Skip to main content

BlastShield Documentation

BlastShield™ active Gateway installation in VMware ESXi

The Gateway is an in-line protection instance that is deployed as a VM in front of protected VMs on the hypervisor. The Gateway software supports VMware ESXi 7 environments and can be used to protect virtual machines running on the Hypervisor from unauthorized internal and external users, controlling lateral movement between VMs.

Summary of BlastShield™ Gateway Installation in VMware ESXi

Installing a Blastshield™ Gateway in VMware ESXi involves the following steps:

  1. Configure the VMware networking.

  2. Install the Blastshield™ Gateway OVA in ESXi.

  3. Move the VMware kernel interface onto the protected BlastShield™ Downstream vSwitch (optional step).

VMware Networking configuration for the Active Gateway
BlastShield™ Active Gateway installation in VMware ESXi

The BlastShield Active Gateway is an in-line protection instance that will be deployed in front of protected assets or applications. The active Gateway will provide L2 isolation and invisibility of protected VMs on the hypervisor and will protect assets from unauthorised users on the outside or the inside of the network. It will block unauthorised lateral movement between VMs, to secure against malware or unauthorised actors.

Installation of a new gateway instance in VMware requires the following primary workflows:

  1. Configure the VMware networking from the ESXi client.

  2. Install the Blastshield™ Gateway OVA in ESXi.

Preparation

This procedure is for installing the BlastShield™ Gateway as a guest in VMware ESXi 7 and is designed to be run from the ESXi client. Please verify you have met the prerequisites below.

  1. You have administrator access to your ESXi hypervisor.

  2. You have administrator access to the BlastShield™ Orchestrator.

  3. The ESXi hypervisor requires at least one physical NIC which is connected to the internet.

  4. The BlastShield™ Gateway requires outbound TCP to auth.blastwave.io port 8443, and outbound UDP ports to all required destinations.

  5. You will require a copy of the Gateway OVA file. It can be downloaded from here.

  6. If you are using vCenter, then do not use a distributed vSwitch for the ‘BlastShield Downstream’ vSwitch because these cannot support the necessary VLAN configuration on the port group.

  7. By default, the gateway expects to receive an IP address via DHCP.  Manual assignment is also supported during the installation process.

BlastShield Gateway network architecture in VMware

An overview of the VMware networking configuration is shown below. This shows the connectivity between the BlastShield™ Gateway virtual machine, the protected virtual machines, port groups and vSwitches.

vmware-active-gateway-v3.png
Configure the vSwitches and Port Groups

From the ESXi host/Networking screen.

  1. Configure the vSwitches.

    Two vSwitches will be required as described below.

    1. vSwitch 0  

      The default vSwitch and the hypervisor should have already created this vSwitch.  This vSwitch will provide the physical uplink for the Gateway.

      vmware-networking-step1-1.png

    2. BlastShield Downstream

      You must add this vSwitch. This vSwitch is created for downstream protected traffic and the protected guest hosts will connect to this vSwitch.

      It should not have an uplink to the external NIC and you should remove the default uplink.

      vmware-networking-step1-2.png

    The vSwitiches are shown below.

    vmware-networking-step2-2.png

  2. Configure the port groups.

    From the Networking User Interface

    1. Add port groups for the gateway

      1. From the ESXi host / networking user interface, add the following port groups.

      2. VM Network port group.  Mapped to vSwitch 0.  Used to attach the BlastShield instance to the outside world.

      3. BlastShield Downstream port group.  Mapped to the 'BlastShield Downstream' vSwitch.  Assign it VLAN ID = 4095.

        Tip

        VLAN ID 4095 specifies that the port group should use trunk mode, also known as virtual guest tagging mode, which allows the guest operating system to manage its own VLAN tags.

      4. A ‘Management Network’ port group will already have been created by default for the VM Kernel port.

    2. Add port groups for the linux test host endpoints.

      From the Networking User interface, add the following ports

      1. VM1 port group.  This should be mapped to BlastShield Downstream vSwitch for the VM 1 endpoint.  Assign it VLAN ID = 1

      2. VM2 port group.  This should be mapped to BlastShield Downstream vSwitch for the VM 2 endpoint.   Assign it VLAN ID = 2

    The port groups are shown below.

    vmware-networking-step2-1.png
BlastShield™ Active Gateway installation in VMware ESXi
BlastShield™ Active Gateway installation in VMware ESXi

The BlastShield Active Gateway is an in-line protection instance that will be deployed in front of protected assets or applications. The active Gateway will provide L2 isolation and invisibility of protected VMs on the hypervisor and will protect assets from unauthorised users on the outside or the inside of the network. It will block unauthorised lateral movement between VMs, to secure against malware or unauthorised actors.

