74

“Revert to a Previous App Firewall Configuration” on page 75

“Delete an App Firewall Rule” on page 75

“Using SpoofGuard” on page 75
Using App Firewall
The App Firewall service is a centralized, hierarchical firewall for ESX hosts. App Firewall enables you to
create rules that allow or deny access to and from your virtual machines. Each installed vShield App enforces
the App Firewall rules.
You can manage App Firewall rules at the datacenter, cluster, and port group levels to provide a consistent set
of rules across multiple vShield App instances under these containers. As membership in these containers can
change dynamically, App Firewall maintains the state of existing sessions without requiring reconfiguration
of firewall rules. In this way, App Firewall effectively has a continuous footprint on each ESX host under the
managed containers.
Securing Containers and Designing Security Groups
When creating App Firewall rules, you can create rules based on traffic to or from a specific container that
encompasses all of the resources within that container. For example, you can create a rule to deny any traffic
from inside of a cluster that targets a specific destination outside of the cluster. You can create a rule to deny
any incoming traffic that is not tagged with a VLAN ID. When you specify a container as the source or
destination, all IP addresses within that container are included in the rule.
App Firewall Management
13
N
OTE
App Firewall rules apply to vShield App instances, but not vShield Edge or vShield Endpoint instances.
The Zones Firewall tab becomes the App Firewall tab when the vShield App license is activated.