Skip to main content

VMware NSX-V

GravityZone Security for Virtualized Environments integrates with the VMware vCenter through NSX-V manager.

Integrate with NSX-V Manager

For the integration to work, you will need to set up the integration for vCenter Servers associated with the NSX-V Manager. For more information, refer to Integrate with vCenter Server.

To setup integration with NSX-V Manager:

  1. In Control Center, navigate to Configuration > Virtualization Providers > Management Platforms.

  2. Click the add.png Add button at the upper side of the table. A configuration window will appear.

  3. Specify the NSX-V integration details:

    • Add the vCenter details.

    • Add Installed platform details, selecting NSX-V:

      1. The hostname or the IP address of the associated vCenter Server system.

      2. The NSX-V port. The default value is 433.

      3. The username.

      4. The password.

  4. Click Save.

    sva_op_vcenter.png

  5. After the integration is added, you must register by pressing the sva_op_register_button.png Register button.

    • This button requires the NSX-V Security Server to be published from: Control Center > Configuration > Update > Components.

    • After publishing the image, you can press the sva_op_register_button.png Register button.

Content Control is now integrated with NSX-V.

Note

GravityZone can only be used to protect the associated vCenter server.

Manage endpoint protection in VMware NSX-V

In this section, you will learn how to configure Bitdefender GravityZone Security for Virtualized Environments integration with NSX-V Manager and apply endpoint protection to your guest virtual machines.

Integration overview

The NSX-V integration provides agentless endpoint protection capabilities through the Guest Introspection ecosystem. Bitdefender integrates with the NSX ecosystem to protect guest virtual machines by using a Security Server deployed at the hypervisor host level.

This section provides guidance for NSX-V Manager administrators on how to configure and apply endpoint protection to guest VMs, by implementing a Bitdefender GravityZone Guest Introspection policy.

Prerequisites

Process description

Deploy the Security Server installation as a partner service in NSX-V manager

To deploy the partner service (Bitdefender GravityZone) in NSX Manager and apply endpoint protection to VMs you must:

  1. In vCenter, go to the Menu > Networking and Security.

    sva_op_nsx_vcenter.png

  2. Go to Installation and Upgrade > Service Deployment.

  3. Deploy Guest Introspection, using the plus button on the cluster that should be protected by the Bitdefender Security Server.

  4. Wait until Guest introspection has displays the Succeded installation status and the service status is Up.

  5. Select the Bitdefender service.

  6. Click Deploy.

  7. Specify the service deployment details:

    • In the Cluster field, select the cluster where the service needs to be deployed.

    • In the Data Store field, you can select a data store where the Security Server disk can be stored.

      For more information, refer to the official VMware Documentation.

    • Under the Network column, you must configure the Management Network interface and the Assignation Mode.

    sva_op_nsxv_deploy.png

  8. Click Finish.

Configure NSX groups

NSX uses groups to be used as source and destination field of a service profile. Create groups in NSX Manager for protected, unprotected VMs and affected (quarantined) VMs.

In this section, you will find out how to create and define group membership:

Protected VM Group

Create a group for protected VMs by following these steps:

  1. In vCenter, go to the Networking and Security page.

  2. Click Service Composer.

  3. In the Security Group section, click Add.

    sva_op_create_group_step2.png

  4. Specify the group details:

    Enter the security group name and description. Under Compute Members, click Set Members to define membership of the group:

    1. Go to the Membership Criteria tab and click Add criteria.

    2. In the third column, click Contains.

    3. In the Scope field, enter the following tag:

      ANTI_VIRUS

    4. Click Apply.

      sva_op_nsxv_group_details.png

  5. Define a dynamic membership using available criteria.

    sva_op_nsxv_dynamic_membership.png

  6. Include objects from Object type dropdown list.

    sva_op_nsxv_object_type.png

    Note

    Users can also exclude objects in this page.

  7. Click Finish.

    The group for the protected VMs is now added.

Create a GravityZone security policy

Create and configure security policy in Control Center.

  1. In Control Center, go to the Policies > General > Antimalware page.

  2. Click Add to configure a policy.

  3. Enter a name for your policy.

  4. Configure the policy settings as needed.

    80107_8.png

    Note

    Only Antimalware settings are applicable to NSX-V integrations.

  5. Go to NSX and select the associated check box to set its visibility in NSX-V Manager.

    80107_9.png

    The GravityZone policy is visible in NSX-V Manager under the Vendor Template column, when you add a Service Profile.

  6. Click Save.

Configure and apply endpoint protection to guest VMs

NSX enforces Guest Introspection policies (GravityZone security policy) when a Service Profile is available. To apply endpoint protection to guest VMs you need to create Service Profile and associate it to a VM group through policy rule.

Configure endpoint protection for guest VMs by following these steps:

Create a service profile

Add a Service Profile in NSX Manager:

  1. In vCenter, go to the Networking and Security.

  2. Click Service Composer.

  3. In the Security Policies section, click Add.

  4. Add your security policy name.

    sva_op_nsxv_security_policy_name.png

  5. In the Guest Introspection Services page, click Add.

    sva_op_nsxv_guest_introspective_service.png

  6. Specify the guest introspective service name.

  7. Select the Bitdefender as the service name.

  8. Select the service profile associated with the GravityZone policy settings.

    sva_op_nsxv_service_profile_gz.png

  9. On the Ready to Complete page, click Finish.

    sva_op_nsxv_service_profile_finish.png

    The service profile is now added.

Apply the security policy to security groups

To associate a security group that needs to be protected by a specific service profile, you need to apply the security policy to that group or groups.

You can apply the policy by following these steps:

  1. In vCenter, go to the Networking and Security page.

  2. Click Service Composer.

  3. In Security Policies, select your policy.

  4. Click Apply.

  5. Select and include your security group or groups.

    sva_op_nsxv_apply_policy.png

  6. Click Apply.

Change the Security Server password

Once you have deployed the Security Server, you can change the password following these steps:

Using the local interface

  1. Open the Security Server console.

    gravityzone_op_sve_new_password_nsx1.png

  2. Press F2 to open the configuration screen.

  3. Enter your password. The default password is: sve.

    sva_change_pass.png

  4. Change the password.

    The default password does not meet the new security password requirements, so you have to change it. It must contain at least 8 characters, one digit, at least one upper case character, at least one lower case character, one special character and must be changed every 3 months.

    gravityzone_op_sve_new_password_nsx2.png

    Note

    For more information about resetting the root password, refer to Reset root password for Security Server.

Using SSH

  1. Connect to the appliance via SSH.

  2. Log in using the default credentials.

    • User name: root

    • Password: sve

  3. Change the password.

    The default password does not meet the new security password requirements, so you have to change it. It must contain at least 8 characters, one digit, at least one upper case character, at least one lower case character, one special character and must be changed every 3 months.

    gravityzone_cl_pt_op_sve_new_password2.png

    Note

    For more information about resetting the root password, refer to Reset root password for Security Server.

In this section: