Loading

×Sorry to interrupt
This page has an error. You might just need to refresh it.
[NoErrorObjectAvailable] Uncaught ReferenceError: addCTracking is not defined
Failing descriptor: {markup://c:KM_ArticleThemeLayout}

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

How to deploy AppDefense in VMware Cloud Foundation 3.7 (67347)

Last Updated: 6/28/2019Categories: How toTotal Views: 2604Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Purpose

This article provides instructions for installing AppDefense into a VMware Cloud Foundation 3.7 Virtual Infrastructure workload domain.

Resolution

Prerequisites:

VMware Cloud Foundation 3.7 is deployed.

A Virtual Infrastructure (VI) workload domain has been created.

Access to a vSphere Platinum license or an AppDefense Cloud SaaS Subscription account. You can find details on provisioning an AppDefense Cloud SaaS account at Sign up for VMware AppDefense Service (SaaS).

Note: If you have upgraded VMware Cloud Foundation from version 3.5.x to version 3.7, use the following steps to prepare the environment for AppDefense installation:

Download the attached 67347_vcf-projectmanager.rpm file.

Use a file transfer utility to copy the 67347_vcf-projectmanager.rpm file to the /tmp/ folder on SDDC Manager VM.

SSH to the SDDC Manager VM as the vcf user and then issue the su - command to switch to the root user.

Issue the following command to install the /tmp/67347_vcf-projectmanager.rpm file:

rpm -Ihv /tmp/67347_vcf-projectmanager.rpm

Deploy AppDefense in On-Prem Mode:

Use the instructions at Obtain the AppDefense Plug-In Installer to download the AppDefense Appliance OVA.

Use a file transfer utility to copy the AppDefense Appliance OVA to the /opt/vmware/vcf/projectmanager/ova/ folder on the SDDC Manager VM.

SSH to the SDDC Manager VM as the vcf user.

Issue the following command to set the appropriate permissions on the .ova file uploaded in Step 2:

chmod 640 /opt/vmware/vcf/projectmanager/ova/*.ova

Issue the following command to prepare the environment for the AppDefense installation:

sudo /opt/vmware/vcf/projectmanager/scripts/start-projectmanager.sh

Note: You can review the log for this command at /var/log/vmware/vcf/projectmanager/projectmanager.log.

Issue the following command to collect the id values for the management workload domain cluster and the workload domain cluster where AppDefense is being installed:

curl http://localhost/inventory/clusters |json_pp

Note: You will see output similar to the following:

[
{
"datacenter" : "EPG-VCF-DS",
"status" : "ACTIVE",
"id" : "28b97c61-2b30-11e9-845e-cb7bf8aacd71",
"name" : "EPG-VCF-Cluster",
"resourcePoolName" : "EPG-VCF-sddc-mgmt",
"isDefault" : true,
"vcenterId" : "28abe7d1-2b30-11e9-845e-cb7bf8aacd71",
"ftt" : 0,
"domainId" : "280595b0-2b30-11e9-845e-cb7bf8aacd71",
"isStretched" : false,
"vdsIds" : [
"8be2b8e6-3374-4a9f-af9a-a606f6c1be4f"
]
}
{
"datacenter" : "EPG-VCF-DS",
"status" : "ACTIVE",
"id" : "3566a2b1f-a457-994d-e867-456eff89912e",
"name" : "VI-WLD",
"resourcePoolName" : "VI-WLD-test",
"isDefault" : false,
"vcenterId" : "5567eba5-55fa-334a-fca3-df45556911fa",
"ftt" : 0,
"domainId" : "aa5195b2-33f3-99e1-43c1-aa569834bb32",
"isStretched" : false,
"vdsIds" : [
"9c378be6-5592-3abf-dda9-b992115dfff4"
]
}
]

Note: Make a note of the id value for the management workload domain cluster and the workload domain cluster where AppDefense is being installed. In the previous example, 28b97c61-2b30-11e9-845e-cb7bf8aacd71 is the id value for the management workload domain cluster and 3566a2b1f-a457-994d-e867-456eff89912e is the id value for the workload domain cluster where AppDefense is being installed.

Open the /opt/vmware/vcf/projectmanager/templates/enable-appdefense-template.json file with a text editor.

Modify the requires section such that the id values obtained in Step 6 are used for the management-cluster and the workload-cluster, per the following example:

"requires": {
"management-cluster": {
"type": "Cluster",
"id": "28b97c61-2b30-11e9-845e-cb7bf8aacd71"
},
"workload-cluster": {
"type": "Cluster",
"id": "3566a2b1f-a457-994d-e867-456eff89912e"
}
},

Modify the parameters section such that the following values are populated:

"parameters": {
"vm-name": {
"type": "String",
"value": "<desired VM Name>",
"defaultValue": "AppDefense-VM"
},
"vm-ipaddress": {
"type": "IpAddress",
"value": {
"ipAddress": "<IP address on the management network>",
"netmask": "<netmask>",
"gateway": "<default gateway>"
}
},
"vm-dns": {
"type": "String",
"value": "<DNS server IP address>"
},
"vm-ntp": {
"type": "String",
"value": "NTP Server IP/FQDN>"
},
"vm-admin-username": {
"type": "String",
"value": "<enter admin, or leave blank>",
"defaultValue": "admin"
},
"vm-admin-password": {
"type": "String",
"value": "<password between 8 to 20 characters long including at least one lowercase character, one number, and one special character?"
},
"vm-root-password": {
"type": "String",
"value": "<password between 8 to 20 characters long including atleast one lowercase character, one number, and one special character>"
},
"appdefense-id": {
"type": "String",
"value": "<UUID in the format of 12345678-1234-1234-1234-123456789012, can include 0-12 and a-f, or leave blank>",
"defaultValue": "6dc3f1bf-64d2-49af-8cfb-d4be74b85bcb"
}
}

Save and close the file.

