Add a VMware vCenter

vCenter

See Deploy Deep Security for steps that you must perform before proceeding with the steps in this article.

You can import a VMware vCenter into Deep Security Manager and then protect its virtual machines either agentlessly, with an agent, or in combined mode (For information on those options, see Choose agentless vs. combined mode protection.)

You cannot import a vCenter that is using vShield Manager. For information on migrating from vShield Manager to a supported VMware product, see Deploy Deep Security.

  1. Before you begin, make sure you've followed the NSX set-up steps to deploy the appliance with NSX.
  2. In Deep Security Manager, go to Computers > Add > Add VMware vCenter.
  3. Enter the vCenter server information:
    • Enter the vCenter server's IP address (or host name if DNS is configured and able to resolve FQDNs to IP addresses).
    • Enter the port number to connect to the vCenter (443 by default).
    • Enter the user name and password of a vCenter user account. This account must conform to the specifications in the table below. This user is required to synchronize the VM inventory between vCenter and Deep Security Manager.
      Protection methodNSX TypevCenter user account specifications
      agentless or combined modeVMware NSX Data Center for vSphere (NSX-V)

      The vCenter user account must have the following two roles:

      • Enterprise Administrator role assigned in NSX Manager. For information on assigning roles in NSX-V Manager, see this VMware article.
      • Administrator role assigned at the data center level in vCenter.

      agent only

      No NSX-V integration

      		The vCenter user account must have the vCenter Read Only role (or another role that has equal or greater privileges) at the data center level.

    Applying the Read Only or Administrator role at the Hosts and Clusters or Virtual Machine level in vCenter causes synchronization problems.

    • Click Next.
  4. Accept the vCenter TLS (SSL) certificate.
  5. Enter your NSX information as described below if you plan on using agentless or combined mode protection. Otherwise, click Next to skip this step.
    • Enter the NSX Manager IP address (or host name if DNS is configured and able to resolve FQDNs to IP addresses).
    • Enter the port number to connect to NSX Manager (443 by default).
    • Enter the user name and password of an NSX or vCenter user account. This account must conform to the specifications in the table below. This user is required to synchronize NSX security policies and security groups with Deep Security Manager.
      NSX TypeUser account specifications
      VMware NSX Data Center for vSphere (NSX-V)

      The user account must be:

      • the NSX built-in administrator account (which has full permissions)

      Or

      • a vCenter user account with the following two roles:
        • Enterprise Administrator role assigned in NSX Manager. For information on assigning roles in NSX-V Manager, see this VMware article.
        • Administrator role assigned at the data center level in vCenter. (Applying this role at the cluster level causes errors.)
    • Click Next.
  6. If prompted, accept the NSX Manager's TLS (SSL) certificate.
  7. Review the vCenter information and click Finish.
  8. The VMware vCenter has been successfully added message will be displayed. Click Close.The vCenter will appear on the Computers page.

    If you select Create an Event Based task to automatically activate VMs added to protected NSX Security Groups in this vCenter when adding the vCenter, Deep Security Manager will create two event-based tasks. One activates VMs when protection is added and the other deactivates VMs when protection is removed. For more information, see Automated policy management in NSX environments.

If you provided NSX information as described above, Deep Security Manager registers the Deep Security service within NSX Manager. The registration permits the deployment of the Deep Security service to the ESXi servers.

In a large environment with more than 3000 machines reporting to a vCenter Server, this process may take 20 to 30 minutes to complete. You can check the vCenter's Recent Task section to verify if there are activities running.

Deep Security Manager will maintain real-time synchronization with this VMware vCenter to keep the information displayed in Deep Security Manager (number of VMs, their status, etc.) up to date.

Once you've completed the above steps, move on to Prepare ESXi servers for NSX and appliances.