6.0.3

By capitalizing on virtual machine isolation, correctly conguring virtual switches, and maintaining
network separation, the system administrator can house all three virtual machine zones in the same ESXi
host and be condent that there will be no data or resource breaches.
The company enforces isolation among the virtual machine groups by using multiple internal and external
networks and making sure that the virtual switches and physical network adapters for each group are
completely separate from those of other groups.
Because none of the virtual switches straddle virtual machine zones, the system administrator succeeds in
eliminating the risk of packet leakage from one zone to another. A virtual switch, by design, cannot leak
packets directly to another virtual switch. The only way for packets to travel from one virtual switch to
another is under the following circumstances:
n
The virtual switches are connected to the same physical LAN.
n
The virtual switches connect to a common virtual machine, which could be used to transmit packets.
Neither of these conditions occur in the sample conguration. If system administrators want to verify that
no common virtual switch paths exist, they can check for possible shared points of contact by reviewing the
network switch layout in the vSphere Web Client.
To safeguard the virtual machines’ resources, the system administrator lowers the risk of DoS and DDoS
aacks by conguring a resource reservation and a limit for each virtual machine. The system administrator
further protects the ESXi host and virtual machines by installing software rewalls at the front and back
ends of the DMZ, ensuring that the host is behind a physical rewall, and conguring the networked
storage resources so that each has its own virtual switch.
Internet Protocol Security
Internet Protocol Security (IPsec) secures IP communications coming from and arriving at a host. ESXi hosts
support IPsec using IPv6.
When you set up IPsec on a host, you enable authentication and encryption of incoming and outgoing
packets. When and how IP trac is encrypted depends on how you set up the system's security associations
and security policies.
A security association determines how the system encrypts trac. When you create a security association,
you specify the source and destination, encryption parameters, and a name for the security association.
A security policy determines when the system should encrypt trac. The security policy includes source
and destination information, the protocol and direction of trac to be encrypted, the mode (transport or
tunnel) and the security association to use.
List Available Security Associations
ESXi can provide a list of all security associations available for use by security policies. The list includes both
user created security associations and any security associations the VMkernel installed using Internet Key
Exchange.
You can get a list of available security associations using the esxcli vSphere CLI command.
Procedure
u
At the command prompt, enter the command esxcli network ip ipsec sa list.
ESXi displays a list of all available security associations.
Add an IPsec Security Association
Add a security association to specify encryption parameters for associated IP trac.
You can add a security association using the esxcli vSphere CLI command.
Chapter 8 Securing vSphere Networking
VMware, Inc. 239