These permissions must be applied at the data center level in the Hosts and Clusters view of the vCenter. Because the ability to fetch parent IDs of various entities is required, applying the permissions in the cluster level will cause errors.
Preparing the ESX host
This is the first step in deploying the DSVA. In this phase, a kernel driver is loaded onto the ESX host, and a separate vSwitch is configured to facilitate internal connectivity for the DSVA.
| Configuration Location | Required Permissions |
|---|---|
| Host > Configuration > Change Settings | Permissions Required to Query Modules on ESX |
| Host > Configuration > Maintenance | Permissions Required to Enter and Exit Maintenance Mode |
| Host > Configuration > Network Configuration | Permissions required to add new virtual switch, port group, virtual NIC etc. |
| Host > Configuration > Advanced Settings | Permissions required to setup networking for dvfilter communication on ESX |
| Host > Configuration > Query Patch | Permissions required to install Filter Driver |
| Host > Configuration > Connection | Permissions to disconnect/reconnect a host |
| Host > Configuration > Security profile and firewall | Permissions to reconfigure outgoing FW connections to allow retrieval of Filter Driver package from DSM |
| Global > Cancel Task | Permissions required to cancel a task if required |
| Host > Configuration > System Management | Permissions to prepare ESXi |
| Host > Configuration > Image Configuration | Permissions to configure DSVA image |
| Host > Configuration > Memory Configuration | Permissions to configure DSVA memory |
Deploying the Virtual Appliance
This is the second step in DSVA deployment, during which the virtual appliance itself is deployed from an OVF file.
| Configuration Location | Required Permissions |
|---|---|
| vApp > vApp application configuration | Permissions to set Product Version for DSVA |
| vApp > Import | Permissions to deploy DSVA from OVF file |
| Datastore > Allocate Space | Permissions required to allocate space for DSVA on datastore. |
| Host > Configuration > Virtual machine autostart configuration | Permissions to set DSVA to autostart on ESX |
| Network > Assign Network | Permissions to assign DSVA to networks |
| Virtual Machine > Configuration > Add new disk | Permissions to add disks to DSVA |
| Virtual Machine > Interaction > Power On | Permissions to power on DSVA |
| Virtual Machine > Interaction > Power Off | Permissions to power off DSVA |
| Host > Inventory > Modify Cluster | Permissions to deploy DSVA |
| Virtual Machine > Change Configuration > Set annotation | Permission to deploy DSVA |
Activating the Virtual Machine
In this third step, the appliance is activated into the Deep Security Manager (DSM) system.
| Configuration Location | Required Permissions |
|---|---|
| Virtual Machine > Configuration > Advanced | Permissions to reconfigure virtual machine for dvfilter |
Regular Operations
For ongoing operations, less permissions are needed.
| Configuration Location | Required Permissions |
|---|---|
| Host > Configuration > Change Settings | Permissions required to query modules on ESX |
| Virtual Machine > Configuration > Advanced | Permissions to reconfigure virtual machine for dvfilter |
Deep Security Virtual Appliance Seamless Upgrade
For more information about DSVA seamless upgrade, see option 1 of the "Upgrade the appliance" section.
| Configuration Location | Required Permissions |
|---|---|
| ESX Agent Manager > Modify | Required for seamless upgrade |
| Virtual Machine > Edit Inventory > Remove | Required for seamless upgrade |
NSX Environment
For NSX environment, both deployment and operation require the NSX built-in administrator account or a vCenter user account with assigned Enterprise Administrator role. To assign a role to vCenter user, follow the procedure in this VMware article: Assign a Role to a vCenter User.