5nine Cloud Security Azure Pack Extension. Version 5.2

Transcription

1 5nine Cloud Security Azure Pack Extension Version 5.2 June 2015

2 2015 5nine Software. All rights reserved. All trademarks are the property of their respective owners. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form by any means, without written permission from 5nine Software Inc. (5nine). The information contained in this document represents the current view of 5nine on the issue discussed as of the date of publication and is subject to change without notice. 5nine shall not be liable for technical or editorial errors or omissions contained herein. 5nine makes no warranties, express or implied, in this document. 5nine may have patents, patent applications, trademark, copyright, or other intellectual property rights covering the subject matter of this document. All other trademarks mentioned herein are the property of their respective owners. Except as expressly provided in any written license agreement from 5nine, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Important! Please read the End User Software License Agreement before using the accompanying software program(s). Using any part of the software indicates that you accept the terms of the End User Software License Agreement. 1

3 Table of Contents Summary... 4 System Requirements... 5 Permissions... 6 Installation nine Cloud Security Network Manager Plugin installation nine Cloud Security Azure Pack Extension installation Microsoft Web Platform Installer Pre-configuration nine Cloud Security Network Manager Plugin pre-configuration nine Cloud Security Azure Pack Extension pre-configuration Operations Admin portal operations Adding, removing and changing hosts Viewing virtual machines and log records Managing security groups Managing templates User actions audit Disaster recovery management Usage record and limits Viewing tenants Tenant portal operations Enable 5nine Cloud Security features Viewing virtual machines and log records Managing security groups Managing templates User actions audit Common operations Operations with security groups Operations with templates Managing virtual firewall protection status Managing IDS status Managing traffic scanner status

4 Adding rules Changing VM settings User actions log filter Uninstallation

5 Summary 5nine Cloud Security Azure Pack Extension represents the plugin specifically designed for Azure Pack web-based portal, which allows users to work with 5nine Cloud Security functions directly via Azure Pack web interface. Extension is conveniently embedded into Azure Pack Admin and Tenant portals as an additional menu item. Admin portal view with 5nine Cloud Security for Azure Pack Admin Extension: Tenant portal view with 5nine Cloud Security for Azure Pack Tenant Extension: 4

6 System Requirements 5nine Cloud Security Azure Pack Extension requirements correspond to those stipulated for Azure Pack and 5nine Cloud Security for Hyper-V: Supported Operating Systems: Windows Server 2012 or Windows Server 2012 R2 (also refer to for details on Windows Server compatibility) Before you install 5nine Cloud Security Azure Pack Extension, the following software must be installed in your environment: Azure Pack using Web Platform Installer 5.0 ( which requires: Microsoft System Center Virtual Machine Manager R2 and Microsoft System Center Orchestrator R2: WCF Data Services 5.0 (OData v3): Service Provider Foundation (SPF) prerequisite. ASP.NET MVC 4: SPF prerequisite. Windows Assessment and Deployment Kit for Windows 8.1: SCVMM prerequisite. MS SQL 2012 SP1 or 2014 full setup: Required for SCVMM, SPF and Azure Pack. 5nine Cloud Security for Hyper-V 5.1 5nine Cloud Security Network Manager Plugin (SCVMM compliance extension). 5

7 Permissions TCP port is used by default for Cloud Security site https connection in the IIS settings. Make sure it s opened on the Azure Pack server. Default ports for Azure Pack are for Admin site, for Tenant site, and for Auth sites. Make sure they are opened unless you set alternative ports for Azure Pack components. TCP port 8090 used for SPF must be opened on the SPF server. If it is not configured at all, 5nine Cloud Security Azure Pack Extension will still work partially with Admin portal only as Tenant portal itself will be inoperable without properly configured SPF. 5nine Cloud Security Azure Pack Extension should be installed with domain administrative account. This account should also meet requirements stipulated for 5nine Cloud Security for Hyper-V. Domain account that is used to install 5nine Cloud Security Azure Pack Extension must be added to Azure Pack admins list. It can be the same account under which Azure Pack has been previously installed this account has already been added to Azure Pack admins list during installation of Azure Pack. To add a new user to the Azure Pack admins list use the following PS command (PS must be run with administrative privileges Run as Administrator ): Get-MgmtSvcAdminUser to check the currently added admins; Add-MgmtSvcAdminUser -Principal "Domain\User" to add the new admin. Substitute Domain/User with yours and keep quotes where they are. Domain account that is used to install 5nine Cloud Security Azure Pack Extension must be added to 5nine Cloud Security for Hyper-V Global Admins list and must be assigned both SecurityAdministrator and Auditor roles. Installation 5nine Cloud Security Azure Pack Extension installation consists of two steps, considering that all other components as are SCVMM, SPF, Azure Pack and 5nine Cloud Security for Hyper-V 5.1 are already installed in your environment: - 5nine Cloud Security Network Manager Plugin (SCVMM compliance extension) the plugin that is required to get the VMM logical switches to compliant state. Azure Pack 6

