360 Virtualization Security

Installation Guide

Version 7.0

Date 2017-9-1

1

Content

Installation Guide (VMware NSX) ...................................................................................................... 2

1. Preparations of Installation ............................................................................................... 2

2. Create and Add Distributed network ................................................................................ 3

3. Install NSX Manager .......................................................................................................... 5

4. Register vCenter Server To NSX Manager ....................................................................... 20

5. Add and Distribute License ............................................................................................. 23

6. Configure the Agent Virtual Machine ............................................................................. 27

7. Install Guest Introspection ................................................................................................... 28

8. Install and configure Management Center .......................................................................... 33

8.1Management Center of Installation ........................................................................... 33

8.2 Configure Management Center ................................................................................. 48

9. Deploy Security VM ............................................................................................................. 57

10 Configure security groups and security policy ................................................................... 65

10.1 Configure security group ......................................................................................... 65

10.2 Configure security policy ......................................................................................... 68

10.3 Apply Security Policy ............................................................................................ 71

11. Install VMware-tools in Protected windows VM ............................................................... 73

12. Install Guest Introspection in Protected Linux VM ............................................................ 76

13.Uninstall the Security Modules of Host .............................................................................. 79

14. Troubleshooting ................................................................................................................ 83

Appendix： ............................................................................................................................. 88

1. Install ESXi Host and vCenter ............................................................................................... 88

2.Add ESXi Host to vCenter ................................................................................................... 101

3.Windows operating system supports: ................................................................................ 103

4.Linux operating system supports: ...................................................................................... 103

2

Installation Guide (VMware NSX)

1. Preparations of Installation

1) Related software of VMware

ESXi host

vCenter

NSX Manager

2) NSX security modules

Guest Introspection

3) IP of Guest Introspection and NSVM security VM

4) Version introduction of and NSX Manager and ESXi

3

2. Create and Add Distributed network

Premise：Host has at least 2 network card to configure distributed network

1) Login vCenter via vSphere Client

2) Click “Inventory- Inventory -Networking” to enter into network configuration

3) Select data center, click “Add a vSphere Distributed Switch” in the right side.

4

4) Select corresponding version in the dialog box of “Create vSphere Distributed

Switch”, configure “Number of Uplink ports” as 1 in the tab page of “General

Properties”, because only one network card needs to be added in distributed

switch, click “Next”.

5) In the tab page of “Add Hosts and Physical Adapters” select “Add now”,

select host and physical adapter, click “Next” till finish.

5

6) Back to the page of host and cluster, click host, click “Configuration-Network

Adapters” to view, another extranet card has been added to distributed switch.

3. Install NSX Manager

Recommend that users use OVF template to deploy NSX Manager, it will be more quick and

convenient, taking the template of 6.3NSX-Manager as an example,

VMware-NSX-Manager-6.3.1-5124716.ov

1) Select the host which need be installed with NSX Manager, then click menu “File”- Depoly

OVF Template”, open the dialog box of “Deploy OVF Template” as following:

6

2) Click the button of “ Browse” in the dialog box, select the template of NSX Manager, click

the “Next”

3) Click “Next “ in the page of “OVF template Details”

7

4) Select “Accept”, and click the button of “Next” in the page of End User License

Agreement.

8

5) In the page of “Name and location” configure the name of NSX Manager, and click “Next”

9

6) Select the resource pool within which you wish to deploy this template in the page of

“ Resource Pool”, then click “Next”

10

7) Select a destination storage for the virtual machine files in the page of “Storage”, then

click “Next”

11

8) Click “Next” in the page of “Disk Format”

12

9) Select the Destination Network int the page of “Network Mapping”, then click “Next”

13

10) Configure the password for the WebUI and CLI of the NSX Manager In the page of

“Properties”, network parameter, the server address of NTP, select to enable SSH, and click

“Next”

14

15

16

11) Select “Turn on the power after deployment” and Click “Finish” in the page of “Ready to

Complete”

17

12) The system starts to deploy NSX Manager,and it shows the process.

18

13) After deployment, it will operate the command of “show interface” in the CLI of NSX

Manager to verify the IP address just deployed has applied as expected.

