vShield Administration Guide
74
VMware, Inc.
5
Double-click the row and type a name for the group.
6
Click
Add
.
After security group creation is complete, assign resources to the group.
Assign Resources to a Security Group
You can assign virtual machines and network adapters to a security group. These resources have associated IP
addresses that define the source or destination parameters for which an App Firewall rule enforces an access
policy.
To assign resources to a security group
1
Click a datacenter resource from the vSphere Client.
2
Click the
vShield App
tab.
3
Click
Security Groups
.
4
Click the arrow next to the name of a security group to expand the details of the group.
5
Select a vNIC from the drop-down list and click
Add
.
The selected vNIC appears under vNIC Membership.
Repeat these steps for each vNIC you want to place in this security group.
6
Click
Commit
.
After assigning resources, add the security group to a firewall rule as a container. See
“Create an App
Firewall Rule”
on page 71.
Validating Active Sessions against the Current App Firewall Rules
By default, a vShield Edge matches firewall rules against each new session. After a session has been
established, any firewall rule changes do not affect active sessions.
The CLI command
validate sessions
enables you to validate active sessions that are in violation of the
current rule set. You would use this procedure for the following scenarios:
You updated the firewall rule set. After a firewall rule set update, you should validate active sessions to
purge any existing sessions that are in violation of the updated policy.
You viewed sessions in Flow Monitoring and determined that an existing or historical flow requires a new
access rule. After creating a firewall rule that matches the offending session, you should validate active
sessions to purge any existing sessions that are in violation of the updated policy.
After the App Firewall update is complete, issue the
validate sessions
command from the CLI of a vShield
App to purge sessions that are in violation of current policy.
To validate active sessions against the current firewall rules
1
Update and commit the App Firewall rule set at the appropriate container level.
2
Open a console session on a vShield App issue the
validate sessions
command.
vShieldApp> enable
Password:
vShieldApp# validate sessions
Summary of Contents for VSHIELD APP 1.0.0 UPDATE 1 - API
Page 9: ...VMware Inc 9 vShield Manager and vShield Zones...
Page 10: ...vShield Administration Guide 10 VMware Inc...
Page 14: ...vShield Administration Guide 14 VMware Inc...
Page 18: ...vShield Administration Guide 18 VMware Inc...
Page 24: ...vShield Administration Guide 24 VMware Inc...
Page 34: ...vShield Administration Guide 34 VMware Inc...
Page 42: ...vShield Administration Guide 42 VMware Inc...
Page 46: ...vShield Administration Guide 46 VMware Inc...
Page 47: ...VMware Inc 47 vShield Edge and Port Group Isolation...
Page 48: ...vShield Administration Guide 48 VMware Inc...
Page 57: ...VMware Inc 57 vShield App and vShield Endpoint...
Page 58: ...vShield Administration Guide 58 VMware Inc...
Page 62: ...vShield Administration Guide 62 VMware Inc...
Page 68: ...vShield Administration Guide 68 VMware Inc...
Page 78: ...vShield Administration Guide 78 VMware Inc...
Page 85: ...VMware Inc 85 Appendixes...
Page 86: ...vShield Administration Guide 86 VMware Inc...