8 Tenant Portal operation assumes having logical switches properly set in SCVMM and they must be in compliant state so the logical networks/tenant VMs are fully operable. This component should be installed directly on your SCVMM server. Refer to the 5nine Cloud Security Network Manager Plugin installation subsection below. - 5nine Cloud Security Azure Pack Extension installation. The main web application that is embedded into Azure Pack web interface. This component should be installed directly on your Azure Pack server. Refer to the 5nine Cloud Security Azure Pack Extension installation subsection below. 5nine Cloud Security Network Manager Plugin installation To install 5nine Cloud Security Network Management Plugin, run the single setup launcher application on your SCVMM server: Select SC VMM compliance extension and click Install. The 5nine Cloud Security for Hyper-V Network Manager Plugin Setup wizard will open. Click Next. 7

9 Select the destination folder or leave the default path and click Next. 8

10 Click Install to start the 5nine Cloud Security for Hyper-V Network Manager Plugin installation process. Wait until the following screen appears, and then click Finish to complete the 5nine Cloud Security for Hyper-V Network Manager Plugin installation process. 9

11 The installation process is complete, but the further steps are required to finalize 5nine Cloud Security for Hyper-V Network Manager Plugin configuration and setting up corresponding SCVMM items configuration. Refer to the Pre-configuration section below for details. 5nine Cloud Security Azure Pack Extension installation To install 5nine Cloud Security Azure Pack Extension, first run the single setup launcher application with administrative privileges ( Run as Administrator ) on your Azure Pack server: Select Extension for Azure Pack and click Install. The 5nine Cloud Security for Azure Pack Setup wizard will open. Click Next. 10

12 Read and accept the EULA (end user license agreement). Click Next. 11

13 Choose the components to install on your Azure Pack server: - MgmtSvc-AdminSite Extension 5nine Cloud Security Azure Pack Extension for Admin site; - MgmtSvc-TenantSite Extension 5nine Cloud Security Azure Pack Extension for Tenant site. Note. The first two components Admin and Tenant site extensions, are also available in Microsoft Web Platform Installer (Web PI) and alternatively can be installed directly from Web PI console. Please refer to the Microsoft Web Platform Installer subsection below for details. - MgmtSvc-CloudSecurity Backend Service this component sets up MgmtSvc- CloudSecurity site IIS service and provides connectivity and data exchange between Azure Pack and 5nine Cloud Security for Hyper-V. Click Next. 12

14 Enter credentials to connect to 5nine Cloud Security management server. The user must be assigned SecurityAdministrator (required) and Auditor (preferable) 5nine Cloud Security roles (please refer to 5nine Cloud Security for Hyper-V QSG for detailed information). Click Next. 13

15 Enter credentials for Azure Pack to use for communication with Cloud Security API web service. For security reasons do not use windows/domain account credentials. Click Next. Click Install to start the 5nine Cloud Security for Azure Pack installation process. 14

16 Wait until the following screen appears, and then click Finish to complete the 5nine Cloud Security for Azure Pack installation process. The installation is complete, but the further steps are required to finalize 5nine Cloud Security Azure Pack Extension configuration. Refer to the Pre-configuration section below for details. 15

