6.0

Securing the Management Interface 6
Secure the management Interface of an ESXi host and the virtual machine guest operating system by
restricting the services and management agents that are allowed to interface directly with the host or virtual
machine.
This chapter includes the following topics:
n
“Securing ESXi Hosts,” on page 59
n
“Securing Virtual Machines,” on page 63
Securing ESXi Hosts
The ESXi hypervisor architecture has many built-in security features such as CPU isolation, memory
isolation, and device isolation. You can configure additional features such as lockdown mode, certificate
replacement, and smart card authentication for enhanced security.
An ESXi host is also protected with a firewall. You can open ports for incoming and outgoing traffic as
needed, but should restrict access to services and ports. Using the ESXi lockdown mode and limiting access
to the ESXi Shell can further contribute to a more secure environment. Starting with vSphere 6.0, ESXi hosts
participate in the certificate infrastructure. Hosts are provisioned with certificate that are signed by the
VMware Certificate Authority (VMCA) by default.
See the VMware white paper Security of the VMware vSphere Hypervisor for additional information on ESXi
security.
Allow or Deny Access to an ESXi Service or Management Agent
You can configure firewall properties to allow or deny access for a service or management agent.
You add information about allowed services and management agents to the host configuration file. You can
enable or disable these services and agents using the vSphere Client or at the command line.
NOTE If different services have overlapping port rules, enabling one service might implicitly enable
overlapping services. To minimize the effects of this behavior, you can specify which IP addresses are
allowed to access each service on the host.
Procedure
1 Select the host in the inventory panel.
2 Click the Configuration tab, then in the Software section, click Security Profile.
The vSphere Client displays a list of active incoming and outgoing connections with the corresponding
firewall ports.
VMware, Inc.
59