VMware VSHIELD APP 1.0.0 UPDATE 1 - API, Руководство администратора

Страница: 71 / 144

VMware, Inc. 71
Chapter 13 App Firewall Management

Deny all traffic by default. You can change the Action status of the default rules from Allow to Deny , and
add allow rules explicitly for specific systems and applications. In this scenario, if a session does not
match any of the allow rules, the vShield App drops the session before it reaches its destination. If you
change all of the default rules to deny any traffic, the vShield App drops all incoming and outgoing traffic.
Create an App Firewall Rule
App Firewall rules allow or deny traffic based on the following criteria:
You can add destination and source port ranges to a rule for dynamic services such as FTP and RPC, which
require multiple ports to complete a transmission.
To create a firewall rule at the datacenter level
1 In the vSphere Client, go to Inventory > Hosts and Clusters .
2 Select a datacenter resource from the resource tree.
3 Click the vShield App tab.
4 Click App Firewall .
By default, the L4 Rules option is selected.
To create L2/L3 rules, see “Create a Layer 2/Layer 3 App Firewall Rule” on page 73.
5 Do one of the following:

Click Add to add a new rule to the Data Center Low Precedence Rules ( Rules below this level have
lower precedence... ).

Select a row in the Data Center High Precedence Rules section of the table and click Add . A new
appears below the selected row.
6 Double-click each cell in the new row to select the appropriate information.
You can type IP addresses in the Source and Destination fields, and port numbers in the Source Port and
Destination Port fields.
7 (Optional) Select the new row and click Up to move the rule up in priority.
8 (Optional) Select the Log check box to log all sessions matching this rule.
9 Click Commit to save the rule.
Criteria Description
Source (A.B.C.D/nn) Container, direction in relation to container, or IP address with netmask (nn) from
which the communication originated.
Source Port Port or range of ports from which the communication originated. To enter a port
range, separate the low and high end of the range with a colon. For example,
1000:1100.
Destination (A.B.C.D/nn) Container, direction in relation to container, or IP address with netmask (nn) which
the communication is targeting.
Destination Application The application on the destination the source is targeting. If you select a protocol
from the drop-down list, the well-known port for the selected protocol appears in
the Destination Port field.
Destination Port Port or range of ports which the communication is targeting. To enter a port range,
separate the low and high end of the range with a colon. For example, 1000:1100.
Protocol Transport protocol used for communication.
N
OTE
Layer 4 firewall rules can also be created from the Flow Monitoring report. See “Add an App Firewall
Rule from the Flow Monitoring Report” on page 65.