Installation of a new gateway instance in VMware requires the following primary workflows:

  1. Configure the VMware networking from the ESXi client.

  2. Install the Blastshield™ Gateway OVA in ESXi.

Preparation

This procedure is for installing the BlastShield™ Gateway as a guest in VMware ESXi 7 and is designed to be run from the ESXi client. Please verify you have met the prerequisites below.

  1. You have administrator access to your ESXi hypervisor.

  2. You have administrator access to the BlastShield™ Orchestrator.

  3. The ESXi hypervisor requires at least one physical NIC which is connected to the internet.

  4. The BlastShield™ Gateway requires outbound TCP to auth.blastwave.io port 8443, and outbound UDP ports to all required destinations.

  5. You will require a copy of the Gateway OVA file. It can be downloaded from here.

  6. If you are using vCenter, then do not use a distributed vSwitch for the ‘BlastShield Downstream’ vSwitch because these cannot support the necessary VLAN configuration on the port group.

  7. By default, the gateway expects to receive an IP address via DHCP.  Manual assignment is also supported during the installation process.

Install the BlastShield™ Gateway in ESXi 7

  1. Add a new Gateway in the Orchestrator.

    1. Connect to the Orchestrator and select Gateways from the left Menu.

    2. Select Add New Gateway from the Gateway List.

    3. Enter a name for the new Gateway.

    4. Select the Addressing Mode for the Gateway to be VLAN.

      gw_addressing_mode--VLAN.png

    5. Select Save and Download Invitation. You can chose to either download the invitation file or copy the contents to the clipboard. Retain the invitation file data as you will need it later when you install the Gateway OVA.

      vmware-gw-install-step1-1.png

  2. Download the Gateway OVA file.

    1. Download the Gateway OVA file from here and keep it available so that you can upload it to your ESXi server.

  3. Install the BlastShield Gateway™ OVA file on the ESXi client.

    Using the VMWare ESXi new virtual machine installer, the Invitation (.bsi) file generated in step 1 and the OVA file you downloaded in step 2 you will install the software on your ESXi hypervisor and bind it to the BlastShield™ Network. Below are the steps for this process.

    1. From the ESXi host, go to Virtual Machines / Create /Register VM / Create a virtual machine from an OVF/OVA file.

      vmware-gw-install-step3-1.png

    2. Give the new Gateway a name and select the BlastShield™ OVA file which you downloaded in the previous step.

      vmware-gw-install-step3-2.png

    3. Leave the default datastore option.

      vmware-gw-install-step3-3.png

    4. Set the deployment options as shown:

      1. Public Network: VM Network port group.

      2. Protected Network: BlastShield Downstream port group.

        vmware-gw-install-step3-4.png

    5. In Additional Settings, add the contents of the bsi file.

      1. Paste the contents of the Gateway bsi file into the Invitation contents field.

      2. For IP addressing, the default option is that the Gateway will use DHCP.  If you are setting a manually assigned IP address, default gateway and DNS, then enter them here (leaving the boxes blank here will use DHCP).

      3. Click next, then click finish to add the new Gateway virtual machine.

        vmware-gw-install-step3-5.png

Tip

You can verify the Gateway has started by watching the console output in the hypervisor. when the Gateway is up, then the status in the Orchestrator will indicate 'online' as shown in the image below.

Figure 1. 
vmware-gw-install-step3-6.png



Troubleshooting if your Gateway status does not come Online

  1. You have not provided the contents of the bsi file in the Additional settings step on the hypervisor.

  2. Your hypervisor is not running a DHCP server but you have not manually configured an IP address in the Additional settings step on the hypervisor. You can manually enter an IP address, default gateway and DNS server if this is the case.

  3. There is no internet access on your hypervisor, or a firewall is restricting outbound access. See the list of port requirements at the top of this article.

  4. Verify that you have configured the correct Public and Protected networks in the Deployment Options step so that the Gateway is able to access the externally facing physical interface.

Create your Enpoint VMs and setup an access policy

At this point you can add two test virtual guests in the ESXi hypervisor and then add the corresponding endpoints to your gateway. You can use the VLAN numbering an port group numbering as shown on the architecture diagram below. The VLAN ID on the port group is used to reference the endpoint in the Orchestrator.

vmware-gw-install-step4-0.png

  1. Create two endpoints in the Orchestrator.

    1. VM1 will have VLAN ID = 1 set in the Orchestrator. This will use port group VM1 on the hypervisor.

      vmware-gw-install-step4-1.png

    2. VM2 will have VLAN ID =2 set in the Orchestrator. This will use port group VM2 on the hypervisor.

      vmware-gw-install-step4-2.png

    3. Note that the Protected IP address is automatically set and is the IP address for the endpoint as used in the BlastShield™ network overall. You can overwrite it if necessary. Please be sure not to create a duplicate IP address if you do this.