Make sure that NSX Manager can execute the operation of ping on its default gateway,

NTP server, VCenter Server and ESXi host IP

14) Open the WebUI of NSX Manager, Login via the admin user and password

19

15) Click “View Summary“ in the opened page

16) Make sure that VPostgres, RabbitMQ and NSX Management Service are running in the

page of Summary

20

4. Register vCenter Server To NSX Manager

1) Open the WebUI of NSX Manager, Login via admin user and password

2) In the homepage click Manager vCenter Registration

3) Click the button of “Edit” in the right side of vCenter Server page

21

4) Input the address, user name and password of vCenter Server in the dialog box. About user

name, the best choice is the user of administrator@vsphere.local, not root user.

5) Select “Yes” in the page of “ Trust Certificate”

22

6) If the state of vCenter Server is connected, it shows that the registration is successful.

7) Use vsphere Web Client to Login vCenter Server

8) There is an icon of “Network & Security” in the homepage of Vsphere Web Client

23

5. Add and Distribute License

PS: if it is unnecessary to use network, please skip this step.

1) Enter into the page of “Administration” in home page

24

2) Enter into the page of “ Licenses” in “Administration”

25

3) Click the button of “+” in the page, add licenses related with network

4) Input the password of license, configure license name in the dialog box of “ New

Licenses”, then click “Finish”

26

5) In the tab page of “Assets”- “Solutions” select NSX for vSphere, click the button of

“Distribute License”

27

6) Select the license just added in the dialog box, click “OK”.

6. Configure the Agent Virtual Machine

1) Use vsphere Web Client to Login vCenter Server

28

2) Select ESXi host in the page, and turn to the page of “Manager”-”Agent VM Settings”, then

click the button of “Edit” in the right side.

3) In the page of “Agent VM Settings” select correct data store and VM network, then click

“OK”

7. Install Guest Introspection

1) Enter into the page of ”Service Deployments” in the module of network and security,

click the button of “+”

29

2) Open the guide of “ Deploy Network & Security Services”, and select “Guest

Introspection” in the page of “Select service & Schedule”, then click “Next”

3) Select Datacenter and cluster of ESXi hostin the page of “Select clusters”, then click

“Next”

30

4) Configure correct data storage and network in the page of “Select storage and

Management Network”, IP is DHCP by default.

Users can also distribute IP via IP pool, click the button of “ Change”, select “ Use IP

pool” in the dialog box of “Select IP Assignment mode” and click “+” to add static IP

pool.

31

5) Click “Finish” in the page of “ Ready to Complete”

6) After clicking “Finish”, you can see the service of Guest Introspection just added in the

page of service deployment

32

7) The ESXi host will automatically create a virtual machine named after Guest

Introspection

PS: Please make sure that the network selected and NSX Manager are in the same network

segment when the user configure the network of Guest Introspection.

33

8. Install and configure Management Center

8.1Management Center of Installation

Management center can be installed in physical machine or virtual machine

The following is an introduction to VMware virtual machine installation:

Now uploading the media of installation ics-ctrl-7.0.0-2279.x86_64.iso to the

physical server.

Open the interface of vSphere client, select a physical server

Right click data store object, for example：datastore164

34

Double-click ISO folder

35

Open the interface of vSphere client, select the physical server on which you will

36

deploy the virtual machine.

37

38

39

40

41

42

43

44

Tick: Edit settings of virtual machine before finishing

Click the button of “Continue”

Here you can alter the CPU 、memory of virtual machine.

The scale of physical

servers management

Configuration suggestion

1~20s 4CPU，16G memory

20~50s 8CPU，32G memory

More than 50s 16CPU，64G memory

45

Select the iso file just uploaded.

46

Right-click to open virtual machine console

Virtual machine starts from ISO, user will get 60s to consider that whether to

confirm installation or not (If there is no any operation after 60s, it will confirm

installation), after pressing “Enter”, it starts to install.

47

After the installation is completed, you will see the notice of Reboot, select Reboot

to complete installation.

48

8.2 Configure Management Center

1. Configure IP address

Because management center is responsible for the security of all

hosts and virtual machines, it need communicate with all physical

machine loaded with virtual machines, the IP is very important

and it can not be changed after configuration, we suggest that

users use static IP address. The method of configuration is as

follows:

1) After the installation and reboot, it will enter into the page of

management center xconsole.

