6.0.3

Because host-based rewalls can slow performance, balance your security needs against performance goals
before you install host-based rewalls on virtual machines elsewhere in the virtual network.
See “Securing the Network with Firewalls,” on page 228.
Segmentation
Keep dierent virtual machine zones within a host on dierent network segments. If you isolate each virtual
machine zone on its own network segment, you minimize the risk of data leakage from one virtual machine
zone to the next. Segmentation prevents various threats, including Address Resolution Protocol (ARP)
spoong, in which an aacker manipulates the ARP table to remap MAC and IP addresses, thereby gaining
access to network trac to and from a host. Aackers use ARP spoong to generate man in the middle
(MITM) aacks, perform denial of service (DoS) aacks, hijack the target system, and otherwise disrupt the
virtual network.
Planning segmentation carefully lowers the chances of packet transmissions between virtual machine zones,
which prevents sning aacks that require sending network trac to the victim. Also, an aacker cannot
use an insecure service in one virtual machine zone to access other virtual machine zones in the host. You
can implement segmentation by using either of two approaches. Each approach has dierent benets.
n
Use separate physical network adapters for virtual machine zones to ensure that the zones are isolated.
Maintaining separate physical network adapters for virtual machine zones is probably the most secure
method and is less prone to misconguration after the initial segment creation.
n
Set up virtual local area networks (VLANs) to help safeguard your network. Because VLANs provide
almost all of the security benets inherent in implementing physically separate networks without the
hardware overhead, they oer a viable solution that can save you the cost of deploying and maintaining
additional devices, cabling, and so forth. See “Securing Virtual Machines with VLANs,” on page 234.
Preventing Unauthorized Access
If your virtual machine network is connected to a physical network, it can be subject to breaches just like a
network that consists of physical machines. Even if the virtual machine network is isolated from any
physical network, virtual machines in the network can be subject to aacks from other virtual machines in
the network. The requirements for securing virtual machines are often the same as those for securing
physical machines.
Virtual machines are isolated from each other. One virtual machine cannot read or write another virtual
machine’s memory, access its data, use its applications, and so forth. However, within the network, any
virtual machine or group of virtual machines can still be the target of unauthorized access from other virtual
machines and might require further protection by external means.
Securing the Network with Firewalls
Security administrators use rewalls to safeguard the network or selected components in the network from
intrusion.
Firewalls control access to devices within their perimeter by closing all communication pathways, except for
those that the administrator explicitly or implicitly designates as authorized. The pathways, or ports, that
administrators open in the rewall allow trac between devices on dierent sides of the rewall.
I The ESXi rewall in ESXi 5.5 and later does not allow per-network ltering of vMotion trac.
Therefore, you must install rules on your external rewall to ensure that no incoming connections can be
made to the vMotion socket.
In a virtual machine environment, you can plan the layout for rewalls between components.
n
Firewalls between physical machines such as vCenter Server systems and ESXi hosts.
vSphere Security
228 VMware, Inc.