vShield Edge (vSE) is used to provide security services at network edge. Its similar to Cisco ASA Firewall in physical networks.
It consists of security zones as well as the code which is responsible for implementing security policies between zones. This code is running inside vSE VA which is deployed by vShield Manager once vSE is configured.
The security zones are represented by vSS Port Group, vDS Port Group, or N1KV Port Profile in vCenter environment. This means that vSE VA is securing the communication between different port groups (not within same port group).
In addition to security policies, vSE can provide L2L & SSL VPN, Load Balancing, DHCP & NAT Services, HA, Routing.
A typical use of vSE can be seen in multi-tenant cloud environments to isolate between Organizations.
The first configuration step is deploying vSE. When you deploy vSE, a VA will be created which is having the code to act as a firewall. Each vSE VA is having 10 vNICs to connect to 10 port-groups.
Navigate to Home > Inventory > Networking > Select the Cluster > Network Virtualization.
Home > Inventory > Hosts and Clusters > vSE-VA) including vCPUs, Memory, Port-Groups, etc.
To manage vSE VA, Select Actions > Manage. Other actions are available as well from same drop-down menu such as convert to large/x-large, download tech-support, disable/enable auto-rules, etc.
Below snapshots describe the functions of different tabs. Basic ones are only covered (firewall, nat, zones).
Important note about NAT implementation:
The translated IPs should be configured in vSE vNIC configuration. This is required for vSE to generate ARP of the translated addresses. Without this configuration, uplink devices won't forward traffic to the translated addresses due to missing ARP.
2. No deployment of new vSEs
Note: Communication between vShield Manager and vShield Edge is happening at VMkernal level and not using IP communication
Here are some useful CLI commands for troubleshooting on vSE:
vSE-VMs-0> show system
cpu Show system cpu information.
memory Show system memory information.
network-stats Show system network stats.
storage Show system storage information.
uptime Show system uptime information.
vSE-VMs-0> debug packet display
vSE-VMs-0> show log