Deploy agentless protection in a vCloud environment

Applies to on-premise Deep Security software installations only

VMware vCloud integration enables the primary tenant in a multi-tenant installation to add a vCenter to their Deep Security Manager, configure a connector, and to deploy and manage the Deep Security Virtual Appliance. The tenants can import vCloud Organizations as cloud accounts and apply agentless Deep Security protection to them.

In this topic:

Before you begin

  • Review this table to see which NSX licenses and versions are supported.
  • Review these system requirements.
  • If the features you want are not available agentlessly, use 'combined mode'.
  • If you configured guest VMs to have direct access to a network card, install agents on those VMs. In this case there is no opportunity to intercept packets and an in-guest agent is preferable. See Choose agentless vs. combined mode protection for details.

Enable agentless protection of vCloud VMs

  1. In the Deep Security Manager console, go to Administration > System Settings > Agents.
  2. Select the Allow Appliance protection of vCloud VMs check box.
  3. Click Save.

Create a multi-tenant environment

There are two main task required to create a multi-tenancy environment: you must enable multi-tenancy and then create tenants. For step-by-step instructions on how to perform these tasks, as well as requirements and recommendations for a multi-tenant environment, see Set up a multi-tenant environment.

Add a vCenter and deploy the Deep Security Virtual Appliance

The primary tenant must add a vCenter and deploy the Deep Security Virtual Appliance. For instructions, see Deploy the Deep Security Virtual Appliance with NSX Advanced or Enterprise.

Configure VMware vCloud resources for integration with Deep Security

To configure VMware vCloud resources for integration with Deep Security:

Create a minimum rights role for vCloud account tenant users

The user accounts you create in vCloud director that the Deep Security tenants will use to add their cloud accounts to their Deep Security Manager require only the All Rights > General > Administrator View right.

  1. Log in to vCloud Director.
  2. In the System tab, click on Administration.
  3. In the navigation panel on the left, click on Roles.
  4. Click the "plus" sign to create a new Role (for example, "DS_User").
  5. Select the Administrator View right in the All Rights > General folder.
  6. Click OK.

You can now assign this role to the user accounts you will give to Deep Security users to import their vCloud resources into the Deep Security Manager.

When providing a Deep Security user with their credentials, you must include the IP address of the vCloud Organization and instruct them that when importing the vCloud resources into their Deep Security Manager, their username must include "@orgName". For example if the vCloud account's username is kevin and the vCloud Organization you've given the account access to is called CloudOrgOne, then the Deep Security user must enter kevin@CloudOrgOne as their username when importing the vCloud resources. (For a vCloud administrator view, use @system.)
You can configure Deep Security Manager to use a proxy server specifically for connecting to instances being protected in Cloud Accounts. The proxy setting can be found in Administration > System Settings > Proxies > Proxy Server Use > Deep Security Manager (Cloud Accounts).

Assign unique UUIDs to new virtual machines

Deep Security requires that all protected virtual machines have unique UUIDs. Virtual machines created from a vApp template can be assigned duplicate UUIDs which can cause problems. To configure your vCloud database to assign unique UUIDs, set the CloneBiosUuidOnVmCopy property to zero (0) following VMware Knowledge Base article 2002506.

Enable the OVF Environment Transport for VMware Tools on your guest VMs

Enabling the OVF Environment Transport for VMware Tools on your guest VMs will expose the guestInfo.ovfEnv environment variable making it easier for agents to uniquely identify their VMs to the Deep Security Manager. This will reduce the risk of VM misidentification.

  1. In vCloud Director, open the VM's Properties screen, go the Guest OS Customization tab and select the Enable guest customization check box. Click OK.
  2. In vCenter, select the same VM, open its Properties screen, go to the Options tab.
  3. Click vApp Options and select the Enabled radio button. OVF Settings will now be exposed.
  4. In OVF Settings, select the VMware Tools check box in the OVF Environment Transport area. Click OK.

If your VM is running, it must be restarted for the changes to take effect.

The data used by Deep Security are taken from the following properties: vmware.guestinfo.ovfenv.vcenterid and vmware.guestinfo.ovfenv.vcloud.computername.

Activate virtual appliance protection on virtual machines

To activate virtual appliance protection, tenants must import vCloud Organization accounts and apply agentless Deep Security protection to them.

vCloud Organization accounts must be added by tenants (not the primary tenant).

Import computers from a VMware vCloud Organization Account

  1. In the Deep Security Manager, go to the Computers section, right-click Computers in the navigation panel and select Add vCloud Account to display the Add vCloud Account wizard.
  2. Enter a Name and Description of the resources you are adding. (These are only used for display purposes in the Deep Security Manager.)
  3. Enter the vCloud Address. (The hostname of the vCloud Director host machine.)
  4. Enter your User name and Password.
    Your User name must be in the form username@vcloudorganization.
  5. Click Next.
  6. Deep Security Manager verifies the connection to the cloud resources and displays a summary of the import action. Click Finish.

The VMware vCloud resources now appear in the Deep Security Manager under their own branch under Computers in the navigation panel.

Import computers from a VMware vCloud Air Virtual data center

  1. In the Deep Security Manager, go to the Computers section, right-click Computers in the navigation panel and select Add vCloud Account to display the Add vCloud Account wizard.
  2. Enter a Name and Description of the VMware vCloud Air virtual data center you are adding. (These are only used for display purposes in the Deep Security Manager.)
  3. Enter the Address of the VMware vCloud Air virtual data center.
    To determine the address of the VMware vCloud Air virtual data center:
    1. Log in to your VMware vCloud Air portal.
    2. On the Dashboard tab, click on the data center you want to import into Deep Security. This will display the Virtual Data Center Details information page.
    3. In the Related Links section of the Virtual Data Center Details page, click on vCloud Director API URL. This will display the full URL of the vCloud Director API.
    4. Use the hostname only (not the full URL) as the Address of the VMware vCloud Air virtual data center that you are importing into Deep Security.
  4. Enter your User name and Password.
    Your User name must be in the form username@virtualdatacenterid.
  5. Click Next .
  6. Deep Security Manager will verify the connection to the virtual data center and display a summary of the import action. Click Finish.

The VMware vCloud Air data center now appears in the Deep Security Manager under its own branch under Computers in the navigation panel.

Activate virtual appliance protection on virtual machines

To activate virtual appliance protection, right-click on a virtual machine in the Computers list and click Actions > Activate.