VMware VSHIELD APP 1.0.0 UPDATE 1 - API, Руководство администратора

Страница: 74 / 144

vShield Administration Guide
74 VMware, Inc.
5 Double-click the row and type a name for the group.
6 Click Add .
After security group creation is complete, assign resources to the group.
Assign Resources to a Security Group
You can assign virtual machines and network adapters to a security group. These resources have associated IP
addresses that define the source or destination parameters for which an App Firewall rule enforces an access
policy.
To assign resources to a security group
1 Click a datacenter resource from the vSphere Client.
2 Click the vShield App tab.
3 Click Security Groups .
4 Click the arrow next to the name of a security group to expand the details of the group.
5 Select a vNIC from the drop-down list and click Add .
The selected vNIC appears under vNIC Membership.
Repeat these steps for each vNIC you want to place in this security group.
6 Click Commit .
After assigning resources, add the security group to a firewall rule as a container. See “Create an App
Firewall Rule” on page 71.
Validating Active Sessions against the Current App Firewall Rules
By default, a vShield Edge matches firewall rules against each new session. After a session has been
established, any firewall rule changes do not affect active sessions.
The CLI command validate sessions enables you to validate active sessions that are in violation of the
current rule set. You would use this procedure for the following scenarios:

You updated the firewall rule set. After a firewall rule set update, you should validate active sessions to
purge any existing sessions that are in violation of the updated policy.

You viewed sessions in Flow Monitoring and determined that an existing or historical flow requires a new
access rule. After creating a firewall rule that matches the offending session, you should validate active
sessions to purge any existing sessions that are in violation of the updated policy.
After the App Firewall update is complete, issue the validate sessions command from the CLI of a vShield
App to purge sessions that are in violation of current policy.
To validate active sessions against the current firewall rules
1 Update and commit the App Firewall rule set at the appropriate container level.
2 Open a console session on a vShield App issue the validate sessions command.
vShieldApp> enable
Password:
vShieldApp# validate sessions