6.0.3

See “ESXi Networking Security Recommendations,” on page 159.
Use Firewalls to Secure
Virtual Network
Elements
You can open and close rewall ports and secure each element in the virtual
network separately. Firewall rules associate services with corresponding
rewalls and can open and close the ESXi rewall according to the status of
the service.
See “ESXi Firewall Conguration,” on page 173.
Consider Network
Security Policies
Networking security policy provides protection of trac against MAC
address impersonation and unwanted port scanning. The security policy of a
standard or distributed switch is implemented in Layer 2 (Data Link Layer)
of the network protocol stack. The three elements of the security policy are
promiscuous mode, MAC address changes, and forged transmits.
See the vSphere Networking documentation for instructions.
Secure Virtual Machine
Networking
The methods you use to secure a virtual machine network depend on which
guest operating system is installed, whether the virtual machines operate in a
trusted environment, and a variety of other factors. Virtual switches and
distributed virtual switches provide a substantial degree of protection when
used with other common security practices, such as installing rewalls.
See Chapter 8, “Securing vSphere Networking,” on page 227.
Consider VLANs to
Protect Your
Environment
ESXi supports IEEE 802.1q VLANs, which you can use to further protect the
virtual machine network or storage conguration. VLANs let you segment a
physical network so that two machines on the same physical network cannot
send packets to or receive packets from each other unless they are on the
same VLAN.
See “Securing Virtual Machines with VLANs,” on page 234.
Secure Connections to
Virtualized Storage
A virtual machine stores operating system les, program les, and other data
on a virtual disk. Each virtual disk appears to the virtual machine as a SCSI
drive that is connected to a SCSI controller. A virtual machine is isolated
from storage details and cannot access the information about the LUN where
its virtual disk resides.
The Virtual Machine File System (VMFS) is a distributed le system and
volume manager that presents virtual volumes to the ESXi host. You are
responsible for securing the connection to storage. For example, if you are
using iSCSI storage, you can set up your environment to use CHAP and, if
required by company policy, mutual CHAP by using the vSphere Web Client
or CLIs.
See “Storage Security Best Practices,” on page 250.
Evaluate the Use of
IPSec
ESXi supports IPSec over IPv6. You cannot use IPSec over IPv4.
See “Internet Protocol Security,” on page 239.
In addition, evaluate whether VMware NSX for vSphere is a good solution for securing the networking layer
in your environment.
Chapter 1 Security in the vSphere Environment
VMware, Inc. 15