17 Microsoft Web Platform Installer 5nine Cloud Security Azure Pack Extension for Admin site and 5nine Cloud Security Azure Pack Extension for Tenant site are available and can be installed directly from Microsoft Web Platform Installer (Web PI) 1. To use this installation option, run the Web PI console on your Azure Pack server(s): - Go to the Products tab and find extensions: 5nine Cloud Security for Azure Pack: Admin Site Extension; 5nine Cloud Security for Azure Pack: Tenant Site Extension. - Click the Add button against products as required either both together or just one of them, depending on whether you need to install them on the same server or on different servers (distributed installation). 1 Get more information and download Microsoft Web Platform Installer at 16

18 - Click the Install button in the bottom of the Web PI console: - Accept license terms: 17

19 - Wait until installation is complete and then close Web PI console: Pre-configuration Upon installation, further steps are required to complete 5nine Cloud Security Network Management Plugin and 5nine Cloud Security Azure Pack Extension configuration to get all components to be fully operable. 5nine Cloud Security Network Manager Plugin pre-configuration Upon installation, do the following actions on your SCVMM server to complete 5nine Cloud Security for Hyper-V Network Manager Plugin configuration: 1. Restart SCVMM service. Re-open SCVMM management console, make sure you do it with administrative privileges ( Run as Administrator ). 2. Go to Settings Configuration Providers. Check that "5nine Cloud Security Network Management Provider" is present in configuration providers list. 3. Create Network Service in SCVMM: Go to Fabric Networking Network Service (right click) Add Network Service; 18

20 Name the network service (e.g. Cloud Security Filtering Service ); Select 5nine Software, Inc CloudSecurity Manager ; Enter credentials. The best way is to add current domain user account that has all necessary permissions; Connection string: localhost; Host group: check All Hosts 4. Go to Fabric Networking Logical Switches: Right-click on the logical switch Properties; Select Extensions; Check the box against the new 5nine Cloud Security Filtering extension. Click OK. 5. Check that logical switch extensions order in SCVMM console and Hyper-V manager match for each Hyper-V host. Alter the order if necessary by using the Move UP/Move Down buttons. 6. Go to Fabric Networking Logical Switches: Select "Hosts" on the main pane; Select logical switches that are in Not Compliant state. Remediate the logical switches that are in Not Compliant state. Wait until the state of logical switch becomes Compliant. Note: You might have to refresh the hosts that do not run 5nine Cloud Security Host Management Service (in the case you have those in your environment) upon remediate action is complete to get the logical switches to Compliant state on such hosts! 19

21 5nine Cloud Security Azure Pack Extension pre-configuration Once 5nine Cloud Security for Azure Pack is installed onto your Azure Pack server, do the following pre-configuration settings to finally prepare the system for operation: 1. Make sure the proper SSL certificate is selected for MgmtSvc-CloudSecurity site in your Azure Pack server s IIS settings: Go to Computer Management Services and Applications Internet Information Services (IIS) Manager. Open Sites under your Azure Pack server and select MgmtSvc-CloudSecurity site. Right-click MgmtSvc-CloudSecurity site and select Edit Bindings (or click Edit Site Bindings on the right). Select the site binding and click the Edit button: 20

22 Ensure that MgmtSvc-CloudSecurity SSL certificate is selected and click OK: 2. Open 5nine Cloud Security for Hyper-V Management Console and make sure the Azure Pack domain user (admin) is added to Cloud Security global admins list: Set the SecurityAdministrator and preferably Auditor roles for Azure Pack domain user. Refer to 5nine Cloud Security for Hyper-V QSG for details. Note. If Azure Pack admin is not present in Cloud Security global admins list, tenant subscription with Cloud Security service will be out of sync! 21

23 3. Open Azure Pack admin portal, go to the 5NINE CLOUD SECURITY menu item and register the Cloud Security REST endpoint: Click the link Connect the portal to your Cloud Security REST endpoint. Fill in the Cloud Security REST endpoint registration form: 22

24 Type the endpoint url to the Cloud Security REST API that the Azure Pack portal will connect to into the REST API ENDPOINT field. The string has the following format: where <server> is the hostname of the server where MgmtSvc-CloudSecurity Backend Service is installed; <port> is TCP port that is used by MgmtSvc-CloudSecurity Backend Service. Default port is Enter the user name into the USER NAME field. Use the non-windows user that you specified earlier at the 5nine Cloud Security Azure Pack Extension (MgmtSvc-CloudSecurity Backend Service component) installation. E.g., Admin. Enter the password you have set earlier for this user into the PASSWORD field. Click the V mark in the right-lower corner to save the Cloud Security REST endpoint connection settings. Wait until the endpoint connection is set, it may take several seconds depending on environment. Note. In the current version of 5nine Cloud Security Azure Pack Extension it is not possible to change the Cloud Security REST endpoint connection settings once they are successfully registered. 4. Add Cloud Security service to Azure Pack plan(s) where it s necessary to use 5nine Cloud Security Extension for tenants: 23

25 Cloud security must be listed as another service in the selected plan(s): At this stage 5nine Cloud Security Azure Pack Extension is configured and ready for operation. Operations 5nine Cloud Security Azure Pack Extension operation is divided into two parts: Admin portal operation and tenant portal operation. These functions reflect the corresponding operations performed via 5nine Cloud Security Management Console with adaptation to Azure Pack concept. Some operations like adding/editing/removing rules, security groups, templates, loading logs are common for both admin and tenant portals. Admin portal operations subsection below describes operations specific for Azure Pack admin portal. Tenant portal operations subsection below describes operations specific for Azure Pack tenant portal. Common operations subsection below describes operations common to both admin and tenant portals. Admin portal operations Admin portal operations with 5nine Cloud Security functions allow: - Viewing all virtual machines either placed into the clouds or directly on hosts, including those deployed by tenants. - Viewing all tenants including those created in Azure Pack and those created in 5nine Cloud Security Management console. - Adding/removing managed hosts. - Applying security policies (adding, editing, removing virtual firewall rules, security groups, operating with virtual firewall status on virtual machines). - Setting usage limits. 24

26 Adding, removing and changing hosts To add, remove or change settings of managed hosts, go to the 5NINE CLOUD SECURITY menu item in the Azure Pak admin portal and select HOSTS: Then use an appropriate button in the lower part of your browser: - To add a new host, click the ADD button. Then enter the host name and credentials (if applicable) or let default credentials be used: 25

27 Click the V mark in the right-lower corner to complete the operation. Azure Pack will inform you if the operation is succeeded or not. - To remove managed host, select it and click the REMOVE button. Then confirm the operation. - To change host name and/or credentials click the CREDENTIALS button. Enter a new name and/or credentials: Click the V mark in the right-lower corner to complete the operation. Azure Pack will inform you if the operation is succeeded or not. 26

28 Viewing virtual machines and log records To view virtual machines from admin portal, either go to VIRTUAL MACHINES tab of 5NINE CLOUD SECURITY menu item or open any of hosts to view VMs on particular host: All hosts view: Selected host view: 27

29 Open any of VMs to view rule list, filtering log, IDS and network traffic scanner events and connections table: View rules list: View filtering log: 28

30 View IDS log: View network traffic scanner log: View connections table: Use the ADD IP RULE, ADD ARP/L2 RULE buttons to add new rules. To edit the rule, select it and then click the EDIT button to open the rule for editing. 29

31 Please refer to the Common operations section for details. These operations are similar for admin and tenant Azure Pack portals. To remove the rule, select it, then click the REMOVE button and confirm the operation. Managing security groups To manage security groups from admin portal go to VIRTUAL MACHINES GROUPS tab: - To create group click the CREATE button on the bottom panel. - To remove security group, select the necessary group and click the REMOVE button on the bottom panel. Confirm the operation. - To use rules template, select the necessary group and click the USE TEMPLATE button on the bottom panel. Please refer to the Common operations section for details. This operation is similar for admin and tenant Azure Pack portals. - To add, edit or remove rules in the group, open the target group and go to the RULES tab: 30

32 Then use the appropriate buttons on the bottom panel. Please refer to the Common operations section for details. These operations are similar for admin and tenant Azure Pack portals. - To add or remove virtual machines from the security group, go to the MEMBERS tab: To add or remove a member, use the appropriate button in the bottom panel. Please refer to Common operations section for details. These operations are similar for admin and tenant Azure Pack portals. Managing templates Go to the TEMPLATES tab of the 5NINE CLOUD SECURITY item to view and manage userdefined rule templates: Please refer to the Common operations section for details. These operations are similar for admin and tenant Azure Pack portals. 31

33 User actions audit Go to USER ACTIONS LOG tab of the 5NINE CLOUD SECURITY item to view user actions log: Filter is available to select the events by date. Please refer to the Common operations section below. Disaster recovery management On the MANAGEMENT SERVERS tab of the 5NINE CLOUD SECURITY item you can set disaster recovery feature: 32

34 Use the appropriate buttons on the bottom panel to add, remove and change position of the management servers: - To add a new management server click the ADD button. Then enter management server parameters and click the V mark to save changes: Note. 5nine Cloud Security Management service must be installed on the target server prior to adding it to the management servers list for disaster recovery. Refer to the 5nine Cloud Security for Hyper-V QSG for details. - To change the position of the management server click the MOVE UP or MOVE DOWN buttons accordingly. The top management server will be a primary one that takes control over 5nine Cloud Security. - To remove management server from the list click the DELETE button and confirm the operation. 33

35 Usage record and limits 5nine Cloud Security Azure Pack Extension includes mandatory service usage record and standard usage endpoint to connect to the billing system. Azure Pack admin is also able to set service usage limits for Cloud Security service within a particular tenant plan. These limits determine the maximal number of virtual machines allowed to enable each feature on (plan quota). The following 5nine Cloud Security features are included in Azure Pack plan quota for Cloud Security service: - Virtual Firewall; - IDS; - Network Traffic Scanner. To set usage limits for Cloud Security service, select the necessary plan in Azure Pack admin portal and open Cloud Security service (the plan should include this service): Click the right arrow in the NAME column of the Cloud Security entry. You will see service quota parameters: 34

36 Set the maximal number of virtual machines that a tenant can enable each feature on using the subscription to this plan. Type the number into the Usage limit field for virtual firewall, ids and traffic scanner features accordingly. The default limit is set to 10 VMs for each feature. If you do not need to limit any feature or all features, mark the Unlimited option where needed: In the bottom panel click the SAVE button to save limitation settings or the DISCARD button to cancel the changes. Viewing tenants 5nine Cloud Security Azure Pack Extension does not allow admin to actively manage tenants. Tenants and subscriptions are managed in the same Azure Pack admin portal by its own standard means using USER ACCOUNTS and PLANS Azure Pack admin portal menu items. Under 5NINE CLOUD SECURITY item admin can work with tenants in observation mode only. All actions with tenants are done automatically when corresponding changes are applied by using Azure Pack and/or Cloud Security Management Console means. Note that tenants created via Azure Pack will be automatically replicated to main Cloud Security application 35

37 (database). They must not be manually altered in any way in Cloud Security Management Console as it will lead to out-of-sync tenant subscription. Tenants that are originally created via 5nine Cloud Security Management Console will also be displayed under 5NINE CLOUD SECURITY item of Azure Pack admin portal. These tenants are not registered in Azure Pack and can t use Azure Pack subscriptions/operate VMs. Azure Pack-created tenants are fully capable with 5nine Cloud Security operations. There is a difference in these two tenant conceptions. To view tenants go to the TENANTS tab of the 5NINE CLOUD SECURITY item: In this tab you will see tenants list and usage statistics for each tenant. Statistics displays virtual firewall, traffic scanner, and IDS services quota usage by each tenant in format: <VMs currently in service>/<maximal number of VMs for the service (quota)>. This way you always can check how many VMs are used by tenants in each service and how many left in quota for each tenant. 36

38 Tenants, originated from Azure Pack admin portal, have their own passwords set for each one at the time tenant user account is created by Azure Pack admin. This password allows tenants to access tenant portals only. It cannot be used to access 5nine Cloud Security Management console under the tenant account as there is another hidden password to connect to 5nine Cloud Security, which is generated automatically and is hidden from tenants. Azure Pack admin can retrieve it in the case if it s necessary to access 5nine Cloud Security Management console under the tenant account, but cannot change this password. To get the internal password, select the necessary tenant in the TENANTS tab of the 5NINE CLOUD SECURITY item in Azure Pack admin portal and open it the password will be displayed in the INTERNAL PASSWORD column of the USERS subtub: This password shall be used to access 5nine Cloud Security Management Console under tenant account in the case of necessity. Do not make attempts to change this password using 5nine Cloud Security Management Console means. Tenant portal operations Tenant portal operations with 5nine Cloud Security functions allow: - Adding/removing virtual machines from 5nine Cloud Security tenant s list. - Viewing virtual machines deployed by a tenant from Azure Pack portal and also the ones that 5nine Cloud Security global admin additionally assigned to a tenant and their statuses. - Applying security policies for virtual machines assigned to the tenant (adding, editing, removing virtual firewall rules, policy templates and security groups, operating with virtual firewall status on virtual machines). - Viewing firewall logs, IDS and Network traffic scanner events and VM connections table. - Viewing user actions log. 37

39 Enable 5nine Cloud Security features Tenant admin deploys virtual machines via Azure Pack tenant portal using a subscription to Azure Pack Virtual Machine Clouds plan. 5nine Cloud Security features are disabled on these machines by default. To enable 5nine Cloud Security features on these virtual machines, tenant should add them to 5nine Cloud Security service list. Cloud Security service should be in the same plan as Virtual Machine Clouds service. 5nine Cloud Security global admin is able to add and remove any virtual machines to/from the tenant s 5nine Cloud Security list. If 5nine Cloud Security global admin assigns additional virtual machines to the tenant that are not part of the tenant s subscription, those virtual machines will also be displayed under the 5NINE CLOUD SECURITY item of Azure Pack tenant portal. 5nine Cloud Security features will apply to these virtual machines, but Azure Pack native features will not (guest console, RDP connection etc.). To add a new virtual machine to 5nine Cloud Security click the NEW button of the Azure Pack tenant portal, then click CLOUD SECURITY ADD VM. The VMs that have been deployed by the tenant, but have not been added to 5nine Cloud Security tenant s list yet, will appear in the following box: 38

40 Select VMs that you want to add to 5nine Cloud Security tenant s list using CTRL/SHIFT keys and click the V mark to complete the operation. Selected VMs will appear under the 5NINE CLOUD SECURITY item of Azure Pack tenant portal. Viewing virtual machines and log records To view virtual machines from tenant portal go to VIRTUAL MACHINES tab of 5NINE CLOUD SECURITY menu item: Open any of VMs to view rule list, filtering log, IDS and network traffic scanner events and connections table: View rules list: 39

41 View filtering log: View IDS log: View network traffic scanner log: 40

42 View connections table: Use the ADD IP RULE, ADD ARP/L2 RULE buttons to add new rules. To edit the rule, select it and then click the EDIT button to open the rule for editing. Please refer to Common operations section for details. These operations are similar for admin and tenant Azure Pack portals. To remove the rule, select it, then click the REMOVE button and confirm the operation. Managing security groups To manage security groups from tenant portal, go to VIRTUAL MACHINE GROUPS tab: To add, edit or remove a security group, click the appropriate button on the bottom panel. 41

43 - To add, edit or remove rules in the group, open the target group and go to the RULES tab: Then use the appropriate buttons on the bottom panel. - To add or remove virtual machines from the security group, go to the MEMBERS tab: To add or remove a member, use the appropriate button in the bottom panel. Please refer to Common operations section for details. All these operations are similar for admin and tenant Azure Pack portals. 42

44 Managing templates Go to the TEMPLATES tab of the 5NINE CLOUD SECURITY item to view and manage userdefined rule templates: Please refer to the Common operations section for details. These operations are similar for admin and tenant Azure Pack portals. User actions audit 5nine Cloud Security performs user actions audit. It records all actions that users do when working with 5nine Cloud Security into the database. These data are blocked from modification for all users, only observation is possible. Go to USER ACTIONS LOG tab of the 5NINE CLOUD SECURITY item to view user actions log: Filter is available to select the events by date. Please refer to the Common operations section below. 43

45 Common operations This section describes operations common to admin and tenant Azure Pack portals. Operations with security groups Creating a new security group: upon clicking the CREATE button on the bottom panel of the admin or tenant portals, enter parameters for the new group set the group name and select virtual machines: Use CTRL/SHIFT buttons to select virtual machines into the group. Then click the V mark to save the group. To edit security group, select it and click the EDIT button. Alter group parameters just like when creating a new group. To remove security group, select it and click the REMOVE button. Then confirm the operation. 44