NSX Administration Guide NSX 6.0 for vSphere This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see EN-001269-01 NSX Administration Guide 2 VMware, Inc. You can find the most up-to-date technical documentation on the VMware Web site at: The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: Copyright 2010 2013 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at VMware is a registered trademark or trademark of VMware, Inc. in the United States and other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. VMware, Inc. 3401 Hillview Ave. Palo Alto, CA 94304 Contents NSX Administration Guide11 1Overview of NSX13 NSX Capabilities14 NSX Components15 2User Management19 Configure Single Sign On19 Managing User Rights20 Managing the Default User Account21 Assign a Role to a vCenter User21 Edit a User Account23 Change a User Role23 Disable or Enable a User Account23 Delete a User Account24 3Grouping Objects25 Working with IP Address Groups25 Working with MAC Address Groups26 Working with IP Pools27 Working with Security Groups28 Working with Services and Service Groups30 4Logical Switches33 Create a Logical Switch34 Connect Virtual Machines to a Logical Switch36 Test Logical Switch Connectivity36 Prevent Spoofing on a Logical Switch37 Edit a Logical Network37 Logical Switch Scenario37 5L2 Bridges43 Add L2 Bridge44 6Logical Router45 Specify Global Configuration45 Add a Static Route46 Configure OSPF Protocol46 Configure BGP Protocol47 Configure IS-IS Protocol48 Configure Route Redistribution49 VMware, Inc. 3 7Logical Firewall51 Working with Distributed Firewall51 Working with Edge Firewall62 8Virtual Private Networks (VPN)s71 SSL VPN-Plus Overview71 IPSec VPN Overview93 L2 VPN Overview97 9Logical Load Balancer101 Set Up Load Balancing101 Working with Application Profiles109 Working with Service Monitors109 Working with Server Pools110 Working with Virtual Servers110 Working with Application Rules111 10Other Edge Services113 Managing DHCP Service113 Configure DNS Servers116 11Service Composer117 Using Service Composer118 Graphical View of Service Composer124 Export a Service Composer Configuration126 Import a Service Composer Configuration127 Working with Security Tags127 Viewing Effective Services129 Working with Security Policies130 Edit a Security Group132 Service Composer Scenarios132 12Data Security137 NSX Data Security User Roles137 Defining a Data Security Policy137 Running a Data Security Scan139 Viewing and Downloading Reports140 Creating Regular Expressions140 13Operations and Management141 System Events and Audit Logs141 Management System Settings145 Working with Domains148 NSX Edge Operations150 Backing Up NSX Manager Data159 Flow Monitoring160 Activity Monitoring165 NSX Administration Guide 4 VMware, Inc. vShield Endpoint Events and Alarms174 14Extensibility (Integrate Partner Solutions with NSX)177 Register a Partner Solution Manually177 Install a Partner Service179 15NSX Edge VPN Configuration Examples181 Terminology182 IKE Phase 1 and Phase 2182 Configuring IPSec VPN Service Example184 Using a Cisco 2821 Integrated Services Router185 Using a Cisco ASA 5510188 Configuring a WatchGuard Firebox X500190 Troubleshooting NSX Edge Configuration Example191 16Data Security Regulations201 Arizona SB-1338203 ABA Routing Numbers203 Australia Bank Account Numbers203 Australia Business and Company Numbers203 Australia Medicare Card Numbers204 Australia Tax File Numbers204 California AB-1298204 California SB-1386205 Canada Social Insurance Numbers205 Canada Drivers License Numbers205 Colorado HB-1119206 Connecticut SB-650206 Credit Card Numbers206 Custom Account Numbers206 EU Debit Card Numbers207 FERPA (Family Educational Rights and Privacy Act)207 Florida HB-481207 France IBAN Numbers207 France National Identification Numbers Policy207 Georgia SB-230 Policy208 Germany BIC Numbers Policy208 Germany Driving License Numbers Policy208 Germany IBAN Numbers Policy208 Germany National Identification Numbers Policy208 Germany VAT Numbers Policy208 Hawaii SB-2290 Policy209 HIPAA (Healthcare Insurance Portability and Accountability Act) Policy209 Idaho SB-1374 Policy209 Illinois SB-1633210 Indiana HB-1101 Policy210 Italy Driving License Numbers Policy210 Italy IBAN Numbers Policy.210 Contents VMware, Inc. 5 Italy National Identification Numbers Policy210 Kansas SB-196 Policy211 Louisiana SB-205 Policy211 Maine LD-1671 Policy211 Massachusetts CMR-201212 Minnesota HF-2121212 Montana HB-732212 Netherlands Driving Licence Numbers212 Nevada SB-347213 New Hampshire HB-1660213 New Je