Chapter 8. Managing vSphere Security, SRM, vCloud Air, and vROps

So far, we have discussed how to install and configure ESXi servers and how to configure and manage networks and storage in a vSphere environment. Then we discussed logical constructs in a vCenter environment. In the previous chapter, we covered how to manage the different aspects of a virtual machine, thus making life easier for the virtual administrator. In this chapter, we will discuss the additional aspects of a vCenter environment, which are as follows:

• The vSphere Security Hardening Guide

• Managing vSphere Update Manager

• Configuring firewall and services in an ESXi host

• Managing host profiles

• Managing vCenter Site Recovery Manager

• Managing vCloud Air

• Managing vRealize Operations Manager

We will start this chapter with a discussion on the Security Hardening Guide in a vSphere environment.

The vSphere Security Hardening Guide

The Security Hardening Guides provided by VMware gives a prescriptive guidance for end users on how to securely deploy and operate VMware products. Typically, vSphere guides are provided in a spreadsheet format. The document also includes script examples in various formats used for automating the security implementation. To get the latest version of the document, visit the website and download the version applicable to you from:

https://www.vmware.com/security/hardening-guides.

In this book, we will cover and discuss the vSphere 6.0 Hardening Guide. There is a total of 75 points regarding security best practices that should be checked and implemented. In Chapter 12, Best Practices and Sample Scripts we will provide you with a script that will cover all these points, and automate the environment to check for the points; if they are not set, the script will set them for you.

Note that many of the points can be set and checked using Update Manager and host...

Managing vSphere Update Manager

VMware vSphere Update Manager is a tool used to automate patch management and remove manual tracking and patching for ESXi hosts and virtual machines. We can use the following cmdlets to manage Update Manager in a vSphere environment using PowerCLI:

• Attach-Baseline

• Detach-Baseline

• Get-Baseline

• Remove-Baseline

• Get-Compliance

• Download-Patch

• Get-Patch

• Stage-Patch

• Get-PatchBaseline

• New-PatchBaseline

• Set-PatchBaseline

• Remediate-Inventory

• Scan-Inventory

If you take a look at the cmdlets, you will notice that there are few categories in which we can place the cmdlets. The first of these groups is the one that manages Patch. The following are the three cmdlets for this group:

• Download-Patch

• Get-Patch

• Stage-Patch

Using the first Download-Patch cmdlet, we can download the patches. This cmdlet initiates the download of new patches and returns a task object. To get the status of the task, we can use the Get-Task cmdlet:

As you can see in the preceding example...

Configuring a firewall and services in an ESXi host

Configuring a firewall in any environment is one of the main security configurations that anyone does. To configure a firewall in a vSphere environment, we can use the following cmdlets:

• Get-VMHostFirewallDefaultPolicy

• Set-VMHostFirewallDefaultPolicy

• Get-VMHostFirewallException

• Set-VMHostFirewallException

Also, we can use the following cmdlets to manage the services in an ESXi host:

• Get-VMHostService

• Restart-VMHostService

• Set-VMHostService

• Start-VMHostService

• Stop-VMHostService

We will start with the firewall cmdlets, and then we will take a look at the services that control the cmdlets.

We can get a list and status of the services in an ESXi server using the Get-VMHostFirewallException cmdlet:

We can get a selective list as well; for example, to get a list of enabled services, we can use the same cmdlet with the –Enabled parameter:

PS C:\> Get-VMHostFirewallException -VMHost ESXi1.lab.com -Enabled:$true

We can use the Set-VMHostFirewallException...

Managing host profiles

In Chapter 3, Deploying vSphere Hosts we touched upon host profile concepts. In this section, we will go more in-depth on the topic. To manage host profiles, we can use the following cmdlets:

• Export-VMHostProfile

• Get-VMHostProfile

• Get-VMHostProfileRequiredInput

• Import-VMHostProfile

• Invoke-VMHostProfile

• New-VMHostProfile

• Remove-VMHostProfile

• Set-VMHostProfile

• Test-VMHostProfileCompliance

We have already checked how we can utilize the New-VMHostProfile, Get-VMHostProfile, and Invoke-VMHostProfile cmdlets.

