Skip to main content

BlastShield Documentation

VMware Gateway deployment for local VM protection on the ESXi host

This article explains how to install the BlastShield™ Gateway OVA in VMware ESXi 7 where the Gateway is configured with VLAN addressing mode to work as an active Gateway. The Gateway can be used to protect other VMs on the hypervisor, as shown in the picture below.

  • Using VLAN addressing mode will allow you to connect VM endpoints to the Gateway and create a virtual air-gap network to protect the VMs against unauthorized users.

  • Authorized BlastShield remote users will be able to connect in to the VM endpoints over the BlastShield™ network.

  • The VM endpoints will be isolated from unauthorised users and the Gateway will provide protection against unauthorized lateral movement in the protected network.

Figure 7. BlastShield™ Active Gateway in ESXi 7
BlastShield™ Active Gateway in ESXi 7

This figure shows an Active Gateway providing secure remote access and isolation of guest virtual machines running on the hypervisor. Optionally (shown), access to the VM kernel may also be protected by the Gateway.



Pre-requisites

  1. A VMware ESXi7 hypervisor with admin access.

  2. A BlastShield™ Orchestrator with administrator access..

  3. The ESXi hypervisor requires at least one physical NIC which is connected to the internet.

  4. You will require a copy of the Gateway OVA file. It can be downloaded from here.

  5. If you are using vCenter, then do not use a distributed vSwitch for the ‘BlastShield Downstream’ vSwitch because these cannot support the necessary VLAN configuration on the port group.

  6. By default, the gateway expects to receive an IP address via DHCP.  Manual assignment is also supported during the installation process.

Gateway Connectivity Requirements

  1. Outbound UDP ports to all required destinations.

  2. Resolution of DNS requests must be supported by the network.

Configure the vSwitches and Port Groups

An overview of the VMware networking configuration is shown below. This shows the connectivity between the BlastShield™ Gateway virtual machine, the protected virtual machines, port groups and vSwitches.

vmware-networking-updated.png

This procedure shows you how to add the BlastShield™ downlstream vSwitch and the port groups for the Gateway and for the protected VM endpoints.

From the ESXi host/Networking screen.

  1. Configure the vSwitches.

    Two vSwitches will be required as described below.

    1. Login to the ESXi client, and select Networking from the left hand menu. Then click on the Virtual Switches tab at the top of the main window

    2. From the Networking / Virtual Switches view the existing vSwitches and verify the hypervisor has the standard vSwitch to provide network connectivity, as shown below, often referred to as vSwitch0.

      1. vSwitch 0  

        This is the standard vSwitch for the hypervisor which should already exist.  This vSwitch will provide the physical uplink for the Gateway.

        vmware-networking-step1-1.png

      2. If this switch doesn't exist then you will need to add it. Click on the Add standard virtual switch in the networking tab to add it.

    3. Add a new vSwitch for the BlastShield Gateway.

      This vSwitch is created for downstream protected traffic and the protected guest hosts will connect to it.

      1. Click on the Add standard virtual switch in the networking tab to add it.. Give it the following settings

        1. vSwitch Name: BlastShield downstream

          It should not have an uplink to the external NIC and you should remove the default uplink.

        2. MTA: leave as default

        3. Link Discovery: leave as default

        4. Uplink 1: The vSwitch should not have an uplink to the external NIC and you should remove the default uplink.

          add-Blastshield-downstream-vswitch.png

    The completed vSwitich configuration for the Gateway is shown below.

    vmware-networking-step2-2.png

  2. Configure the port groups.

    1. Add VM Network and BlastShield Downstream port groups for the Gateway.

      1. From the ESXi client, select Networking from the left hand menu. Then click on the Port groups tab at the top of the main window.

      2. Click on Add port group

      3. Create the VM Network port group.  

        This port group is mapped to vSwitch 0 and is used to connect the Gateway instance to the network.

        1. Name: VM Network

        2. VLAN ID: 0

        3. Virtual switch: vSwitch 0

        4. Leave the other settings as default.

          add-VMnetwork-vSwitch.png

        5. Click Add to create the vSwitch.

      4. Create the Blasthield downstream port group.  

        This port group is mapped to the BlastShield downstream vSwitch.  It is assigned VLAN ID = 4095.

