User manual VMWARE VSHIELD ENDPOINT 1.0.0 UPDATE 1 API PROGRAMMING GUIDE

[. . . ] vShield API Programming Guide vShield Manager 4. 1. 0 Update 1 vShield Zones 4. 1. 0 Update 1 vShield App 1. 0. 0 Update 1 vShield Edge 1. 0. 0 Update 1 vShield Endpoint 1. 0. 0 Update 1 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www. vmware. com/support/pubs. EN-000434-01 vShield API Programming Guide You can find the most up-to-date technical documentation on the VMware Web site at: http://www. vmware. com/support/ The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: docfeedback@vmware. com Copyright © 2010 VMware, Inc. and international copyright and intellectual property laws. [. . . ] Revert to an SNAT Configuration by Snapshot Timestamp Request: PUT <vshield_manager-uri>/api/1. 0/network/<internal-portgroup-vc-moref-id>/ snat/snapshot/<snapshot-timestamp> Delete All SNAT Rules on a vShield Edge Example 5-18. Delete All SNAT Rules on a vShield Edge Request: DELETE <vshield_manager-uri>/api/1. 0/network/<internal-portgroup-vc-moref-id>/snat/rules Example: DELETE /api/1. 0/network/network-244/snat/rules HTTP/1. 1 Authorization: Basic YWRtaW46ZGVmYXVsdA== Host:sdfsdf Managing DNAT Rules DNAT maps public addresses to internal addresses. If you use Port Group Isolation, you must configure DNAT rules to allow traffic from the external network to the internal network. The vShield Edge supports two forms of DNAT: Traffic targeting a public address is forwarded to an internal host with the given internal IP address. Traffic targeting a specific port of a public address is forwarded to an internal host with the given internal IP address on the specified port. Get the DNAT Rule Set Example 5-19. Get the DNAT Rule Set on a vShield Edge Request: GET <vshield_manager-uri>/api/1. 0/network/<internal-portgroup-vc-moref-id>/dnat/rules 30 VMware, Inc. Chapter 5 vShield Edge Management Example: GET /api/1. 0/network/network-244/dnat/rules HTTP/1. 1 Authorization: Basic YWRtaW46ZGVmYXVsdA== Host: localhost Post a DNAT Rule Set You can post a DNAT rule set for a vShield Edge. The vShield Manager processes the posted XML file as a complete rule set for the specific vShield Edge. The current rule set is replaced with this new set of rules. Post a DNAT Rule Set on a vShield Edge Request: POST <vshield_manager-uri>/api/1. 0/network/<internal-portgroup-vc-moref-id>/dnat/rules <VShieldEdgeConfig> <NATConfig> <NATRule> <protocol>tcp|udp|icmp|any</protocol> <internalIpAddress>see_below</internalIpAddress> <internalPort>see_below</internalPort> <externalIpAddress>see_below</externalIpAddress> <externalPort>see_below</externalPort> </NATRule> </NATConfig> </VShieldEdgeConfig> Rules: You can add multiple DNAT rules by entering multiple <NATRule></NATRule> sections in the body. For <protocol /> options tcp and udp, you must specify internalPort and externalPort elements. For options icmp and any, the internalPort and externalPort elements are not expected. You must add <icmpType /> if you configure icmp as the protocol. To enable logging, add a <log /> element within <NATRule />. The externalIpAddress and internalIpAddress parameters can be entered in either of these formats. <ipAddress>IpOrAny</ipAddress> or <IpRange> <rangeStart>low_ip_address</rangeStart> <rangeEnd>high_ip_address</rangeEnd> </IpRange> The externalPort and internalPort parameters can be entered in either of these formats. <port>PortOrAny</port> or <PortRange> <rangeStart>low_port</rangeStart> <rangeEnd>high_port</rangeEnd> </PortRange> VMware, Inc. 31 vShield API Programming Guide Example: Multiple DNAT Rules POST /api/1. 0/network/network-244/dnat/rules HTTP/1. 1 content-type: application/xml; charset=UTF-8 Authorization: Basic YWRtaW46ZGVmYXVsdA== Host: 10. 112. 196. 213 accept: text/html, image/gif, image/jpeg, *; q=. 2, */*; q=. 2 content-length: 617 <?xml version="1. 0" encoding="UTF-8" standalone="yes"?><VShieldEdgeConfig><NATConfig><NATRule><protocol>tcp </protocol><internalIpAddress><ipAddress>172. 16. 1. 11</ipAddress> </internalIpAddress><internalPort><port>any</port></internalPort> <externalIpAddress><ipAddress>10. 112. 196. 217</ipAddress></externalIpAddress> <externalPort><port>any</port></externalPort></NATRule><NATRule><protocol>icmp </protocol><icmpType>any</icmpType><internalIpAddress><ipAddress>172. 16. 1. 11 </ipAddress></internalIpAddress><externalIpAddress><ipAddress>10. 112. 196. 218 </ipAddress></externalIpAddress></NATRule></NATConfig></VShieldEdgeConfig> DNAT Rule with IP Range content-length: 453 <?xml version="1. 