Here is a set of examples to show you the preceding cmdlets:

Here are the explanations of the preceding cmdlets.

In the first Export-VMHostProfile cmdlet, we are taking a backup of the profile Configuration-Profile in the C drive. Note the extension of the profile; it is saved as a .vpf file.

In the second cmdlet, we are removing an existing profile Configuration-Profile using the Remove-VMHostProfile cmdlet. Next we run the Get-VMHostProfile cmdlet to check whether...

Managing vCenter Site Recovery Manager

Here, we will discuss how we can use PowerCLI cmdlets to manage Site Recovery Manager. To manage SRM, we can use two cmdlets: Connect-SrmServer and Disconnect-SrmServer.

To connect to an SRM server, we first need to connect to a vCenter server where SRM is already configured and attached to the vCenter server. Once we connect to the vCenter server using the Connect-VIServer cmdlet, we can connect to the SRM server using the Connect-SrmServer cmdlet:

PS C:\> $srmServer = Connect-SrmServer
PS C:\> $srmServer

Name                           Port  User                 
----                           ----  ----                 
192.168.12.20                  9007  lab.com\Administrator

To disconnect from an SRM server, we can use the Disconnect-SrmServer cmdlet. To get more information from the SRM server and to manage further aspects, we need to access the extension data information. We will go into details of how we can access this information. Here...

Managing vCloud Air

In this section, we will discuss how to manage vCloud Air using PowerCLI cmdlets. Earlier, we had vCloud director available as a cloud solution, and we could use vSphere PowerCLI for tenants to manage the in-house vCloud director environments. With the availability of the vCloud Air and vCloud Air network environments and discontinuity of a standalone vCloud director environment, we now have updated PowerCLI cmdlets with which we can directly manage the workload hosted in the vCloud Air environment. To manage the vCloud Air environment, at the time of the PowerCLI installation, we need to install the vCloud Air/vCD PowerCLI module as well. It is not installed by default:

The vCloud Air/vCD PowerCLI module has two different modules: VMware.VimAutomation.Cloud and VMware.VimAutomation.PCloud. To get a list of the available cmdlets in these two modules, we can use the Get-Command cmdlet:

PowerCLI C:\> Get-Command -Module Vmware.VimAutomation.PCloud | Select Name

Name...

Managing vRealize Operations Manager

By the time I finished writing the first draft of this book, PowerCLI Version 6.0 Release 2 came out. The major changes are listed here:

• The license snap-in has been converted into a module.

• vSphere Update Manager (VUM): This is used as a separate installable snap-in. This has been converted into a VMware.VumAutomation module and is included in the main installable.

• vRealize Operations Support. With this release, support for vRealize Operations is included.

• vCloud Air support for an on-demand environment is included in this release with the addition of a new cmdlet.

• Cmdlets are added to get more host hardware information.

• New cmdlets have been added to VASA, NFS 4.1, and VAIO filters.

There are other pretty interesting enhancements too. For a detailed coverage, visit the VMware official blog at https://blogs.vmware.com/PowerCLI/2015/09/powercli-6-0-release-2-is-now-generally-available.html.

In this topic, I plan to cover the vRealize Operations support in detail...

Summary

In this chapter, we discussed how to manage security and other aspects of a vSphere environment, starting with host profile and moving on to Update Manager and firewall services. Then we touched upon managing SRM servers and the vCloud Air environment. At the end of the chapter, we discussed the latest release of PowerCLI: Version 6.0 Release2. We also discussed cmdlets for managing the vRealize Operations Manager environment.

In the next chapter, we will move on to more interesting and fun topics involved in managing the APIs in a vSphere environment using PowerCLI.