49

Select“Configure System”, and press “Enter”

Select“Configure Network”，and press “Enter”

Select“Configure Interface”，and press “ Enter”

50

Input default password vmsecadmin，and press “ Enter”

Select network card, and press “Enter”

51

Select“Static”, configure static IP

Input correct IP address, mask and gateway, and

press”Enter”.

52

System starts to configure interface again.

After configuration, IP becomes static pattern.

53

2. Change password(we suggest changing)

Administrator can change the password of logging on xconsole in

management center .

Select “Authentication” in the xconsole，and press “Enter”

Select “Change Password”and press “Enter”

54

Input old password and new password, then confirm new

password in the dialog box.

After pressing “Enter”, system will notice you that password has

been changed successfully.

55

3. Login management center:

The way of logging on management center is

https://X.X.X.X:8443（X.X.X.X.This is the IP in the first step for

management center），its default user name and password are

admin/sysadmin，administrator Login the system, then go to the

page of “management” --“user management” to add or

delete user

The process of activating product

After logging in the management center via user name and password, click the link

of “System- Settings- License” in the page.

The page will skip to the page of “System”- “Settings”- “License”.

Click “Update license”, and click “select file” in the dialog box.

56

Select the correct license file, then click “OK”

After updating license, the states of system security modules are updated

to“activated”.

57

9. Deploy Security VM

1) Add VMware vSphere host

a) Enter into the page of “Assets” - “hosts” in management center, click “New”,and

open the dialog box of “Add Pool”, then select virtual machine platform, type is

VMware vCenter, then input name, vCenter address, user name

(administrator@vsphere.local) and password, and the security solution is NSX(Only

enable anti-malware), then input the address, user name and password of NSX, last

click “OK”.

It will register NSVM Security Serivce in NSX automatically after adding successfully.

b) After adding successfully, user can see ESXi host in the page of host, its state is

“uninstalled security modules”

58

2) Deploy NSVM Security Service

a) Use vsphere web client to Login vCenter Server

b) Enter into the page of Installation-Service Deployment in the module of network

and security, then click the button of “+”.

59

c) In the guide of “Deploy network and security service” select “NSVM Security

Service”, then click “Next”.

60

d) In the page of “Select clusters”, select the cluster, then click “Next”

61

e) In the page of “ Select storage and Management Network” select that data and

network are “Specified on-host”, select the “Distributed port group” and click

“Next” till finish.

f) Click “Finish”

62

g) AS the following picture, after clicking “Finish”, the page of Service Deployment will

show that the state of NSVM Security Service installation status is scheduled for

install, and the service status is unknown.

h) After about 1 minute, the installation state of NSVM Security Service is succeeded,

and service status is up

63

i) There are some virtual machines named after NSVM Security Service in vCenter,

each vm for one host.

j) Edit the settings of VM, Change the third network card of NSVM to

vmservice-vshield-pg

64

k) The service is available in the page of “Service Definitions-Services/ Service

Managers” .

65

l) In the page of management center, the connection status of this host is connected.

PS：When the number of host is large, the speed of synchronization maybe slows,

just waiting for several minutes.

10 Configure security groups and security policy

10.1 Configure security group

1) Return to homepage, enter into the page of “Service Composer”--”Security

Groups”, click the button of “create new security groups”, then input the name of security

groups in the guide of “New Security Group” , then click “Next” .

66

2) In the TabPage of “ Select the objects to include”, select the type of object “Virtual

machine”, then select the virtual machine which need to be protected in the following

object type box, click the button of , then click “Next”.

67

3) Click “Next”until Finishing.

68

10.2 Configure security policy

1) Enter into the page of “Service-Composer”-“Security Policies”, then click the

button of “Create security policy”.

2) In the guide of “New Security Policy”, configure the name of security policy, then

click “Next”

69

3) Click the button of “+” in the TabPage of Guest Introspection Services

4) In the dialog box of “Add Guest Introspection Service” configure name and

operation, and then select applied and enabled, consent to implement by force, click “Next”.

70

5) Click “Next”until Finish

71

10.3 Apply Security Policy

1) Select the security policy and right click, and then click “ Apply policy” in the open

menu.

72

2) In the dialog box of “Security policy”–“Apply Policy to Security Groups” select

security group created before and click “OK”.

