User manual VMWARE VSHIELD EDGE DATASHEET

[. . . ] DATA S H E E T VMware vShield Edge Secure the Edge of the Datacenter AT A G L A N C E VMware vShield Edge, part of the vShield family of virtualization security products, provides comprehensive perimeter network security for virtual datacenters. [. . . ] ·SimplifyITcompliancewithdetailedlogging. ·Streamlinemanagementusingafull-featured interface that integrates with VMware vCenterTM Server and leading enterprise security solutions. How Does VMware vShield Edge Work? Network Security Gateway Deployed as a virtual appliance, vShield Edge provides firewall, VPN, Web load balancer, NAT, and DHCP services to monitor packet headers for source and destination IP addresses. Depending on policy, it can deny or allow connections, initiate and terminate VPN sessions, perform network address translation, or inspect data by source/destination port and protocol type (TCP or UDP). Port Group Isolation When deployed as a loadable kernel module on vSphere, port group isolation creates a barrier between the virtual machines protected by vShield Edge and the external network. This has the same effect as implementing VLANs but without the complexity of trunking switch connections and defining switch port mappings. VMware vShield Edge secures traffic between virtual datacenters with built-in perimeter security and port group isolation. How Is VMware vShield Edge Used? ·Consolidate edge security hardware ­ vShield allows customers to provision edge security services using existing vSphere resources, eliminating the need for edge security hardware to "air gap" vSphere hosts. P R O D U C T DATA S H E E T / 1 VMware vShield Edge ·Rapidly and securely provision virtual datacenter perimeters ­ vShieldEdgeallowsorganizationstoeasilycreatesecure, logical, hardware-independent perimeters ("edges") around virtual datacenter environments, making it easier to leverage shared network resources in multi-tenant IT infrastructures. ·Protect data confidentiality over shared networks ­ vShield Edge provides site-to-site VPN with 256-bit encryption to protect the confidentiality of all data transmitted across virtual datacenter perimeters. ·Ensure performance and availability of Web services ­ vShieldEdgeefficientlymanagesinboundWebtrafficacross virtual machine clusters and includes Web load balancing capabilities that customers can deploy in conjunction with port group isolation and edge security, or on its own. ·Facilitate compliance management ­ vShield Edge provides the necessary controls such as detailed event logging and flow statistics that enterprises need to demonstrate compliance with corporate policies, along with industry and government regulations. Web Load Balancing ·InboundloadbalancingforalltrafficincludingWebtraffic (HTTP, HTTPS) ·Round-robinalgorithm ·Supportfor"sticky"sessions Port Group Isolation ·Enforcedathypervisorlayertorestricttrafficwithinavirtual datacenter to specified port groups ·SameeffectasVLANsinvirtualorphysicalswitchenvironments Edge Flow Statistics ·Virtualdatacenterresourceutilizationmeteredandattributed back to tenant ·StatisticsaccessiblethroughRESTAPIsandleveragedin service provider chargeback applications Key Features Stateful Inspection Firewall Inbound and outbound connection control with rules based on the following parameters: ·IP address ­ source/destination IP address ·Ports ­ source/destination port ·Protocol ­ type (TCP or UDP) Policy Management ·Full-featuredmanagementthroughvShieldManager;many features also accessible through vCenter Server interface ·CustomizableinterfaceformanagementusingRESTAPIs ·SupportforintegrationwithenterpriseITsecurity management tools Logging and Auditing ·Basedonindustrystandardsyslogformat ·AccessiblethroughRESTAPIsandvShieldManagerUI ·Administrator-definedloggingon/offforkeyedgesecurity events (errors, warnings, etc. ): ­ Firewall: at rule level ­ NAT: at rule level ­ VPN: site-to-site connection name ­ Web load balancer: At pool level, specific Web requests including URL/folder ­ DHCP: At service level, bindings (release/renewals) Network Address Translation ·IPaddresstranslationto/fromthevirtualizedenvironment ·MasqueradingofvirtualdatacenterIPaddressesto untrusted locations Dynamic Host Configuration Protocol ·AutomaticIPaddressprovisioningtovirtualmachinesin vSphere environments ·Administrator-definedparameters(e. g. , addresspools, lease times, dedicated IP addresses, etc. ) Find Out More ForinformationortopurchaseVMwareproducts, call877-4-VMWARE(outsideofNorthAmericadial 650-427-5000), visit www. vmware. com/products, orsearchonlineforanauthorizedreseller. Fordetailed product specifications and systems requirements, refer to the VMware vShield Edge Administration Guide Site-to-Site VPN ·Securecommunicationbetweenvirtualdatacenters (or edge security virtual machines) ·IPsecVPN, basedontheInternetKeyExchange(IKE)protocol VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www. vmware. com Copyright © 2010 VMware, Inc. [. . . ] Item No: VMW_10Q3_DS_PROD_VSHIELD_EDGE_USLET_EN_R6 [. . . ]