Bromium Secure Platform

May 23, 2019

Contributed by: C

Citrix Hypervisor supports Bromium Secure Platform on Windows VMs. This feature protects your enterprise from breaches and enables users to perform any operations without compromising security.

Note:

The minimum supported Bromium version is 4.0.4.

Using this feature, you can:

Protect your enterprise against known and unknown threats.
Detect and monitor threat activity as it happens.
Respond to a visualization of the attack and view the remedial measures taken.

Compatibility requirements and caveats

Citrix Hypervisor supports Bromium on:

CPU: Intel Core i3, i5, i7 v3 (Haswell) or later with Intel Virtualization Technology (Intel VT) and Extended Page Tables (EPT) enabled in the system BIOS.

AMD CPUs are not supported.
VMs: Windows 7 SP1 (32-bit and 64-bit), Windows 8.1 (64-bit), and Windows 10 (64-bit).
VM resources: At least 2 vCPUs, 4 GB RAM and 32 GB disk space.

For VMs that are running Bromium, Citrix Hypervisor does not support and prevents the use of the following features:

Any form of VM motion (for example: live migration, storage live migration).
Use of Dynamic Memory Control (DMC).

Note:

It is possible to use PCI pass-through and vGPU for a VM that has enabled nested virtualization. However, Citrix does not support such configurations.

Important:

Bromium Secure Platform uses nested virtualization support. Citrix supports this feature for use with Bromium Secure Platform only. Nested virtualization is not supported for other use cases. To use this feature, you must run Citrix Hypervisor Premium Edition or have access to Citrix Hypervisor through a Citrix Virtual Apps and Desktops entitlement.

Configuration

To prepare your Citrix Hypervisor system for use with Bromium Secure Platform, perform the following steps:

On each host, force the use of software VMCS shadowing by running the following command at the command prompt:
```
/opt/xensource/libexec/xen-cmdline --set-xen force_software_vmcs_shadow
```
Restart the host.
On each VM, enable nested-virtualized support using the following commands:
```
xe vm-list name-label='vm_name' --minimal

xe vm-param-set uuid=$VM platform:nested-virt=1
```
Note:

For Citrix Virtual Desktops, use the gold image for nested virtualization.
Install Bromium Secure Platform in the VM by following its installation instructions.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

Bromium Secure Platform

May 23, 2019

Contributed by: C

Bromium Secure Platform

Compatibility requirements and caveats

Configuration

Bromium Secure Platform

In this article