        Tip

        VLAN ID 4095 specifies that the port group should use trunk mode, also known as virtual guest tagging mode, which allows the guest operating system to manage its own VLAN tags.

      5. Click on Add port group.

        1. Name: Blastshield downstream

        2. VLAN ID: 4095

        3. Virtual switch: Blastshield downstream

        4. Leave the other settings as default.

        5. Click Add to create the vSwitch.

          add-Blastshield-downstream-port-group.png

    2. Add port groups for the protected VM endpoints which you will connect to the Gateway using the BlastShield downstream vSwitch.. Each endpoint port group requires an unique VLAN ID which is used by the Gateway to identify the endpoint.

      From the Networking User interface, add the following ports

      1. From the ESXi client, select Networking from the left hand menu. Then click on the Port groups tab at the top of the main window.

      2. Click on Add port group.

      3. Name: VM1 port group

      4. VLAN ID: 1

      5. Virtual switch: Blastshield downstream

        add-VM1_port_group.png

      6. Repeat for every VM endpoint that you wish to add to the Gateway, using a unique VLAN ID for each endpoint.

    The port groups are shown below. This example has two endpoint port groups (VM1 and VM2).

    all-port-groups.png
Install the BlastShield™ Gateway in ESXi 7

  1. Add a new Gateway in the Orchestrator.

    1. Connect to the Orchestrator and select Gateways from the left Menu.

    2. Select Add New Gateway from the Gateway List.

    3. Enter a name for the new Gateway.

    4. Select the Addressing Mode for the Gateway to be VLAN.

      gw_addressing_mode--VLAN.png

    5. Select Save and Download Invitation. You can chose to either download the invitation file or copy the contents to the clipboard. Retain the invitation file data as you will need it later when you install the Gateway OVA.

      vmware-gw-install-step1-1.png

  2. Download the Gateway OVA file.

    1. Download the Gateway OVA file from here and keep it available so that you can upload it to your ESXi server.

  3. Install the BlastShield Gateway™ OVA file on the ESXi client.

    Using the VMWare ESXi new virtual machine installer, the Invitation (.bsi) file generated in step 1 and the OVA file you downloaded in step 2 you will install the software on your ESXi hypervisor and bind it to the BlastShield™ Network. Below are the steps for this process.

    1. From the ESXi host, go to Virtual Machines / Create /Register VM / Create a virtual machine from an OVF/OVA file.

      vmware-gw-install-step3-1.png

    2. Give the new Gateway a name and select the BlastShield™ OVA file which you downloaded in the previous step.

      New-VM-select-OVF.png

    3. Leave the default datastore option.

      vmware-gw-install-step3-3.png

    4. Set the deployment options as shown:

      1. Public Network: VM Network port group.

      2. Protected Network: BlastShield Downstream port group.

      3. Deployment type: Inline gateway

      4. Leave the other settings as default.

        vmware-activegw-inline-esxi-deployment-options.png

    5. In Additional Settings, add the contents of the bsi file.

      1. BlastShield Invitation / Invitation contents (BSI): Paste the contents of the Gateway bsi file into the Invitation contents field.

        vmware-activegw-inline-esxi-additonal-settings2.png

      2. Network Configuration

        The network configuration sets the Gateway's local IP address, default gateway and DNS. For an inline Gateway, this refers to the upstream interface.

        1. To use DHCP to assign the IP address, default gateway and DNS, leave all three boxes blank in the Network Configuration section. This is the default option.

        2. If you are setting a manually assigned IP address, default gateway and DNS, then enter them in the Network Configuration boxes as described below.

          new-vm-optional-nw-config.png

          1. In the IP Address field, enter the IPv4 address and prefix length of the upstream network interface in CIDR format.

          2. In the Default Gateway field, enter the default gateway IPv4 address for the upstream network interface.

          3. In the DNS server field, enter the IPv4 address for the upstream network interface. If left blank, the Gateway will try public DNS.

      3. There is no need to add an SSH key for a Gateway installation. This will be automatically provided by the Orchestrator.