0" encoding="UTF-8" standalone="yes"?><VShieldEdgeConfig><NATConfig><NATRule><protocol>tcp </protocol><internalIpAddress><IpRange><rangeStart>172. 17. 1. 10</rangeStart> <rangeEnd>172. 17. 1. 15</rangeEnd></IpRange></internalIpAddress><internalPort> <port>any</port></internalPort><externalIpAddress><ipAddress>10. 112. 196. 219 </ipAddress></externalIpAddress><externalPort><port>any</port></externalPort> </NATRule></NATConfig></VShieldEdgeConfig> DNAT Rule with Port Range content-length: 518 <?xml version="1. 0" encoding="UTF-8" standalone="yes"?><VShieldEdgeConfig><NATConfig><NATRule><protocol>tcp </protocol><internalIpAddress><ipAddress>172. 17. 1. 11</ipAddress> </internalIpAddress><internalPort><PortRange><rangeStart>15</rangeStart> <rangeEnd>19</rangeEnd></PortRange></internalPort><externalIpAddress> <ipAddress>10. 112. 196. 219</ipAddress></externalIpAddress><externalPort> <PortRange><rangeStart>9915</rangeStart><rangeEnd>9919</rangeEnd></PortRange> </externalPort></NATRule></NATConfig></VShieldEdgeConfig> DNAT Rule with IP and Port Range content-length: 627 <?xml version="1. 0" encoding="UTF-8" standalone="yes"?><VShieldEdgeConfig><NATConfig><NATRule><protocol>tcp </protocol><internalIpAddress><IpRange><rangeStart>172. 17. 1. 15</rangeStart> <rangeEnd>172. 17. 1. 19</rangeEnd></IpRange></internalIpAddress><internalPort> <PortRange><rangeStart>15</rangeStart><rangeEnd>19</rangeEnd></PortRange> </internalPort><externalIpAddress><IpRange><rangeStart>10. 112. 196. 215 </rangeStart><rangeEnd>10. 112. 196. 219</rangeEnd></IpRange></externalIpAddress> <externalPort><PortRange><rangeStart>9915</rangeStart><rangeEnd>9919 </rangeEnd></PortRange></externalPort></NATRule></NATConfig> </VShieldEdgeConfig> 32 VMware, Inc. Chapter 5 vShield Edge Management Get Timestamps of Last 10 DNAT Rule Configurations for a vShield Edge Example 5-21. Get Last 10 DNAT Rule Set Snapshots Request: GET <vshield_manager-uri>/api/1. 0/network/<internal-portgroup-vc-moref-id>/dnat/snapshots Get DNAT Configuration by Snapshot Timestamp Example 5-22. Get DNAT Configuration by Snapshot Timestamp Request: GET <vshield_manager-uri>/api/1. 0/network/<internal-portgroup-vc-moref-id>/ dnat/snapshot/<snapshot-timestamp> Revert to an DNAT Configuration by Snapshot Timestamp Example 5-23. Revert to an DNAT Configuration by Snapshot Timestamp Request: PUT <vshield_manager-uri>/api/1. 0/network/<internal-portgroup-vc-moref-id>/ dnat/snapshot/<snapshot-timestamp> Delete All DNAT Rules Example 5-24. Delete All DNAT Rules on a vShield Edge Request: DELETE <vshield_manager-uri>/api/1. 0/network/<internal-portgroup-vc-moref-id>/dnat/rules Example: DELETE /api/1. 0/network/network-244/dnat/rules HTTP/1. 1 Authorization: Basic YWRtaW46ZGVmYXVsdA== Host:localhost Configuring the vShield Edge Firewall The vShield Edge provides firewall protection for incoming and outgoing sessions. The default firewall policy allows all traffic to pass. In addition to the default firewall policy, you can configure a set of rules to allow or deny traffic sessions to and from specific sources and destinations. You manage the default firewall policy and firewall rule set separately for each vShield Edge agent. All firewall rules for a vShield Edge configured by using REST requests appear under the vShield Edge > Firewall tab for the appropriate vShield Edge in the vShield Manager user interface and vSphere Client plug-in. [. . . ] Please refer the Error Schema for more details. data from VC failed for <> 40017=hostId is malformatted or of incorrect length : <> Uninstalling the vShield Endpoint Service from an ESX Host Before you uninstall the vShield Endpoint from the vShield Manager and ESX host, you must unregister the SVM from the vShield Endpoint service. CAUTION If any of the virtual machines that are running on the target ESX host cannot be migrated to another ESX host, these virtual machines must be powered off or migrated manually before the uninstallation can continue. Unregister an SVM from vShield Endpoint You must specify the virtual machine ID of the SVM to unregister the SVM from the vShield Endpoint service. Unregistering an SVM from vShield Endpoint Request: DELETE <vshieldmanager-uri>/endpointsecurity/svm/<vmId> Example: DELETE /api/1. 0/endpointsecurity/svm/vm-1234 HTTP/1. 1 host: 10. 112. 199. 123:80 Authorization: Basic YWRtaW46ZGVmYXVsdA== Response: HTTP HTTP HTTP HTTP 204 No Content: The Endpoint Security VM is successfully unregistered. [. . . ]