Deploy agent-based protection in a vCloud environment

To enable vCloud integration, you must assign a minimum set of rights to the user accounts tenants will use to import their vCloud "Cloud Accounts" and you must configure the vCenter database to assign unique UUIDs to new virtual machines.

Create a minimum rights role for vCloud account tenant users

The user accounts you create in vCloud director that the Deep Security tenants will use to add their cloud accounts to their Deep Security Manager require only the All Rights > General > Administrator View right.

1. Log in to vCloud Director.
2. In the System tab, click on Administration.
3. In the navigation panel on the left, click on Roles.
4. Click the "plus" sign to create a new Role (for example, "DS_User").
5. Select the Administrator View right in the All Rights > General folder.
6. Click OK.

You can now assign this role to the user accounts you will give to Deep Security rsers to import their vCloud resources into the Deep Security Manager.

Configuring the vCenter database to assign unique UUIDs to new virtual machines

Deep Security requires that all protected virtual machines have unique UUIDs. Virtual machines created from a vApp template can be assigned duplicate UUIDs which can cause problems. However, you can configure your database to assign unique UUIDs to these VMs created from a template.

To configure the database to assign unique UUIDs to new virtual machines that are created from a template, you must set the CONFIG table of the database, with the parameter backend.cloneBiosUuidOnVmCopy, to 0.

To set this parameter in Oracle Database, launch Oracle Database Enterprise Manager and run the following commands:

set feedback on echo on

set linesize 120

update "VCLOUD"."CONFIG" set VALUE = '0' where NAME='backend.cloneBiosUuidOnVmCopy';

commit;

select * from "VCLOUD"."CONFIG" where VALUE = '0' and NAME='backend.cloneBiosUuidOnVmCopy';

To set this parameter in Microsoft SQL Server, launch SQL Server Management Studio and run the following commands:

USE VCLOUD

GO

update config set value = '0' where name='backend.cloneBiosUuidOnVmCopy'

select * from dbo.config where value = 0 and name='backend.cloneBiosUuidOnVmCopy';

When the parameter has been set, restart all cells in vCloud Director.

Enable the OVF Environment Transport for VMware Tools on your guest VMs

Enabling the OVF Environment Transport for VMware Tools on your guest VMs will expose the guestInfo.ovfEnv environment variable making it easier for Agents to uniquely identify their VMs to the Deep Security Manager. This will reduce the risk of VM misidentification.

1. In vCloud Director, open the VM's Properties screen, go the Guest OS Customization tab and select the Enable guest customization checkbox. Click OK.
2. In vCenter, select the same VM, open its Properties screen, go to the Options tab.
3. Click vApp Options and select the Enabled radio button. OVF Settings will now be exposed.
4. In OVF Settings, select the VMware Tools checkbox in the OVF Environment Transport area. Click OK.

If your VM is running, it must be restarted for the changes to take effect.

The data used by Deep Security are taken from the following properties: vmware.guestinfo.ovfenv.vcenterid and vmware.guestinfo.ovfenv.vcloud.computername.

Import computers from a VMware vCloud Organization Account

1. In the Deep Security Manager, go to the Computers section, right-click Computers in the navigation panel and select Add vCloud Account to display the Add vCloud Account wizard.
2. Enter a Name and Description of the resources you are adding. (These are only used for display purposes in the Deep Security Manager.)
3. Enter the vCloud Address. (The hostname of the vCloud Director host machine.)
4. Enter your User name and Password.
   Your User name must be in the form username@vcloudorganization.
5. Click Next.
6. Deep Security Manager will verify the connection to the cloud resources and display a summary of the import action. Click Finish.

The VMware vCloud resources now appear in the Deep Security Manager under their own branch under Computers in the navigation panel.

After adding the Cloud Provider resources, you must install an agent, activate the agent, and assign a policy to the computer (see Manually install the Deep Security Agent or Use a deployment script, and Activate the agent.)

Import computers from a VMware vCloud Air Virtual data center

1. In the Deep Security Manager, go to the Computers section, right-click Computers in the navigation panel and select Add vCloud Account to display the Add vCloud Account wizard.
2. Enter a Name and Description of the VMware vCloud Air virtual data center you are adding. (These are only used for display purposes in the Deep Security Manager.)
3. Enter the Address of the VMware vCloud Air virtual data center.
   To determine the address of the VMware vCloud Air virtual data center:
   

   1. Log in to your VMware vCloud Air portal.
   2. On the Dashboard tab, click on the data center you want to import into Deep Security. This will display the Virtual Data Center Details information page.
   3. In the Related Links section of the Virtual Data Center Details page, click on vCloud Director API URL. This will display the full URL of the vCloud Director API.
   4. Use the hostname only (not the full URL) as the Address of the VMware vCloud Air virtual data center that you are importing into Deep Security.
4. Enter your User name and Password.
   Your User name must be in the form username@virtualdatacenterid.
5. Click Next.
6. Deep Security Manager will verify the connection to the virtual data center and display a summary of the import action. Click Finish.

The VMware vCloud Air data center now appears in the Deep Security Manager under its own branch under Computers in the navigation panel.

After adding the Cloud Provider resources, you must install an agent, activate the agent, and assign a policy to the computer (see Manually install the Deep Security Agent or Use a deployment script and Activate the agent.)