      4. Click next, then click finish to add the new Gateway virtual machine.

Tip

You can verify the Gateway has started by watching the console output in the hypervisor. When the Gateway is running and connected, the status in the Orchestrator will indicate ONLINE as shown in the image below.

vmware-active-gw-new-endpoint-online.png
Troubleshooting if your Gateway status does not come Online

  1. Ensure you have pasted the contents of the bsi file from the Orchestrator into the Additional settings step of the Create/Register VM procedure when you install the Gateway OVA on the hypervisor.

  2. If your hypervisor environment is not running a DHCP server, make sure you have manually configured an IP address in the Network Configuration section of the Additional settings step of the Create/Register VM procedure on the hypervisor. You can manually enter an IP address, default gateway and DNS server in the Network Configuration.

  3. Verify that you have configured the correct Public and Protected networks in the Deployment Options step so that the Gateway is able to access the externally facing physical interface.

  4. Ensure there is outbound network access on the hypervisor, so that the Gateway VM can communicate with the BlastShield™ Orchestrator.

Gateway Connectivity Requirements

  1. Outbound UDP ports to all required destinations.

  2. Resolution of DNS requests must be supported by the network.

Create endpoints on the Gateway for the protected virtual machines

For each of the VMs on the hypervisor that you want to securely connect to the BlastShield™ Gateway, you must create a corresponding Endpoint for it on the Gateway. The Destination (VLAN) parameter of the endpoint in the Orchestrator must match the VLAN ID of the port group which you have assigned to it in the ESXi client.

Follow this procedure to learn how to create an endpoint on the Gateway for each virtual machine that you want to protect.

vmware-gateway-v3-endpoint-configuration.png

  1. In the ESXi client, configure a unique VLAN ID for the protected guest VM by setting the port group ID.

    1. In the ESXi client, select Virtual Machines from the left hand menu.

    2. If you have already created the VM, the select it from the displayed list and click on it to bring up the status page.

      1. From the menu at the top of the main window, click on Edit. The Edit settings window for the VM will open.

      2. Ensure that the Virtual Hardware tab is selected and go to the Network Adapter setting.

        1. Set the Network Adapter to one of the port groups you created on the Downstream vSwitch when you configured the network settings. The port group is configured to set the VLAN ID to a unique value which is replicated in the Orchestrator endpoint configuration.

          guest-vm-network-adapter-set-to-port-group1.png

          In this example the VM will have VLAN ID = 1 set in the Orchestrator. This will use port group VM 1, with VLAN ID = 1 on the hypervisor.

        2. Click Save to save the changes.

    3. If you are creating a new VM, then follow the default process in the ESXi client to Create / Register VM

      1. In the Customize Settings step, go to the Network Adapter setting.

      2. Set the Network Adapter to one of the port groups you created on the Downstream vSwitch when you configured the network settings. The port group is configured to set the VLAN ID to a unique value which is replicated in the Orchestrator endpoint configuration.

        new-guest-vm-network-adapter-set-to-port-group1.png

        In this example the VM will have VLAN ID = 1 set in the Orchestrator. This will use port group VM 1, with VLAN ID = 1 on the hypervisor.

      3. Follow the rest of the Create / Register VM process as normal to create the VM.

  2. In the Orchestrator, configure an endpoint to match the ESXi guest VM with the same unique VLAN ID configured as the destination address.

    1. In the Orchestrator, select the VMware ESXi Gateway and click on the Endpoints tab.

    2. Click the 'Add New Endpoint' button and click on the 'Endpoint Enabled' button.

      1. Name: Enter a name for the endpoint

      2. Endpoint Enabled: Check this box to enable the endpoint.

      3. DNS Hostname : Enter a hostname for the endpoint.

      4. Destination (VLAN): Enter the endpoint's VLAN ID. This must match the VLAN ID of the port group which you have assigned to it in the ESXi client.

        For example, this VM will have VLAN ID = 1 set in the Orchestrator. This will use port group VM1, with VLAN ID = 1 on the hypervisor (see the previous step, above).

        vmware-active-gw-new-endpoint.png

      5. Allow outbound external network connectivity:

        1. Check this box if you want to allow the endpoint to be able to communicate out through the Gateway, for example to download software updates.