Issue the following command to deploy AppDefense:

/opt/vmware/vcf/projectmanager/cli.py enableAppDefense --input /opt/vmware/vcf/projectmanager/templates/enable-appdefense-template.json

Deploy AppDefense in SaaS Mode:

Prerequisites:

Ensure that there is connectivity to the internet for VMs on the management network within VMware Cloud Foundation. This will be required for the AppDefense on-prem instance to synchronize with the Cloud Manager service.

Log in to your AppDefense Cloud Manager account. (For US based customers : https://appdefense.vmware.com/app/).

Click the settings icon > Appliance > Provision New Appliance page. The New Appliance window appears.

Create an appliance by entering the appliance name, and then click Provision. The appliance name is an identifier and does not need to match the actual VM name within the vCenter Server, but the best practice is to match the names. For example, Appliance.

The New Appliance Created window displays the URL for the manager in the region, manager UUID, and appliance API key. Keep this window open until the appliance configuration is done, or note down the information as it will be used during the SaaS configuration.

SSH to the SDDC Manager VM as the vcf user.

Open the /opt/vmware/vcf/projectmanager/templates/configure-appdefense-saas-template.json file with a text editor.

Modify the requires section such that the AppDefense UUID value used in Step 9 (appdefense-id section) of the previous section is used for the id, per the following example:

"requires": {
"appdefense-vm" : {
"type" : "AppDefenseAgent",
"id" : "<appdefense-id>"
}
}

Modify the parameters section such that the following values are populated using the AppDefense Manager URL, UUID and Key values obtained in Step 4:

"parameters": {
"appdefense-mgr-url": {
"type": "String",
"value": "<AppDefense Manager URL, or leave blank if using the US default value below>",
"defaultValue": "https://appdefense.vmware.com"
},
"appdefense-mgr-uuid": {
"type" : "String",
"value": "<AppDefense Manager UUID>"
},
"appdefense-mgr-key": {
"type" : "String",
"value": "<AppDefense Manager Key>"
}
}

Save and close the file.

Issue the following command to deploy AppDefense:

/opt/vmware/vcf/projectmanager/cli.py configureSaas --input /opt/vmware/vcf/projectmanager/templates/configure-appdefense-saas-template.json

Install AppDefense Guest Modules

AppDefense needs to install guest modules in guest VMs to protect the applications. A helper script for guest virtual machines running Centos and Ubuntu OSs can be used to install modules. More information to install guest modules can be found at https://docs.vmware.com/en/VMware-AppDefense/2.0/install-appdefense-plugin/GUID-BE81594E-ED34-4ED0-9A71-68EA0C58DC51.html based on your guest OS.

To use the helper script, deploy a guest VM (Centos or Ubuntu OS) in a workload domain and upload the guestmodule.sh script under /opt/vmware/vcf/projectmanager/scripts to the guest. Run this script inside the guest VM.

Once the installation is complete you can check the status using the following commands:

/etc/init.d/vmw_glxd status
/etc/init.d/vmw_conn_notifyd status

Delete AppDefense

SSH to the SDDC Manager VM as the vcf user.

Issue a command similar to the following:

/opt/vmware/vcf/projectmanager/cli.py deleteAppDefense --id 6dc3f1bf-64d2-49af-8cfb-d4be74b85bcb

Note: Replace 6dc3f1bf-64d2-49af-8cfb-d4be74b85bcb with the AppDefense UUID used in your installation.

Note: If you deploy AppDefense again after deleting it, you might not see the AppDefense plugin in the vSphere Client. Use the following steps to resolve this issue:

Log in to the vCenter Server Appliance as the root user.

Issue the following commands to restart the vSphere HTML5 and Web clients:

service-control --stop vsphere-client
service-control --stop vsphere-ui
service-control --start vsphere-client
service-control --start vsphere-ui

Log back in to the vSphere client. The AppDefense plugin should now be present.

Note: It maybe necessary to clear browser cache or try a different browser.

Related Information

If a workload domain with AppDefense deployed is deleted and the /opt/vmware/sddc-suppor/sos --cleanup-decommissioned-host command is run to clean the hosts and prepare them for re-use, the AppDefense host module is not uninstalled. This can be validated on a host by running the following command:

esxcli software vib list |grep glxhost

Note: You will see output similar to the following:

glxhost 1.3.2.0-10483793 VMware VMwareCertified 2019-02-26

To remedy this issue, issue the following command to manually remove the AppDefense host module on each affected host:

esxcli software vib remove glxhost

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

67347_vcf-projectmanager

67347_1_67347_vcf-projectmanager

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Cloud Foundation

Related Versions:

VMware Cloud Foundation 3.7.x

Take Our Survey

Support Assistant