73

3) The application object value of security policy is updated to 1.

11. Install VMware-tools in Protected windows VM

1) Login vSphere Web Client（URL is https://x.x.x.x）

74

2) Select the virtual machine to be protected in the page and enter into the TabPage of

“Summary”, and then click “Install VMware Tools” in the right side of page.

3) Select “Mount” in the dialog box of “Install VMware Tools”.

4) Enter into the virtual machine, open DVD driver.

5) Double click the file of setup.exe, and start to install vm-tools

6) Click “Next” in the dialog box of “ VMware Tools Setup”.

7) Select “Custom’, and then click “Next”.

75

8) Search “VMCI driver” in the tree diagram of figure, select and install “NSX File Introspection

driver”, and then click “Next”.

Versions after vSphere 5.5 U2 are as following:

76

Versions before vSphere 5.5 U2 should search“VMCI driver”, and select to install

“vShield Drivers”to local disk.

9) Click “Install” in the dialog box.

10) After finishing installation, you will get a notice to reboot the system, select “Yes”.

11) Enter into the page of “Asset management”–“Virtual machine/terminal” in the management

center, as the followingpicture; you can see the real-time prevention status of virtual machine

just installed is on state.

12. Install Guest Introspection in Protected Linux VM

Premise：

Make sure that agent and virtual machine have been installed ESX 5.1 or higher version

and Linux.

NSX Guest Introspection supports:

Linux operation system：

RHEL 7 GA（64 digit）

SLES 12 GA（64 digit）

Ubuntu 14.04 LTS（64 digit）

PS: Linux thin agent needs install Glib 2.0 in the target system.

Steps:

Please execute following steps through Root Privilege according to your Linus operating

system.

For Ubuntu System：

a. Use the following commands to get and import VMware to pack public keys：

curl -O

77

https://packages.vmware.com/tools/keys/VMWARE-PACKAGING-GPG-RSA-KEY.pub

apt-key add VMWARE-PACKAGING-GPG-RSA-KEY.pub

b. Create a new file named vm.list below /etc/apt/sources.list.d

c. Edit file and include contents as following：

vi /etc/apt/sources.list.d/vm.list

deb https://packages.vmware.com/packages/ubuntu/ trusty main

d. Now, please install software package like this:

apt-get update

apt-get install vmware-nsx-gi-file

For RHEL7 system：

a . Use the following commands to get and import VMware to pack public keys：

curl -O

https://packages.vmware.com/tools/keys/VMWARE-PACKAGING-GPG-RSA-KEY.pub

rpm --import VMWARE-PACKAGING-GPG-RSA-KEY.pub

b. Create a new file named vm. Repo below /etc/yum.repos.d

c. Edit file and include contents as following：

vi /etc/yum.repos.d/vm.repo

[vm]

name = VMware

baseurl = https://packages.vmware.com/packages/rhel7/x86_64

enabled = 1

gpgcheck = 1

metadata_expire = 86400

ui_repoid_vars = basearch

d. Now, please install software package like this:

yum install vmware-nsx-gi-file

For SLES system：

a. Use the following commands to get and import VMware to pack public keys：

curl -O

https://packages.vmware.com/tools/keys/VMWARE-PACKAGING-GPG-RSA-KEY.pub

rpm --import VMWARE-PACKAGING-GPG-RSA-KEY.pub

b. Add the following memory pool:

zypper ar -f "https://packages.vmware.com/packages/sle12/x86_64/" VMware

c. Now, please install software package like this:

zypper install vmware-nsx-gi-file

Check if the thin agent is running through the command “ service vsepd status” and

management prerogative, it should be running.

Install VMware Tools

a. Login vCenter via vSphere Web Client

78

b. Find “Host and Clusters” in the home page

c. Find the Linux host which needs to be protected, click “Install VMware Tools” in

the right side under the page of “Summary”.

d. Click “ Mount” in the dialog box of “Install VMware Tools”, and mount VMware

Tools to this Linux VM.

