| Enhanced Firewall Services |
In Release 6.0.0, the
Enhanced Firewall Services (EFS) functionality supports URL Category Filtering, URL Reputation Filtering, and Malicious IP Filtering in addition to Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) services on
VMware SD-WAN Edges. The following enhancements are introduced for the EFS functionality:
- URL Filtering and Malicious IP Filtering - The URL Filtering and Malicious IP Filtering services are powered by VMware’s award-winning Security components, empowering IT administrators to reduce their system’s attack surface. Through URL Filtering, web traffic is filtered based on Category and Reputation. Integrating the capabilities of VMware Security with VMware SD-WAN Edge platforms enables clients to confidently remove legacy firewalls at branch locations without compromising security and experiencing the benefits of streamlined network and security operations. Additionally, clients leverage VMware's investment in threat intelligence. The solution also provides extensive traffic and threat visualization through improved security dashboards. To configure and manage URL Filtering and Malicious IP Filtering, see the following topics:
- Security Service Groups - Security Service Groups are organized collections of security service settings that are offered as part of the Enhanced Firewall Services. These settings include URL Category, URL Reputation, Malicious IP, and IDS/IPS. These groups are designed to simplify firewall policy management by enabling the creation and reuse of predefined security service configurations across multiple firewall rules. This approach eliminates the need to create and maintain multiple individual security service settings for each firewall rule, thereby streamlining the process and enhancing efficiency. To create a Security Service Group using the pre-configured security services and associate that Security Service Group with the Firewall rules, see Configure Enhanced Security Services.
- Monitor Security Overview - The Security Overview page is enhanced to display the overall impact summary of configured Security services, like IDS/IPS, URL Categories, URL Reputations, and Malicious IP for all Edges within an Enterprise, based on the metrics collected using the various EFS engines (IDS/IPS/URL Filtering/Malicious IP). For more information, see Monitor Security Overview.
- Improved Firewall Logging - The Firewall logging feature presents a comprehensive pane view for each log record selection, encompassing both Firewall and Enhanced Firewall Service engine-related data. Furthermore, new intelligent filters have been integrated to facilitate the searching of logs based on specific engines, including Firewall, Intrusion Detection System/Intrusion Prevention System (IDS/IPS), URL Category, URL Reputation, and Malicious IP. For more inforamtion, see Monitor Firewall Logs.
- To support configuration and monitoring of URL Filtering and Malicious IP Filtering on Edges, new events, alerts, and troubleshooting tests are added. For more information, see Enhanced Firewall Services Alerts and Events and Troubleshooting Firewall.
|
| ECMP Support on Gateway |
To optimize the utilization of the aggregated bandwidth across the ingress interfaces of non-SDWAN sites, VMware SD-WAN solution incorporates active-active mode support in its gateways. Active/Active mode supports to set up a maximum of 4 tunnel endpoints or Gateways. All Active tunnels can send and receive traffic through ECMP.This can be achieved by enabling the establishment of multiple IPsec tunnels in active-active mode towards non-SDWAN sites. This configuration allows load balancing of network traffic across tunnels optimizing the flow of distribution. For more information, see
Monitor Non SD-WAN Destinations through Gateway The Non SD-WAN Destinations via Gateway tab displays the details of already configured Non SD-WAN Destination. The parameters displayed are:
- Total Bytes
- Bytes Received/Sent
- Total Packets
- Packets Received/Sent
For more information, see Monitor Non SD-WAN Destinations through Gateway. |
| VMware Edge Intelligence |
VMware Edge Network Intelligence is now renamed to VMware Edge Intelligence in the documentation.
Note: As the rebranding of the SASE Orchestrator for the product name change is targeted for the next release, all the UI screenshots in this document still display the old product name.
|
