6.0.3

Use Virtual Switches with the vSphere Network Appliance API Only If
Required
If you are not using products that make use of the vSphere Network Appliance API (DvFilter), do not
congure your host to send network information to a virtual machine. If the vSphere Network Appliance
API is enabled, an aacker might aempt to connect a virtual machine to the lter. This connection might
provide access to the network of other virtual machines on the host.
If you are using a product that makes use of this API, verify that the host is congured correctly. See the
sections on DvFilter in Developing and Deploying vSphere Solutions, vServices, and ESX Agents. If your host is
set up to use the API, make sure that the value of the Net.DVFilterBindIpAddress parameter matches the
product that uses the API.
Procedure
1 To ensure that the Net.DVFilterBindIpAddress kernel parameter has the correct value, locate the
parameter by using the vSphere Web Client.
a Select the host and click the Manage tab.
b Under System, select Advanced System .
c Scroll down to Net.DVFilterBindIpAddress and verify that the parameter has an empty value.
The order of parameters is not strictly alphabetical. Type DVFilter in the Filter eld to display all
related parameters.
2 If you are not using DvFilter seings, make sure that the value is blank.
3 If you are using DvFilter seings, make sure the value of the parameter matches the value that the
product that uses the DvFilter is using.
vSphere Networking Security Best Practices
Following networking security best practices helps ensure the integrity of your vSphere deployment.
General Networking Security Recommendations
Following general network security recommendations is the rst step in securing your networking
environment. You can then move on to special areas, such as securing the network with rewalls or using
IPsec.
n
Ensure that physical switch ports are congured with Portfast if spanning tree is enabled. Because
VMware virtual switches do not support STP, physical switch ports connected to an ESXi host must
have Portfast congured if spanning tree is enabled to avoid loops within the physical switch network.
If Portfast is not set, potential performance and connectivity issues might arise.
n
Ensure that Netow trac for a Distributed Virtual Switch is only being sent to authorized collector IP
addresses. Netow exports are not encrypted and can contain information about the virtual network,
increasing the potential for a successful man-in-the-middle aack. If Netow export is required, verify
that all Netow target IP addresses are correct.
n
Ensure that only authorized administrators have access to virtual networking components by using the
role-based access controls. For example, virtual machine administrators should have access only to port
groups in which their virtual machines reside. Network administrators should have permissions to all
virtual networking components but no access to virtual machines. Limiting access reduces the risk of
misconguration, whether accidental or malicious, and enforces key security concepts of separation of
duties and least privilege.
Chapter 8 Securing vSphere Networking
VMware, Inc. 243