79

e. Enter into the console of VM Linux, install vmware tools via the command of “yum

install net-tools” and “yum install perl”

f. Mount the installation package of vmware-tools to /mnt directory

mount /dev/cdrom /mnt

g. Copy tar.gz in /mnt to path/

cp /mnt/VMwareTools-9.10.5-2981885.tar.gz /

h. Uncompress and install

tar zxvf VMwareTools-9.10.5-2981885.tar.gz

cd vmware-tools-distrib/

./vmware-install.pl

Reboot VM after finishing installation.

13.Uninstall the Security Modules of Host

1) Select VMware vSphere to be seleted in the page of “Asset-management”, click

“Delete”, then click “OK” in the dialog box.

2) Login vCenter via vSphere Web Client, enter into the page of

“Networking&Security”- “Service Composer”, select security group, right click to

delete.

80

3) Access to “Security Policies” of “Service Composer” , select the Sercurity policy and

right click “Delete”.

4) In the page of “Installation”-“Service Deployments”, select “NSVM Security Service”

and then click “Delete”

81

5) Right click“NSVM Security Service” of “Service Definition”, then click “Edit settings”

6) Select “NSVM Security Service” instance , right click “Delete”.

82

7) Select ”NSVM Security Service” in the page of “Service Definitions”, right click “Delete”.

83

8) In the “Remove service definition” dialog box, select “Delete service manager”, then

click “Yes”

14. Troubleshooting

1. Failed to add VMware NSX host

1) Please check configuration or practical examples related with NSVM service in

vCenter to make sure if they are deleted first, and please read chapter 13 “Un

stall the security module of host” in this file.

2) Enter into the page of NSX Manager to make sure that if the service status of

vPostgres, RabbitMQ and NSX Management Service are correct.

2. The VM cannot kill virus.

1) First Login Vcenter Vsphere Web Client, select “cluster” in the page of “ local

host and cluster”, then enter into the page of “ Monitor-Guest Introspection”,

and check if the description and status of host, NSVM Security Service, Guest

Introspection are correct.

84

2) Then according to the VM operating system for troubleshooting.

Windows VM

a) Enter into the page of “ Networking & Security” –“Service

Composer “–“Security Groups” in vCenter vSphere Web Client, and

click the value of VM in the Security Groups, then check if the

windows VM is included in the security groups in the dialog box.

85

b) Check if the configuration applied in this windows VM have turned

on “ Real-time protection”. Login management center, enter into

the page of “ Asset Management- VM/Terminal” to check the status

of “ Real-time protection”. If the status is not “ Real-time protection

on”, please change the security configuration matched and turn on

“ Real-time protection”.

c) Then check if this VM has already installed with VMware tools and

“NSX File Introspection Driver” by custom installation.

d) In the command line of VM to run “scquery vsepflt” and check if

the service is existing. The following picture1 shows that is normal;

the picture2 shows the service is unavailable.

Service is normal：

Service is unavailable, please install VMware tools again:

e) If the service is unavailable, please install VMware tools again, and

select the driver of NSX File Introspection under “ VMCI driver” by

custom installation. After installation, reboot VM and make sure

86

that VMware tools has been installed.

Versions before vSphere 5.5 U2 should search“VMCI driver”, and

select to install “vShield Drivers”to local disk

Find “VMCI driver” and select “vShield Drivers” to install it in local

disk.

PS：If there is not “ NSX File Introspection Driver” or the option

of “ vShield Drivers” like the picture above in the dialog box of

“VM ware Tools”, which means that the version of VMware Tools

is old, you need download the new version of VMware Tools. And

this is the website: https://packages.vmware.com/tools/esx

f) Check the security VM of host. Login this security VM through

console or SSH and execute the command of “ifconfig-a”, and the IP

of eth1 is as following:

87

g) Test security and the communication of VM. You can ping the

IP169.254.1.1 of vmsevice-nvmsec-pg from security VM. Security

process monitors TCP48651 port of this machine. If the protected

VM is enabled, it will connect with local 8000 port.

Linux VM

a) Make sure if the operating system of linux VM is supported, refer to

Appendix-Linux OS lists of support.

b) Enter into the page of “ Networking & Security”- “Service

Composer”-“Security Groups “ in vCenter vSphere Web Client, click

the value of “VM” lists in the page of security groups, then check if

the Linux VM is included by security groups in the dialog box.

