VMware VSHIELD APP 1.0.0 UPDATE 1 - API, Admin Manual, Page: 73 / 144

VMware, Inc. 73
Chapter 13 App Firewall Management
Create a Layer 2/Layer 3 App Firewall Rule
The Layer 2/Layer 3 firewall enables configuration of allow or deny rules for common Data Link Layer and
Network Layer requests, such as ICMP pings and traceroutes. You can change the default Layer 2/Layer 3 rules
from allow to deny based on your network security policy.
Layer 2/Layer 3 firewall rules allow or deny traffic based on the following criteria:
To create a Layer 2/Layer 3 firewall rule
1 In the vSphere Client, go to Inventory > Hosts and Clusters .
2 Select a datacenter resource from the resource tree.
3 Click the vShield App tab.
4 Click App Firewall .
5 Click L2/L3 Rules .
6 Click Add .
A new row is added at the bottom of the DataCenter Rules section of the table.
7 Double-click each cell in the new row to type or select the appropriate information.
You can type IP addresses in the Source and Destination fields
8 (Optional) Select the Log check box to log all sessions matching this rule.
9 Click Commit .
Creating and Protecting Security Groups
The Security Groups feature enables you to create custom containers to which you can assign resources, such
as virtual machines and network adapters, for App Firewall protection. After a security group is defined, you
add the security group to a firewall rule for protection.
Add a Security Group
In the vSphere Client, you can add a security group at the datacenter resource level.
To add a security group by using the vSphere Client
1 Click a datacenter resource from the vSphere Client.
2 Click the vShield App tab.
3 Click Security Groups .
4 Click Add Group .
Criteria Description
Source (A.B.C.D/nn) Container, direction in relation to container, or IP address with netmask (nn) from
which the communication originated
Destination (A.B.C.D/nn) Container, direction in relation to container, or IP address with netmask (nn) which
the communication is targeting
Protocol Transport protocol used for communication
N
OTE
Layer 2/Layer 3 firewall rules can also be created from the Flow Monitoring report. See “Add an App
Firewall Rule from the Flow Monitoring Report” on page 65.