        2. Leave this box unchecked if you do not want the endpoint to be able to communicate out through the Gateway. This will provide endpoint isolation (virtual air-gapping) but will allow authorized users and nodes to connect to the endpoint.

    3. Click on Save Changes.

    4. The status of the Endpoint will show as ONLINE.

      vmware-active-gw-new-endpoint-online.png

    5. Repeat, as necessary, for your other endpoints.

Troubleshooting if your Endpoint status does not come online

  1. Check that your Gateway is Online. If not refer to the troubleshooting steps earlier.

  2. Verify you have configured the appropriate network adapter on the virtual machines.

  3. Verify the Port Groups and vSwitches have been configured correctly.

Configure an access policy and microsegmentation groups
About Groups

Groups allow you to micro-segment users and endpoints. A group is a logical collection of endpoints and/or users that are grouped together. Groups are connected via policies, which form the foundation for BlastShield access control and segmentation management.

  • Any combination of endpoints and/or users can be grouped together.

  • There is no limit to the number of endpoints and/or users that can be in a group.

  • Endpoints and users can be in one or multiple groups simultaneously.

  • Groups are linked together via policies to provide access between endpoints.

  • By default, endpoints/users cannot access or have visibility to other endpoints/users unless they are granted access via a policy

About Policies

A policy defines how groups can interact. Groups are connected via policies, which form the foundation for BlastShield access control and segmentation management.

  • Each policy will have two sets of groups - "From" and "To".

  • The "From" set is one or more source groups.

  • The "To" set is one or more destination groups.

  • There is no limit to the number of groups in a given policy.

  • "From" Groups will have access to "To" Groups within the policy.

  • "To" Groups will not have access to "From" Groups within the policy.

  • Groups can be in one or multiple policies simultaneously.

groups1.png

About Egress Policies

Egress policies allow you to control external network access for Gateway endpoints which are isolated behind a Gateway. This enables endpoints to connect to external entities, for example to download a software update or to connect to an NTP server.

  • The endpoint group contains the endpoints which the policy applies to.

  • The allowed services are E and F.

  • The network prefixes or DNS names define the allowed external network destinations for the endpoint group.

Egress_Policy_1.png
Create Groups

  1. From the Orchestrator, select "Groups" from the left menu.

  2. Select "Add New Group" from the Group List.

  3. Enter a name for the new Group.

  4. To add members to the new group, click the "Add Members" button.

    1. If you adding users to the group then select the desired Users which you want to be associated with the Group from the "Users" box.

    2. If you are adding Agents to the group then select the desired Agents which you want to be associated with the Group from the "Agents" box.

    3. If you are adding Gateway Endpoints then select the desired Endpoints from the "Endpoints" box.

    4. Alternatively, you can leave the members list empty and add/modify new members later.

  5. Click "Add Members" to save the members.

  6. Click "Save" to save the new group.

  7. Repeat, if required, to ensure you have one group for your endpoints and one group for your users, which is the minimum you will need in order to define the access policy.

Please refer to the following video, which is an example of creating one group for your users and one group for Host Agents.

Create a Policy to link your Groups
To connect your user groups and protected servers groups, you must link them with a policy as described here:

Note

Users and Agents must be a member of a group for them to be used in a policy.

  1. Select "Policies" from the left menu.

  2. Select "Add New Policy" from the Policy List.

  3. Enter a name for the new Policy.

  4. Select desired "From" Groups to be associated with the new Policy.

  5. Select desired "To" Groups to be associated with the new Policy.

  6. Save the new Policy.

Policies are directional, so that you can control the direction in which connections may be initiated. Typically for remote access use-cases your policy would be from the "user group" to the "server group" so that users may start connections to the servers, but servers cannot start connections to users. You can create bi-directional permissions by using two policies.

The following video shows an example of creating an access Policy between a group of remote workers and a group of servers. The policy gives the remote workers authorisation to access the server group.

Create an Egress Policy

Egress policies are required only if a Gateway endpoint requires external network access.

Egress policies allow you to control external network access for Gateway endpoints which are isolated behind a Gateway. This enables endpoints to connect to external entities, for example to download a software update or to connect to an NTP server.

