6.0.3

n
Firewalls between one virtual machine and another—for example, between a virtual machine acting as
an external Web server and a virtual machine connected to your company’s internal network.
n
Firewalls between a physical machine and a virtual machine, such as when you place a rewall between
a physical network adapter card and a virtual machine.
How you use rewalls in your ESXi conguration is based on how you plan to use the network and how
secure any given component needs to be. For example, if you create a virtual network where each virtual
machine is dedicated to running a dierent benchmark test suite for the same department, the risk of
unwanted access from one virtual machine to the next is minimal. Therefore, a conguration where rewalls
are present between the virtual machines is not necessary. However, to prevent interruption of a test run
from an outside host, you might set up the conguration so that a rewall is present at the entry point of the
virtual network to protect the entire set of virtual machines.
Firewalls for Configurations with vCenter Server
If you access ESXi hosts through vCenter Server, you typically protect vCenter Server using a rewall. This
rewall provides basic protection for your network.
A rewall might lie between the clients and vCenter Server. Alternatively, depending on your deployment,
vCenter Server and the clients can both be behind the rewall. The main point is to ensure that a rewall is
present at what you consider to be an entry point for the system.
For a comprehensive list of TCP and UDP ports, including those for vSphere vMotion™ and vSphere Fault
Tolerance, see “vCenter Server TCP and UDP Ports,” on page 215.
Networks congured with vCenter Server can receive communications through the vSphere Web Client or
third-party network management clients that use the SDK to interface with the host. During normal
operation, vCenter Server listens for data from its managed hosts and clients on designated ports.
vCenter Server also assumes that its managed hosts listen for data from vCenter Server on designated ports.
If a rewall is present between any of these elements, you must ensure that the rewall has open ports to
support data transfer.
You might also include rewalls at a variety of other access points in the network, depending on how you
plan to use the network and the level of security various devices require. Select the locations for your
rewalls based on the security risks that you have identied for your network conguration. The following
is a list of rewall locations common to ESXi implementations.
n
Between the vSphere Web Client or a third-party network-management client and vCenter Server.
n
If your users access virtual machines through a Web browser, between the Web browser and the ESXi
host.
n
If your users access virtual machines through the vSphere Web Client, between the vSphere Web Client
and the ESXi host. This connection is in addition to the connection between the vSphere Web Client and
vCenter Server, and it requires a dierent port.
n
Between vCenter Server and the ESXi hosts.
n
Between the ESXi hosts in your network. Although trac between hosts is usually considered trusted,
you can add rewalls between them if you are concerned about security breaches from machine to
machine.
If you add rewalls between ESXi hosts and plan to migrate virtual machines between the servers,
perform cloning, or use vMotion, you must also open ports in any rewall that divides the source host
from the target hosts so that the source and targets can communicate.
n
Between the ESXi hosts and network storage such as NFS or iSCSI storage. These ports are not specic
to VMware, and you congure them according to the specications for your network.
Chapter 8 Securing vSphere Networking
VMware, Inc. 229