6.0.3

Connecting to vCenter Server Through a Firewall
vCenter Server uses TCP port 443 to listen for data transfer from its clients. If you have a rewall between
vCenter Server and its clients, you must congure a connection through which vCenter Server can receive
data from the clients.
Open TCP port 443 in the rewall to enable vCenter Server to receive data from the vSphere Web Client.
Firewall conguration depends on what is used at your site, ask your local rewall system administrator for
information.
If you do not want to use port 443 as the port for vSphere Web Client-to-vCenter Server communication, you
can switch to another port by changing the vCenter Server seings from the vSphere Web Client. See the
vCenter Server and Host Management documentation.
If you are still using the vSphere Client, see the vSphere Administration with vSphere Client documentation.
Firewalls for Configurations Without vCenter Server
You can connect clients directly to your ESXi network instead of using vCenter Server.
Networks congured without vCenter Server receive communications through the vSphere Client, one of
the vSphere command-line interfaces, the vSphere Web Services SDK, or third-party clients. For the most
part, the rewall needs are the same as when a vCenter Server is present, but several key dierences exist.
n
As you would for congurations that include vCenter Server, be sure a rewall is present to protect
your ESXi layer or, depending on your conguration, your clients and ESXi layer. This rewall provides
basic protection for your network.
n
Licensing in this type of conguration is part of the ESXi package that you install on each of the hosts.
Because licensing is resident to the server, a separate license server is not required. This eliminates the
need for a rewall between the license server and the ESXi network.
You can congure rewall ports using ESXCLI, using the vSphere Client, or using rewall rules. See “ESXi
Firewall Conguration,” on page 173.
Connecting ESXi Hosts Through Firewalls
If you have a rewall between two ESXi hosts and you want to allow transactions between the hosts or use
vCenter Server to perform any source or target activities, such as vSphere High Availability (vSphere HA)
trac, migration, cloning, or vMotion, you must congure a connection through which the managed hosts
can receive data.
To congure a connection for receiving data, open ports for trac from services such as vSphere High
Availability, vMotion, and vSphere Fault Tolerance. See “ESXi Firewall Conguration,” on page 173 for a
discussion of conguration les, vSphere Web Client access, and rewall commands. See “Incoming and
Outgoing Firewall Ports for ESXi Hosts,” on page 175 for a list of ports. Refer to the rewall system
administrator for additional information on conguring the ports.
Connecting to the Virtual Machine Console Through a Firewall
Certain ports must be open for user and administrator communication with the virtual machine console.
Which ports must be open depends on the type of virtual machine console, and on whether you connect
through vCenter Server with the vSphere Web Client or directly to the ESXi host from the vSphere Client.
Connecting to a Browser-Based Virtual Machine Console Through the
vSphere Web Client
When you are connecting with the vSphere Web Client, you always connect to the vCenter Server system
that manages the ESXi host, and access the virtual machine console from there.
vSphere Security
230 VMware, Inc.