The Egress Policy menu in the Orchestrator allows policies for external network access to be configured on a per-endpoint group basis, where the groups are defined in the Orchestrator Groups menu. Allowed destinations may be defined either by network prefix or by DNS names and the policy may be further controlled by specifying an allowed service. An egress policy may be enabled or disabled from the Orchestrator if the external network access is only temporary.

  1. From within the Orchestrator, select Egress Policies from the left Menu.

  2. Select the red "Add New Policy" icon.

  3. Enter a name for the new Policy.

  4. Check the Policy Enabled box to enable the policy and continue with the configuration.

  5. Select the desired endpoint Groups to be associated with the new Egress Policy in the Endpoint Groups dropdown box

  6. Select any optional Services groups to be associated with the new Policy in the Services dropdown box.

  7. If you want to allow external DNS queries in the policy, then check the Allow all DNS queries box.

  8. Specify the allowed destinations for the Egress Poicy as required using the following options:

    1. In the Allowed Prefixes box, define an allowed external IP address and prefix

    2. in the Allowed DNS Names box, define an allowed external DNS name.

      1. To allow recursive DNS queries, check the Recursive box.

  9. Click Save Changes to save the new Egress Policy.

(Optional) Configure the VM kernel behind the BlastShield Gateway in VMware ESXi
Summary

This step is optional. Moving the VMware kernel interface behind the BlastShield™ Gateway will additionally secure the administrator access to the VMware hypervisor.

This process involves moving the VMware Admin interface from vSwitch0 to the Blastshield downstream vSwitch. This has the effect of placing it in the protected BlastShield™ Network.

Important

You must have already configured the VMware networking and installed the BlastShield™ Gateway on the hypervisor before you start this procedure.

This process is optional.

This process will interrupt access to the ESXi management port. After this procedure is carried out, only authenticated and authorised BlastShield™ users will be able to access the ESXi host.

This procedure will lock out unauthorised users from the ESXi administration interface, so please make sure you back up the system before you start, and that you follow the instructions below to mark the BlastShield™ Gateway VM as auto-starting in the hypervisor.

Starting Configuration with the VM Kernel interface on vSwitch 0.

vmware-networking-1-architecture.png

Final Configuration with the VM Kernel interface moved onto the secure BlastShield™ Downstream vSwitch.

vmware_kernel_on_secure_port_group.png
Procedure to move the VM Kernel interface to the BlastShield™ Downstream vSwitch

  1. Create a new port group in VMware ESXi.

    1. From the ESXi host web ui: - Create the port group in the vSwitch with a suitable VLAN ID and add the matching endpoint in the BlastShield™ orchestrator.  In our example we will use the name "management_secure" as the new port-group name. and assign it VLAN ID = 3.   This new port-group is then connected to the ‘BlastShield Downstream’ vSwitch as shown below.

      vmware_kernel_step1.png

  2. Add the corresponding endpoint in the BlastShield™ orchestrator.

    1. In the Orchestrator, create a new Endpoint for the VM kernel:

      1. Name: VM kernel

      2. DNS Hostname: vm_kernel'

      3. Destination (VLAN): 3

        vmware_kernel_step2.png

  3. Mark the BlastShield™ Gateway VM as auto-starting.

    1. Login to the ESXi host web UI and go to the Manage Host/ system options as shown below.  Mark the BlastShield™ gateway VM as auto-starting

    Important

    This is important, since otherwise the VM Kernel will be unreachable when the system starts

    vmware_kernel_step3.png

  4. Delete the VMkernel interface that you want to migrate from the port group to which it belongs.

    Important

    For this step and the following step you must login to the console on the host. The change will interrupt remote access. After this step, only authenticated and authorised BlastShield™ users will be able to access the ESXi host.

    1. On the VMware console enter the following command. Replace "Management Network" with whatever your current management port group is named. Management Network is the default though.

      esxcfg-vmknic -d "Management Network"

  5. Create a new interface for the one which you removed in the previous step and add it to the Port Group you created.

    1. On the VMware console enter the following command:

      esxcfg-vmknic -a -i DHCP -p "management_secure”

      Now the VM Kernel will be connected via the protected BlastShield™ Downstream vSwitch.

In this section: