6.0.3

Limiting vCenter Server Network Connectivity
For improved security, avoid puing the vCenter Server system on any network other than a management
network, and ensure that vSphere management trac is on a restricted network. By limiting network
connectivity, you limit certain types of aack.
vCenter Server requires access to a management network only. Avoid puing the vCenter Server system on
other networks such as your production network or storage network, or on any network with access to the
Internet. vCenter Server does not need access to the network where vMotion operates.
vCenter Server requires network connectivity to the following systems.
n
All ESXi hosts.
n
The vCenter Server database.
n
Other vCenter Server systems (if the vCenter Server systems are part of a common vCenter Single Sign-
On domain for purposes of replicating tags, permissions, and so on).
n
Systems that are authorized to run management clients. For example, the vSphere Web Client, a
Windows system where you use the PowerCLI, or any other SDK-based client.
n
Systems that run add-on components such as VMware vSphere Update Manager.
n
Infrastructure services such as DNS, Active Directory, and NTP.
n
Other systems that run components that are essential to functionality of the vCenter Server system.
Use a local rewall on the Windows system where the vCenter Server system is running or use a network
rewall. Include IP-based access restrictions so that only necessary components can communicate with the
vCenter Server system.
Consider Restricting the Use of Linux Clients
Communications between client components and a vCenter Server system or ESXi hosts are protected by
SSL-based encryption by default. Linux versions of these components do not perform certicate validation.
Consider restricting the use of these clients.
Even if you have replaced the VMCA-signed certicates on the vCenter Server system and the ESXi hosts
with certicates that are signed by a third party CA, certain communications with Linux clients are still
vulnerable to man-in-the-middle aacks. The following components are vulnerable when they run on the
Linux operating system.
n
vCLI commands
n
vSphere SDK for Perl scripts
n
Programs wrien using the vSphere Web Services SDK
You can relax the restriction against using Linux clients if you enforce proper controls.
n
Restrict management network access to authorized systems only.
n
Use rewalls to ensure that only authorized hosts are allowed to access vCenter Server.
n
Use jump-box systems to ensure that Linux clients are behind the jump.
vSphere Security
212 VMware, Inc.