1.0

www.vmware.com
230
VMware ACE Administrator’s Manual
Network Quarantine Policies
Network quarantine policies give you fine-grained control over the network access
you provide to users of your virtual machines.
Using a packet filtering firewall, the network quarantine feature of VMware ACE lets
you specify exactly which machines or subnets a virtual machine may access. This
means that you can, for example, configure the virtual machine so it is allowed to
connect only to your VPN server, which then controls access to other resources.
Network quarantine rules can be dynamic. This means, for example, that you can
quickly lock virtual machines out of all or part of your network to help combat the
spread of a worm or virus without deploying updated packages.
You can also set different network quarantine policies for virtual machines based on a
version you assign. This means you can, for example, give out-of-date virtual machines
access to the server that provides a required patch or software update but not to
other parts of your network.
You set and modify network quarantine policies with a wizard. Open the policy editor
from the Commands list on the project or virtual machine details page, select
Network quarantine, select Quarantined access to specific networks and machines,
then click Network Quarantine Wizard.
The following sections provide background on some of the decisions you make as
you set network quarantine policies for a virtual machine. For step-by-step
instructions on using the Network Quarantine Wizard, see Setting Network
Quarantine Policies on page 85.
Selecting the Type of Network Quarantine
The following four types of network quarantine are available:
• Static quarantine — You specify a single list of approved or disapproved
networks and machines. The list is stored with the virtual machine and
distributed as part of the package. If you need to make any changes in the
future, you must create a package containing at least the policies for the
affected virtual machine and distribute the update to your users.
Static quarantine is somewhat simpler to configure and may be the most
convenient choice if you do not plan to change the access list.
• Dynamic quarantine — You specify a single list of approved or disapproved
networks and machines. The list is stored on a server. Each time the virtual
machine runs, and at regular intervals while it is running, it checks the server