      If you wish to add more endpoints for additional guest hosts then give each endpoint a unique VLAN ID in the Orchestrator and create a corresponding port group for it in the hypervisor.

  2. Create corresponding virtual machine guest hosts in the ESXi hypervisor.

    1. Create your virtual guest hosts on the ESXi server in the usual way.

    2. In the Customize settings step of the New virtual machine wizard, set the Network adapter for the VM guest to match the port group which has been created for it.

      In our example virtual guest "VM1" will use Network adapter "VM 1" (which is the port group "VM 1"). Port group VM 1 has VLAN ID = 1 and this maps to the VLAN ID which is set in the Orchestrator.

      vmware-gw-install-step4-3.png

  3. Now check that the endpoints have come online.

    1. Login to the Orchestrator and select your Gateway.

    2. Click on the endpoints tab.

    3. Your endpoints should appear Online as shown below.

      vmware-gw-install-step4-4.png

  4. Setup a policy to allow access to the guest host endpoints.

    1. Login to the Orchestrator and create Groups and Policy as shown.

    2. Add the new endpoints which you created to an Endpoint Group.

    3. Add the test user(s) to a User Group.

    4. Create a policy to allow the User Group to access the Endpoint Group. An example of such a policy is shown below.

      vmware-gw-install-step5.png
Troubleshooting if your Endpoint status does not come online

  1. Firstly, check that your Gateway is Online. If not refer to the troubleshooting steps earlier.

  2. Verify you have configured the appropriate network adapter on the virtual machines.

  3. Verify the Port Groups and vSwitches have been configured correctly.

Learn more about Endpoints, Groups and Policy

See the following articles for further information.

  1. About Endpoints

  2. Groups

  3. What are Policies?

  4. Create and manage EndpointsCreate and manage Endpoints

  5. Create a GroupCreate a Group

  6. Create a Policy

Configure the VM kernel behind the BlastShield Gateway in VMware ESXi
Summary

Moving the VMware kernel interface behind the BlastShield™ Gateway will additionally secure the administrator access to the VMware instance itself. This step is optional and provides additional protection to the VMware Admin interface by placing it in the protected BlastShield™ Network. This process will interrupt access to the ESXi management port. After this procedure is carried out, only authenticated and authorised BlastShield™ users will be able to access the ESXi host.

Important

You must have already configured the VMware networking and installed the BlastShield™ Gateway on the hypervisor before you start this procedure.

This process is optional.

This process will interrupt access to the ESXi management port. After this procedure is carried out, only authenticated and authorised BlastShield™ users will be able to access the ESXi host.

Starting Configuration with the VM Kernel interface on vSwitch 0.

vmware-networking-1-architecture.png

Final Configuration with the VM Kernel interface moved onto the secure BlastShield™ Downstream vSwitch.

vmware_kernel_on_secure_port_group.png
Procedure to move the VM Kernel interface to the BlastShield™ Downstream vSwitch

  1. Create a new port group in VMware ESXi.

    1. From the ESXi host web ui: - Create the port group in the vSwitch with a suitable VLAN ID and add the matching endpoint in the BlastShield™ orchestrator.  In our example we will use the name "management_secure" as the new port-group name. and assign it VLAN ID = 3.   This new port-group is then connected to the ‘BlastShield Downstream’ vSwitch as shown below.

      vmware_kernel_step1.png

  2. Add the corresponding endpoint in the BlastShield™ orchestrator.

    1. In the Orchestrator, create a new Endpoint for the VM kernel:

      1. Name: VM kernel

      2. DNS Hostname: vm_kernel'

      3. Destination (VLAN): 3

        vmware_kernel_step2.png

  3. Mark the BlastShield™ gateway VM as auto-starting.

    1. Login to the ESXi host web UI and go to the Manage Host/ system options as shown below.  Mark the BlastShield™ gateway VM as auto-starting

    Important

    This is important, since otherwise the VM Kernel will be unreachable when the system starts

    vmware_kernel_step3.png

  4. Delete the VMkernel interface that you want to migrate from the port group to which it belongs.

    Important

    For this step and the following step you must login to the console on the host. The change will interrupt remote access. After this step, only authenticated and authorised BlastShield™ users will be able to access the ESXi host.

    1. On the VMware console enter the following command. Replace "Management Network" with whatever your current management port group is named. Management Network is the default though.

      esxcfg-vmknic -d "Management Network"

  5. Create a new interface for the one which you removed in the previous step and add it to the Port Group you created.

    1. On the VMware console enter the following command:

      esxcfg-vmknic -a -i DHCP -p "management_secure”

      Now the VM Kernel will be connected via the protected BlastShield™ Downstream vSwitch.

In this section: