5nine Cloud Security for Hyper-V Free Edition. Version 4.0

Transcription

1 5nine Cloud Security for Hyper-V Free Edition Version 4.0 February

2 Table of Contents 5nine Cloud Security for Hyper-V Free Edition... 5 Summary... 5 System Requirements... 5 Permissions... 5 Features and Benefits... 6 Installation... 7 vfirewall Silent Installation nine Security Operations Adding and RemovingH Setting v-firewall Rules Setting Virtual Firewall Antivirus nine Security Configuration File and PowerShell API nine Security and Compliance Scanner for Hyper-V Summary Installation Interface Operation Checking Scan Results VMs Firewalling Intrusion Detection Performance Antivirus Protection Overall Report

3 2014 5nine Software. All rights reserved. All trademarks are the property of their respective owners. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form by any means, without written permission from 5nine Software Inc (5nine). The information contained in this document represents the current view of 5nine on the issue discussed as of the date of publication and is subject to change without notice. 5nine shall not be liable for technical or editorial errors or omissions contained herein. 5nine makes no warranties, express or implied, in this document. 5nine may have patents, patent applications, trademark, copyright, or other intellectual property rights covering the subject matter of this document. All other trademarks mentioned herein are the property of their respective owners. Except as expressly provided in any written license agreement from 5nine, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. 3

4 Contacting 5nine Software We are always welcome your feedback on the product as well as your user experience. In case you would like to help us improve the product, please contact us at Customer Support Please contact if you have encountered any issue using 5nine Cloud Security for Hyper-V Free Edition. 4

5 5nine Cloud Security for Hyper-V Free Edition Summary 5nine Cloud Security Free Edition is a Virtual Infrastructure monitoring tool with the ability to define network traffic rules for Hyper-V Virtual Machines and harden your Virtual Infrastructure from a security perspective; both programmatically using a PowerShell API and via the Management Console. Security allows to review network traffic logs for each of the monitored Virtual machines and generates related reports. 5nine Cloud Security Free Edition is designed for the monitoring and control of the traffic between Hyper-V Virtual machines and between Virtual machines and external networks (Virtual Firewall). It also includes an Intrusion Detection System (IDS) as well as antivirus. 5nine Cloud Security Free Edition is designed for evaluation purposes as it includes less functionality when compared to the capabilities of the Datacenter Edition, which supports the full functionality of Security. For instance IDS is not available in the Free Edition and the Virtual Firewall settings offer less flexibility. 5nine Cloud Security Free Edition also includes 5nine Security and Compliance Scanner for Hyper-V. The description for this functionality is given in the 5

6 5nine Security and Compliance Scanner for Hyper-V section. System Requirements OS: Host: Windows Server 2012 or Windows 8 with enabled Hyper-V; Guest VM: any.net 4.0; SQL 2008 Express edition on Management server/vm (in case DB logging is required); MS PowerShell; IIS. Permissions For both domain and workgroup configurations: TCP port 8788 should be opened on managed host. 5nine Cloud Security should be installed on each Hyper-V host monitored and protected (in case several hosts are managed from one Management console). Same with the 5nine Security service for SC VMM 5nine Security plugins. WMI access ( ) SQL database or file access (read/write). Allow to control Hyper-V ( User should be a local administrator. If the host is managed remotely from the centralized management console, there should also be an account with similar permissions used in Server Settings. The best practice recommendation is to use the same account for the service on the managed host and in Server Settings in the management console. For workgroup/mixed domain environments: Account for workgroup environment should also have similar permissions for current managed hosts. Managed and management servers should be marked as trusted hosts in the case where the workgroup environment is used on several domains environments. 6

7 Features and Benefits Simple installation. 5nine Cloud Security Free Edition has one component that is required to be installed intuitive Management interface (DLL) that supports PowerShell API (described below) to set and change traffic rules. Management API has a simple-to-use GUI application that allows to set traffic rules between the virtual machines and external networks. Management interface can be installed either on a server or a Virtual machine, and allows the System Administrator to access rules, logs and reports: Installation To setup 5nine Cloud Security Free Edition (DLL and Management GUI application) administrator needs to run setup.exe application from the downloaded 5nine Cloud Security Free Edition archive on the server that matches 5nine Cloud Security Free Edition section. section. System Requirements No license is required for the Free Edition. 7

8 Then the 5nine Cloud Security Free Edition Setup Wizard will be opened: Read the SQL server information (you have to make sure it is available on your host for 5nine Cloud Security Free Edition successful installation) and click Next: 8

9 Choose the path where 5nine Cloud Security Free Edition is to be installed and the users who will be able to work with the product: You can check the physical space available on your drives and the space required for the installation by pressing the Disc Cost button on the window shown above: The 5nine Cloud Security Free Edition Information window will then appear: 9

10 Select MS SQL data source: vfirewall remote installation is one step of the installation process. Installing vfw on some machine locally you can define servers on which you want to install vfw remotely. After the data source selection page you will see the page where you can select include remote setup stem to setup process or not. Warnings! 1. When using the remote installation, make sure, that all the servers have the same user credentials as the local server. Credentials will be requested during further installation process only once. It is currently impossible to enter different user credentials for the remote servers and installation will fail, if there is a credentials mismatch. 2. Be sure, that the similar SQL data sources are used on all the servers. You will be requested to select the MS SQL data source only once (if the Existing MS SQL Server instance option has been selected) as described above, and you will not be able to select a different one for the other servers. This will cause a serious problem. The installation will be accomplished on all the servers, but the product may not function properly. If remote setup checkbox is cleared setup goes with a common scenario: 10

11 Specify if a remote installation step is required in the setup process: If the checkbox is checked you can select servers for the remote installation. Remote installation server selection dialog goes after user credentials dialog. That dialog is similar to monitored servers discovery dialog. For remote management Security uses WinRM service and it should be available. For cases listed below trusted hosts should be configured: - Client and remote servers are in different domains and there is no trust between the two domains; - Client or remote server is located in a domain and the other one is located in a workgroup; - Both client and remote server are located in a workgroup. Trusted hosts should be configured on both client and remote server sides. It can be done with the command below: Set-Item wsman: localhost\client\trustedhosts -Value "{CompureName}" Or manuallyconfigured with gpedit.msc console: gpedit.msc console -> Local Computer Policy/Computer Configuration/Administrative Templates/Windows Components/Windows Remote Management (WinRM)/WinRM Client -> Trusted Hosts To add all machines from workgroup to trusted hosts {local} name can be used. Typical symptom of such a problem is an error WinRM cannot process the request in a Management Console log. This message may also appear when the system can t resolve remote host s path (it is wrong or DNS server is inaccessible for example) or wrong credentials are used. 5nine Cloud Security Free Edition uses system security log events for logging denied packets. By default Windows Filtering Platform filtering audit is disabled to prevent the system log overflow and avoid storing of unnecessary data. WFP filtering audit can be enabled with following command: auditpol /set /subcategory:"filtering Platform Packet Drop" /success:enable /failure:enable 11

12 WFP filtering can be enabled from 5nine Cloud Security Free Edition setup. Enable Windows Filtering Platform audit checkbox exists on a Installation settings page. If that checkbox is checked the command listed above would be executed during the installation process: You can manually disable WFP with following command: auditpol /set /subcategory:"filtering Platform Packet Drop" /success:disable /failure:disable It will be better to disable WFP filtering audit if it is not used or after 5nine Cloud Security Free Edition uninstallation. Confirm installation: 12

13 Confirm the 3f3b34c.msi installation and choose the necessary settings if asked (it depends on your server s OS security settings): Set the SQL Server instance that will be used and connect to it by entering user name and password. There could be either SQL Server Authentication or Windows Authentication used while gaining access to your database. To find out which authentication is used and get the user name and password contact your database administrator. The installer would skip this step if MS SQL Server Compact was previously selected as a data source. You can test the database connection by pressing the Test connection button. In the case of successful connection the following type of message will appear: 13

14 Set account for Security Management service as required: If you earlier chose the option Include Remote installation step in setup process as described above, you would be advised to choose the remote host(s) for the 5nine Cloud Security Free Edition installation: You may also add servers to the list individually by pressing the Add button and entering the server name manually in the dialog window above or let 5nine Cloud Security Free Edition search and add servers automatically by pressing the AD Discovery button, or search for servers by IP range/subnet mask, which can be set in the window below called out by pressing the IP Discovery button: 14

15 Install the product on the previously selected servers in the next dialog: There will be table with servers and installation status. Possible statuses include: - Idle. Idle for installation start. Waiting for the start button to be pressed. - Processing. Remote installation in progress. - Complete. Remote installation completed. - Failed. Remote installation failed. Additional information about the error will be in the description column. Remote installation will be processed in parallel for each selected server. MSI file and selected license file will be copied to drive C: on remote machine (user should have permissions to write file on target machine). After the files are copied, installation will be started in silent mode with parameters selected for local installation. After installation is completed the temporary files will be removed and the remote machine will be rebooted. For using the remote installation feature a user should pass msi file name unchanged vfwsetup.msi. After all installations are completed (successfully or failed) a user can close the dialog and go forward with the installation. After the remote installation step the next installation step is the monitored servers selection step. The local machine is included into the list by default. Also servers from previous installation configuration (if it was saved) will also be included into the list. Then press the Start button to start the remote installation, watch the process and results and press the Close button when the remote installation process is complete: 15

16 Add servers for monitoring (press the Add button in the window below to add the servers): Select the servers from the list (separate window Select Hyper-V Servers shown below will be opened) and then set the credentials in the dialog window. Contact your network administrator to get the credentials. You can select one of two ways of authentication: 1) Use default credentials. Current user credentials will be used. 2) Use custom credentials. You can define credentials that will be used to manage vfirewall on the target server. Those credentials will be used only for authentication to retrieve virtual machines list and manage vfirewall with Powershell API. It will not affect user account used by vfirewall service on target machine. 16

17 You may change properties of the already added server at any time by pressing the Edit button in the Servers for monitoring window shown above. You can also change server credentials and a default monitoring state in the Server Properties dialog further (please, refer to Changing Host Settings subsection of 5nine Security Operations section). You may also add servers to the list individually by pressing the Add button and entering the server s name manually in the dialog window below: 17

18 Or let 5nine Cloud Security Free Edition search and add servers automatically by pressing the AD Discovery button, or search for servers by IP range/subnet mask, which can be set in the window below called out by pressing the IP Discovery button: At the end of 5nine Cloud Security Free Edition successful installation process the following message will appear: To finally complete the 5nine Cloud Security Free Edition installation, confirm rebooting of your host: 18

19 vfirewall Silent Installation vfirewall installer accepts following parameters: 1) DataSource. Defines which SQL database to use. This consists of the several parts. The first part defines the type of data source. Possible variants: CE and SQL Instance. The first specifies that local SQL CE 4.0 server will be used; the second specifies that a specific SQL server instance will be used. The second part defines the name of the used SQL Server (in the case of using SQL instance). The third part defines SQL Server authorization type. Possible variants: WinAuth (Authorization with Windows User credentials) or SQLAuth (Authorization by SQL account). If SQLAuth variant is specified user should define SQL user name and password separated by a comma. All parts of data source parameter should be separated by a comma. Common form of datasource string: { CE, SQLInstance }[, ServName,{ WinAuth, SQLAuth }[, UsrName,Password]] Examples of datasource parameter: CE SQLInstance, SOME_SERVER\SQLEXPRESS, WinAuth SQLInstance, SOME_SERVER\SQLEXPRESS, SQLAuth, sa,sa 2) SrvUserName. Defines user name for vfirewall service. 3) SrvPassword. User password. 4) LicenseFile. License file path. Silent installation command line sample: vfwsetup.msi /q Datasource= SQLInstance, SOME_SERVER\SQLEXPRESS, WinAuth SrvUserName= SOME_DOMAIN\Administrator SrvPassword= 123 LicenseFile= c:\license.txt After silent installation machine will be automatically rebooted. 19

20 5nine Security Operations To configure 5nine Cloud Security Free Edition use the menu commands described below: Adding and RemovingH To add host(s) for monitoring; use the Hosts-Add Host menu command, then type the host(s) name in to the dialog below or select them from the list (as described above): Set Authentication parameters just like it was done earlier during installation (please, refer to Installation). To remove a host from monitoring, select it in the tree and use the Hosts Remove Host menu command. Setting v-firewall Rules Adding Rules To add 5nine Cloud Security Free Edition rules; use the Rules menu commands: 20

21 Adding IP rule: Set the necessary parameters, use a space and comma as delimiters when specifying remote IPs and VMs as shown in the windows below: 21

22 To select remote virtual machines from a list, press the button to the right of the field containing their names and check the machines you would like to add and then press OK in the window below: At the end click Ok and the rule will appear in the 5nine Cloud Security Free Edition main window. 22

23 Rule templates There are pre-defined rule parameters sets (templates) implemented in 5nine Cloud Security Free Edition that help you to populate the dialog with necessary values to create rules for some common scenarios (e.g. HTTP access; remote access through RDP, Telnet or SSH etc.). These templates already contain the necessary values to be entered to the dialog, i.e. protocol, TCP/UDP port number etc. The only thing you need to do is select the template you need and choose the right direction, action and remote VMs/IP addresses for which the rule will apply. To use the rule template click the Templates button in the lower left corner of the Add Rule dialog. The following dialog will show you the template list with the most common-used scenarios placed on the top of the list and marked as Popular : - Select the scenario you need by using a left-click; - Select the direction (inbound/outbound); - Click Apply. The Add rule dialog will be filled with parameters applicable for the selected scenario. Note. Be accurate when choosing the direction of the traffic you wish to allow or block. It is important to set this parameter correctly and the assigned TCP/UDP port (local or remote) depends on the set direction. Otherwise the rule you created will not work properly. E.g. if you wish to create the HTTP rule on the VM-web client, set the Outbound direction; if you wish to create the same rule on the VM that is a web server, set the Inbound direction. 5nine Cloud Security Free Edition template will set the HTTP port 80 to remote for VM-client and local for VM-server accordingly to set the TCP segment analysis in the proper way. Contact your network expert, if assistance is needed. As an example, let s see how it will work for the HTTP rule, allowing traffic on the VM web client: Select the template row with the name HTTP : 23

24 Make sure you have selected Outbound direction ( Inbound is default): 24

25 Click Apply. The Add Rule dialog will be filled automatically: Adding rules for multiple virtual machines: The following message will appear when multiple rules are added successfully: 25

26 Adding default gateway rule: Here you have two options: - Add rules to Virtual machines Global Rules the rule being created will be added to Global-VM Rules list and will apply to all the VMs set on v-firewall; - Add rules to selected Virtual machines the rule being created will only be added to the rules lists only for those VMs which were chosen. 26

27 After pressing Ok the following message should appear to inform you that you have successfully added the default gateway rules: and the single IP rule with the following characteristics will be automatically created and added to the necessary places as described above: - Name: Default gateway IP Rule ; - Type of rule: IP ; - Type: Any ; - Action: Allow ; - Protocol: Any ; - Remote IPs: (as it s entered in the example given here); - Local ports: Any ; - Remote ports: Any ; - Priority: 1. As you can see, this IP rule is a permissive rule. It assures that VMs are able to send/receive traffic to/from other subnets through their default gateway that has to be properly configured in TCP/IP settings (or at a DHCP server or a router if a DHCP automatic IP settings assignment is used in your network). Certainly, the other permissive rules have to be additionally created for the necessary type of traffic and added to necessary VMs. Editing rule To edit a rule, select it in the list, then click the Edit Rule button on the top menu panel. Then change the IP, ARP or Broadcast rule settings in the appropriate dialog just like when adding the rule. Removing rule To remove a rule, select it in the list, then click the Remove Rule button on the top menu panel. The rule will disappear from the list. 27

28 Changing rules order To change rules order in the list (up or down) click the Change Order button on the top menu panel and set the desired order in the dialog window below: Select one of the options: - Move First to put the selected rule on the first place in the list. - Move Last to put the selected rule on the last place in the list. - Move After to put the selected rule after another rule. Select that rule from the list box next to this option. Rules will be applied in accordance with their positions in the list. Setting Virtual Firewall To set a virtual firewall use the Settings v-firewall menu command: 28

29 Specify which VMs will be set on the virtual firewall in the dialog below. Clear the check box to remove the necessary VM from monitoring and then press OK: To set the particular VM on the monitoring, select the VM and use the Monitoring context menu command: Use the same command to remove the VM from vfirewall protection. Antivirus There are two ways 5nine Cloud Security Free Edition antivirus works: - Automatic anti-malware scans by pre-defined schedules; - On-demand anti-malware scans initiated by user. Scheduled Antivirus To set 5nine Security Antivirus for scheduled automatic anti-malware runs, you should enable it on the selected VMs and set antivirus schedule. 29

30 Enable antivirus To enable scheduled anti-malware scans, use the Settings Antivirus menu command. The following dialog will appear: Tick the boxes to the left of the VM names for those VMs that you choose to enable for the scheduled anti-malware scans (ticking the box to the left of the host name will enable antivirus for all of its VMs). Choose the file extensions that will be scanned for viruses: Here you have two options: - Scan all files all files on the virtual machine will be checked. 30

31 - Allow me to control exactly what is scanned (default option) only certain types of files which extensions are added to the list will be checked. There is the default list of file types which is recommended to be used. However, you are able to edit it by adding or removing file extensions from this list. Push the Add or Remove buttons to add or remove the extensions. Add the file extension and its description in the dialog below, and then click Ok: To edit the already added extension, find it in the list, then click the Edit button and perform the same actions as above in the Edit extension dialog: To include the files without extensions in the scanning process, enable the Scan files with no extension option (disabled by default): To restore the default settings push the Restore defaults button on the Extensions tab. 31

32 If you do not want the Hyper-V cloud snapshot to be removed after scan, open the Advanced tab and clear the Remove Hyper-V snapshot after scan check box that is ticked by default: Set antivirus schedule To set antivirus schedule use the Settings Antivirus Schedule menu command. The Antivirus Schedule List dialog will appear: 32

33 Call out the schedule setting window by pressing the Add button in the window above: Set the recurrence parameters hourly (shown above), daily: 33

34 weekly: or monthly: 34

35 At the end press Ok. On-Demand antivirus To enable on-demand anti-malware scan on the host and control it, select the necessary host in the tree on the left, then use the appropriate Antivirus context menu command: - Start to start the anti-malware scan. - Stop to terminate the anti-malware scan. - Query to retrieve the anti-malware scan state. The state will be shown with appropriate message, e.g.: - Pause to temporarily pause the anti-malware scan. - Resume to continue the temporarily paused anti-malware scan. - Last scan log to view the anti-malware last scan results. The results will appear on the Antivirus tab. 35

36 To enable on-demand anti-malware scan on the virtual machine and control it, select the virtual machine in the tree on the left, then use the appropriate Antivirus context menu command: or use the appropriate buttons on the Antivirus tab: The controls are the same as when operating on a host. Changing VM Settings To change virtual machine settings, select the virtual machine in the tree on the left, then click the VM Settings button on the top menu panel or use the VM Settings context menu command: 36

37 The following dialog will appear: Here you can enable/disable logging on the particular VM and set logging parameters such as retention length in days and log records count. Changing Host Settings To change host settings, first select the host in the tree on the left, then use the Settings context menu command: The Server Properties dialog will appear: 37

38 Set authentication parameters as described in Adding and Removing subsection. Tick Enable monitoring on new VMs by default box to set vfirewall automatically when a new VM is added (either created or migrated) on the host. Default monitoring state setting is stored in the management service configuration file (settings DefaultMonitoringState in 5nine.VirtualFirewall.Manager.exe.config). Default monitoring state is individual for each monitored host. By default it set to true. This means that all new virtual machines have a monitoring state set to Enabled. When a new virtual machine is created on a monitored host the vfirewall checks if there are any saved settings (in case when machine created as result of migration from any other host with vfirewall installed). If there are no previously saved settings then new VM monitoring state will be set to default monitoring state value. Click OK. Push the Workload thresholds button to change workload parameters if necessary. The following dialog will appear: Set the virtual environment workload thresholds for server s processor, memory, disk input/output and network input/output over-utilization (all in percent to maximum) then press Ok. The defaults are: - Processor over-utilization threshold: 80 - Memory over-utilization threshold: 90 - Disk I/O over-utilization threshold: 80 - Network I/O over-utilization threshold: 80 When anti-malware scan is running, the scanning process on each VM will be automatically paused/resumed (if necessary) in accordance with current workload parameters preventing the host from overload. Refreshing the Object Tree To refresh or change the view (list or tree) use the View menu commands: 38

39 5nine Security Information To get 5nine Cloud Security Free Edition information, use the Help About menu command: The following dialog will display the product version installed on your server and copyright information: 5nine Security Configuration File and PowerShell API v-firewall vfw3 service configuration file %Program Files%\5nine\5nine v-firewall 3.0\5Nine.vFW.vFWService.exe.cfg <?xml version="1.0" encoding="utf-8"?> <configuration> <configsections> <section name="monitoredhosts" type="fivenine.vfw.vfwservicehelpers.monitoredhostsconfigurationsection, 5Nine.vFW.vFWServiceHelpers" /> </configsections> <MonitoredHosts> <host name="host1" /> <host name="host2" />... <host name="hostn" /> </MonitoredHosts> <appsettings> <add key="heartbeatperiod" value="5000" /> <add key="attemptsbeforepause" value="4" /> <add key="logfile" value="vfirewall2.log" /> <add key="loglevel" value="information" /> </appsettings> </configuration> 39

40 Get the list of VM machines The sample of Power Shell script to get GUIDs of VM machines from the specified host $VMs = get-wmiobject -computername $hyper -namespace "root\virtualization" -query "SELECT * FROM Msvm_ComputerSystem WHERE Caption Like '%virtual%'" foreach ($VM in $VMs) { write-host "==================================" write-host "VM Name: " $VM.ElementName write-host "VM GUID: " $VM.Name } API description Add-IP-Rule Add-IP-Rule -VMId <Guid> -Name <String> [-Description <String>] [- Type <String>] -Action <RuleAction> -Protocol <String> [-LocalPort s <String>] [-RemotePorts <String>] [-IPAddresses <String>] [-VMs <String>] [-MACAddresses <String>] [-Priority <Int32>] [-ApplyNow] [-Verbose] [-Debug] [-ErrorAction <ActionPreference>] [-WarningAc tion <ActionPreference>] [-ErrorVariable <String>] [-WarningVariab le <String>] [-OutVariable <String>] [-OutBuffer <Int32>] Set-VMMonitoring Set-VMMonitoring -VMId <Guid> -Enable 1 0 [-Verbose] [-Debug] [-ErrorA ction <ActionPreference>] [-WarningAction <ActionPreference>] [-Er rorvariable <String>] [-WarningVariable <String>] [-OutVariable <S tring>] [-OutBuffer <Int32>] Get-LogRecords Get-LogRecords -VMId <Guid> [-Verbose] [-Debug] [-ErrorAction <Act ionpreference>] [-WarningAction <ActionPreference>] [-ErrorVariabl e <String>] [-WarningVariable <String>] [-OutVariable <String>] [- OutBuffer <Int32>] Get-Rules Get-Rules [-Id <Guid[]>] [-VMId <Guid>] [-Verbose] [-Debug] [-Erro raction <ActionPreference>] [-WarningAction <ActionPreference>] [- ErrorVariable <String>] [-WarningVariable <String>] [-OutVariable <String>] [-OutBuffer <Int32>] Get-VMIPMAC Get-VMIPMAC -VMId <Guid> [-Verbose] [-Debug] [-ErrorAction <Action Preference>] [-WarningAction <ActionPreference>] [-ErrorVariable < 40

41 String>] [-WarningVariable <String>] [-OutVariable <String>] [-Out Buffer <Int32>] Get-VMMonitoring Get-VMMonitoring [-VMId <Guid>] [-Verbose] [-Debug] [-ErrorAction <ActionPreference>] [-WarningAction <ActionPreference>] [-ErrorVar iable <String>] [-WarningVariable <String>] [-OutVariable <String> ] [-OutBuffer <Int32>] Remove-Rule Remove-Rule -Id <Guid> [-ApplyNow] [-Verbose] [-Debug] [-ErrorActi on <ActionPreference>] [-WarningAction <ActionPreference>] [-Error Variable <String>] [-WarningVariable <String>] [-OutVariable <Stri ng>] [-OutBuffer <Int32>] Reset-Rules Reset-Rules -VMId <Guid> [-Verbose] [-Debug] [-ErrorAction <Action Preference>] [-WarningAction <ActionPreference>] [-ErrorVariable < String>] [-WarningVariable <String>] [-OutVariable <String>] [-Out Buffer <Int32>] Set-Rule Set-Rule -Id <Guid> [-Name <String>] [-Description <String>] [-Typ e <String>] [-Action <RuleAction>] [-Protocol <String>] [-LocalPor ts <String>] [-RemotePorts <String>] [-IPAddresses <String>] [-MAC Addresses <String>] [-VMs <String>] [-Priority <Int32>] [-ApplyNow ] [-Verbose] [-Debug] [-ErrorAction <ActionPreference>] [-WarningA ction <ActionPreference>] [-ErrorVariable <String>] [-WarningVaria ble <String>] [-OutVariable <String>] [-OutBuffer <Int32>] Set-VMIPMAC Set-VMIPMAC -VMId <Guid> [-IPAddresses <String>] [-MACAddresses <S tring>] [-Verbose] [-Debug] [-ErrorAction <ActionPreference>] [-Wa rningaction <ActionPreference>] [-ErrorVariable <String>] [-Warnin gvariable <String>] [-OutVariable <String>] [-OutBuffer <Int32>] How to Set Firewall rules in vfw3 Sample scenario to allow RDP access to VM Launch Power Shell and input the following commands: o o o Add-PSSnapIn RulesAPI add vfw3 API snap-in to Power Shell Get VM GUIDs by applying sample PS script Set-VMMonitoring -VMId <Guid> -Enable 1 - set VM to vfw3 monitoring 41