88

c)

Check if the configuration applied in this linux VM have turned on

“ Real-time protection”. Login management center, enter into the

page of “ Asset Management- VM/Terminal” to check the status of

“ Real-time protection”. If the status isn’t “ Real-time protection on”,

please change the security configuration matched and turn on

“ Real-time protection”.

d) Enter into the command line of linux VM, check through the

command of service vseped status if the service status of vseped is

correct, and the normal is running.

Appendix：

1. Install ESXi Host and vCenter

1) Preparation and introduction of installation

Before installing ESXi host and vCenter, please prepare files as following:

ESXi installation file：

Task ESXi6.0 as an example, ESXi-6.0-Custom-e1000e_3.2.2.1.iso

VCenter installation file：

Take VCenter 6.0 as an example VMware-VCSA-all-6.0.0-3040890.iso

89

2) Install ESXi host

ESXi host’s installation is the same as the VMware, you can deploy it via referring to the

official file of VMware.

http://pubs.vmware.com/vsphere-60/index.jsp?topic=%2Fcom.vmware.vsphere.install.do

c%2FGUID-7C9A1E23-7FCD-4295-9CB1-C932F2423C63.html

3) Install VCenter

Introduction：The deployment of VMware vCenter Server Appliance（VCSA）6.0 is different

from the previous version, versions before version5.5 can be deployed quickly through

importing the file of OVA, but users must execute installing procedure in windows from

version6.0, then finish the deployment of VCSA through installation guide.

a. Download VMware-VCSA-all-6.0.0-3040890.iso from the official website.

b. Mount the virtual optical drive to the windows machine.

c. Enter into the directory of vsca to install plugin.

90

d. Installing step by step according to the guide of installation.

91

92

e. After finishing the installation of plugin, click vsca-setup.html and open VCSA

virtual machine guide of installation.

f. Click “ Install”.

93

g. In the page of “ End User License Agreement” select “Accept the items of

agreement”.

94

h. In the page of “ Connect to target server” input IP of ESXi host, user name and

password, then click “Next”.

i. In the dialog box of “Certificate Warning” select “Yes”.

95

j. In the page of “Set up virtual machine” input the name and root password of VCSA

virtual machine, and then click“Next”.

96

k. In the page of “Select deployment type” select default, and click “Next”.

l. In the page of “Set up Single Sign-on” input SSO password, domain name and all

sites use default, and then click “Next”.

97

m. In the page of “ Select appliance size” use default option, and then click “Next”.

n. In the page of “Select datastore” select the memory space of virtual machine, and

then click “Next”.

98

o. In the page of “Configure database” select “Use an embedded database”, and then

click “Next”.

99

p. In the page of “ Network settings” select correct network card, the system of IP

address is IPv4, Network Type is static, then configure IP, subnet mask, gateway, DNS, select

to sync the time of device with ESXi, and then click “ Next”.

q. Check whether the parameter is properly configured or not, click “Finish”.

100

r. After clicking “Finish”, starts the progress of installation.

101

4) Install vSphere Client

Download and install in the website

http://www.prolved.com/vsphere-client-downloads/is ok

2.Add ESXi Host to vCenter

1) Login VMwareVSphere Web Client through administrator@vsphere.local

2) Create Datacenter

102

3) Select Datacenter that just created and give a right click, then select “ New Cluster” in

the menu.

4) Input the name of cluster in the dialog box of “New Cluster”, enable DRS and click “OK”.

103

5) Select the cluster that just created, then click “Add a host”, then operate step by step

according to the guide of “Add host”

3.Windows operating system supports:

Windows XP SP3 and higher versions（32-digit）

Windows Vista（32-digit）

Windows 7（32/64-digit）

Windows 8（32/64-digit）- only vSphere 5.5

Windows 8.1 (32/64) - vSphere 5.5 Patch 2 and higher versions

Windows 10

Windows 2003 SP2 and higher versions（32/64-digit）

Windows 2003 R2（32/64-digit）

Windows 2008（32/64-digit）

Windows 2008 R2（64-digit）

Win2012 (64) - only vSphere 5.5

Win2012 R2 (64) - vSphere 5.5 Patch 2 and higher versions

4.Linux operating system supports:

RHEL 7 GA（64-digit）

104

CENTOS7 GA（64-digit）

SLES 12 GA（64-digit）

Ubuntu 14.04 LTS（64-digit）

105