Deploy agent-based protection in a vCloud environment

Applies to on-premise Deep Security software installations only

To enable vCloud integration, you must assign a minimum set of rights to the user accounts tenants will use to import their vCloud "Cloud Accounts" and you must configure the vCenter database to assign unique UUIDs to new virtual machines.

To deploy Deep Security protection agentlessly in a vCloud environment, see instead Deploy agentless protection in a vCloud environment.

Create a minimum rights role for vCloud account tenant users

The user accounts you create in vCloud Director that the Deep Security tenants will use to add their cloud accounts to their Deep Security Manager require only the All Rights > General > Administrator View right.

  1. Log in to vCloud Director.
  2. In the System tab, click on Administration.
  3. In the navigation panel on the left, click on Roles.
  4. Click the "plus" sign to create a new Role (for example, "DS_User").
  5. Select the Administrator View right in the All Rights > General folder.
  6. Click OK.

You can now assign this role to the user accounts you will give to Deep Security users to import their vCloud resources into the Deep Security Manager.

When providing a Deep Security user with their credentials, you must include the IP address of the vCloud Organization and instruct them that when importing the vCloud resources into their Deep Security Manager, their username must include "@orgName". For example if the vCloud account's username is kevin and the vCloud Organization you've given the account access to is called CloudOrgOne, then the Deep Security user must enter kevin@CloudOrgOne as their username when importing the vCloud resources. (For a vCloud administrator view, use @system.)
You can configure Deep Security Manager to use a proxy server specifically for connecting to instances being protected in Cloud Accounts. The proxy setting can be found in Administration > System Settings > Proxies > Proxy Server Use > Deep Security Manager (Cloud Accounts).

Assign unique UUIDs to new virtual machines

Deep Security requires that all protected virtual machines have unique UUIDs. Virtual machines created from a vApp template can be assigned duplicate UUIDs which can cause problems. To configure your vCloud database to assign unique UUIDs, set the CloneBiosUuidOnVmCopy property to zero (0) following VMware Knowledge Base article 2002506.

Enable the OVF Environment Transport for VMware Tools on your guest VMs

Enabling the OVF Environment Transport for VMware Tools on your guest VMs will expose the guestInfo.ovfEnv environment variable making it easier for Agents to uniquely identify their VMs to the Deep Security Manager. This will reduce the risk of VM misidentification.

  1. In vCloud Director, open the VM's Properties screen, go the Guest OS Customization tab and select the Enable guest customization checkbox. Click OK.
  2. In vCenter, select the same VM, open its Properties screen, go to the Options tab.
  3. Click vApp Options and select the Enabled radio button. OVF Settings will now be exposed.
  4. In OVF Settings, select the VMware Tools checkbox in the OVF Environment Transport area. Click OK.

If your VM is running, it must be restarted for the changes to take effect.

The data used by Deep Security are taken from the following properties: vmware.guestinfo.ovfenv.vcenterid and vmware.guestinfo.ovfenv.vcloud.computername.

Import computers from a VMware vCloud Organization Account

  1. In the Deep Security Manager, go to the Computers section, right-click Computers in the navigation panel and select Add vCloud Account to display the Add vCloud Account wizard.
  2. Enter a Name and Description of the resources you are adding. (These are only used for display purposes in the Deep Security Manager.)
  3. Enter the vCloud Address. (The hostname of the vCloud Director host machine.)
  4. Enter your User name and Password.
    Your User name must be in the form username@vcloudorganization.
  5. Click Next.
  6. Deep Security Manager will verify the connection to the cloud resources and display a summary of the import action. Click Finish.

The VMware vCloud resources now appear in the Deep Security Manager under their own branch under Computers in the navigation panel.

After adding the Cloud Provider resources, you must install an agent, activate the agent, and assign a policy to the computer (see Manually install the Deep Security Agent or Use a deployment script, and Activate the agent.)

Import computers from a VMware vCloud Air Virtual data center

  1. In the Deep Security Manager, go to the Computers section, right-click Computers in the navigation panel and select Add vCloud Account to display the Add vCloud Account wizard.
  2. Enter a Name and Description of the VMware vCloud Air virtual data center you are adding. (These are only used for display purposes in the Deep Security Manager.)
  3. Enter the Address of the VMware vCloud Air virtual data center.
    To determine the address of the VMware vCloud Air virtual data center:
    1. Log in to your VMware vCloud Air portal.
    2. On the Dashboard tab, click on the data center you want to import into Deep Security. This will display the Virtual Data Center Details information page.
    3. In the Related Links section of the Virtual Data Center Details page, click on vCloud Director API URL. This will display the full URL of the vCloud Director API.
    4. Use the hostname only (not the full URL) as the Address of the VMware vCloud Air virtual data center that you are importing into Deep Security.
  4. Enter your User name and Password.
    Your User name must be in the form username@virtualdatacenterid.
  5. Click Next.
  6. Deep Security Manager will verify the connection to the virtual data center and display a summary of the import action. Click Finish.

The VMware vCloud Air data center now appears in the Deep Security Manager under its own branch under Computers in the navigation panel.

After adding the Cloud Provider resources, you must install an agent, activate the agent, and assign a policy to the computer (see Manually install the Deep Security Agent or Use a deployment script and Activate the agent.)