VMware VSHIELD APP 1.0.0 UPDATE 1 - API, Руководство администратора

Страница: 27 / 144

VMware, Inc. 27
Chapter 4 Zones Firewall Management
Create a Zones Firewall Rule
Zones Firewall rules allow or deny traffic based on the following criteria:
You can add destination and source port ranges to a rule for dynamic services such as FTP and RPC, which
require multiple ports to complete a transmission. If you do not allow all of the ports that must be opened for
a transmission, the transmission fails.
To create a firewall rule at the datacenter level
1 In the vSphere Client, go to Inventory > Hosts and Clusters .
2 Select a datacenter resource from the resource tree.
3 Click the vShield Zones tab.
4 Click Zones Firewall .
By default, the L4 Rules option is selected.
To create L2/L3 rules, see “Create a Layer 2/Layer 3 Zones Firewall Rule” on page 28.
5 Do one of the following:

Click Add to add a new rule to the Data Center Low Precedence Rules ( Rules below this level have
lower precedence... ).

Select a row in the Data Center High Precedence Rules section of the table and click Add . A new
appears below the selected row.
6 Double-click each cell in the new row to select the appropriate information.
You must type IP addresses in the Source and Destination fields, and port numbers in the Source Port
and Destination Port fields.
7 (Optional) Select the new row and click Up to move the row up in priority.
8 (Optional) Select the Log check box to log all sessions matching this rule.
9 Click Commit to save the rule.
To create a firewall rule at the cluster level
1 In the vSphere Client, go to Inventory > Hosts and Clusters .
2 Select a cluster resource from the resource tree.
3 Click the vShield Zones tab.
4 Click Zones Firewall .
By default, the L4 Rules option is selected.
To create L2/L3 rules, see “Create a Layer 2/Layer 3 Zones Firewall Rule” on page 28.
Criteria Description
Source (A.B.C.D/nn) IP address with netmask (nn) from which the communication originated
Source Port Port or range of ports from which the communication originated. To enter a port
range, separate the low and high end of the range with a colon. For example,
1000:1100.
Destination (A.B.C.D/nn) IP address with netmask (nn) which the communication is targeting
Destination Application The application on the destination the source is targeting
Destination Port Port or range of ports which the communication is targeting. To enter a port range,
separate the low and high end of the range with a colon. For example, 1000:1100.
Protocol Transport protocol used for communication