Procedures

From the Home tab, select Inventory > vSphere.

On the vSphere page, select Actions > Add vCenter.

On the Configure page, view and approve the certificates for the Platform Services Controller (PSC) and all vCenters that were discovered.

The Approve checkbox must be checked for all certificates before you can add the vCenter.

Certificates from a trusted source have the Approve checkbox checked automatically.

Select the Certificate link to view the certificate details.

Select Approve to populate the approve checkbox for the certificate, or select the x icon to close the window.

Determine if you want to use a single Published IP for each vCenter or a Published IP Range to be used for all current and future vCenters in this ELM.

For a Published IP, select the Configure link in the Published IP column of the vCenter table, enter the Published IP Address and Netmask, and select Apply.

For a Published IP Range, enter the Published IP Address and Netmask in the Published IP Range section.

Enable Tag Sync if you want vCenter Tags in CloudControl.

When all certificates are approved, select Continue.

Create a tag called ESXi_Host. This will be used to tag the ESXi Hosts in the system.

Tag the ESXi Hosts with the tag created.

Now tag the ESXi Hosts in the system with the ESXi_Host tag created.

From the Home tab, select Security > Trust Manifests.

On the Manage Trust Manifests page, select Actions > Create Trust Manifest.

On the Details tab of the Create Trust Manifest page, enter the name and optional description for the trust manifest.

For Policy Type, select Access Control.

In the Access Control Policy section, create a rule for the NetworkAdmin Group:

Select Add Another Rule and add the rule for the SuperAdmin group to the policy.

Select Validate to validate the policy.

Select Save to save the policy.

Select Publish to publish the policy When you publish the policy it will ask you to assign resources to the policy. Select host and select Assign.

Select Close.

From the Home tab, select Security > Log Analysis.

Select the record that shows the Deny status to see the reason for the denial.

You will be able to see the My Access Control Policy was used to control the access.

From the Home tab, select Security > Trust Manifests.

On the Manage Trust Manifests page, select Create Trust Manifest (The Plus sign in the GUI).

On the Details tab of the Create Trust Manifest page, enter the name and optional description for the trust manifest.

For Policy Type, select Secondary Approval.

In the Secondary Approval Policy section, complete according to the image below:

Publish the policy.

When you publish the policy you must assign resources to it. Select host as the resource. This will make policy applicable to any ESXi host in the system.

From the Home tab, select Security > Secondary Approval Requests.

On the Secondary Approval Requests page, select a tab to view Pending or All requests.

(Optional) Select Approve for a pending request to approve the request.

(Optional) Select Deny for a pending request to reject the request.

From the Home tab, select Security > Configuration Hardening.

On the Configuration Hardening Management page, select the Policies tab.

Select the Create (+) button.

In the Create Policy wizard on the Select Type page, select the type of policy that you want to create. This can be one of the following:

Select Assess Only.

Select Continue.

On the Details page, enter the name and optional description of the policy, and specify whether the policy is enabled.

Select Continue.

On the Templates page, select the resource type for the policy. This can be one of the following:

Select ESXi as the template to run against your environment.

The template list displays the name, description and type of operations Select a template that contains the type of operations that you selected for the policy.

Select vSphere - HyTrust Best Practice template. This template is used in the example.

Select Continue.

On the Assignments page, select one of the following and choose what resources to which you want to apply the policy:

Select Tags for the resources you want to apply the policy.

Select the Assign Tags to Policy Now link to select the tags.

Select the ESXi_Host tag created earlier.

Select Continue.

Select the Tag value True that applies to the ESXi_Host tag.

Select Assign.

Select Continue.

(Optional) For vSphere only. On the Resource Constraint page, choose which tag-based resource constraints that you want to use for your ESXi hosts. This option is not described in detail.

Select Continue.

On the Schedule page, select if you want to enable a recurring schedule.

Select Create.

The newly created policy will be displayed on the Policies tab.

Edit the Check ESXi Patch Version Rule in the template. Select the vSphere - HyTrust Best Practice link in the Template Column. The template details appears.

Under Summary of Operations look for Check ESXi Patch Version.

Once you find it, select the Check ESXi Patch Version link to edit the rule.

Select the Params tab and enter the version according to the image below.

Select Save and Close.

From the Home tab, select Security > Configuration Hardening.

On the Configuration Hardening Management page, select the Policies tab.

Select the Policy that you want to run.

Select Actions > Run Now.

In the confirmation window, select Run Now.

You can view the results by selecting the link in the Last Event column.

Select View Full Results.

In the Last Event Summary Tab, select Resource.

As you look to the results, you will be able to see that the ESXi Version test that was in the policy, Passed.