6.0.3

Document and Check the vSphere VLAN Environment
Check your VLAN environment regularly to avoid addressing problems. Fully document the VLAN
environment and ensure that VLAN IDs are used only once. Your documentation can help with
troubleshooting and is essential when you want to expand the environment.
Procedure
1 Ensure that all vSwitch and VLANS IDs are fully documented
If you are using VLAN tagging on a virtual switch, the IDs must correspond to the IDs on external
VLAN-aware upstream switches. If VLAN IDs are not tracked completely, mistaken reuse of IDs might
allow for trac between the wrong physical and virtual machines. Similarly, if VLAN IDs are wrong or
missing, trac between physical and virtual machines might be blocked where you want trac to pass.
2 Ensure that VLAN IDs for all distributed virtual port groups (dvPortgroup instances) are fully
documented
If you are using VLAN tagging on a dvPortgroup the IDs must correspond to the IDs on external
VLAN-aware upstream switches. If VLAN IDs are not tracked completely, mistaken reuse of IDs might
allow for trac between the wrong physical and virtual machines. Similarly, if VLAN IDs are wrong or
missing, trac between physical and virtual machines might be blocked where you want trac to pass.
3 Ensure that private VLAN IDs for all distributed virtual switches are fully documented
Private VLANs (PVLANs) for distributed virtual switches require primary and secondary VLAN IDs.
These IDs must correspond to the IDs on external PVLAN-aware upstream switches. If VLAN IDs are
not tracked completely, mistaken reuse of IDs might allow for trac between the wrong physical and
virtual machines. Similarly, if PVLAN IDs are wrong or missing, trac between physical and virtual
machines might be blocked where you want trac to pass.
4 Verify that VLAN trunk links are connected only to physical switch ports that function as trunk links.
When connecting a virtual switch to a VLAN trunk port, you must properly congure both the virtual
switch and the physical switch at the uplink port. If the physical switch is not properly congured,
frames with the VLAN 802.1q header are forwarded to a switch that not expecting their arrival.
Adopting Sound Network Isolation Practices
Adapting sound network isolation practices signicantly bolsters network security in your vSphere
environment.
Isolate the Management Network
The vSphere management network provides access to the vSphere management interface on each
component. Services running on the management interface provide an opportunity for an aacker to gain
privileged access to the systems. Remote aacks are likely to begin with gaining access to this network. If an
aacker gains access to the management network, it provides the staging ground for further intrusion.
Strictly control access to management network by protecting it at the security level of the most secure virtual
machine running on an ESXi host or cluster. No maer how the management network is restricted,
administrators must have access to this network to congure the ESXi hosts and vCenter Server system.
Place the vSphere management port group in a dedicated VLAN on a common vSwitch. The vSwitch can be
shared with production (virtual machine) trac, as long as the vSphere management port group's VLAN is
not used by production virtual machines. Check that the network segment is not routed, except possibly to
networks where other management-related entities are found, for example, in conjunction with vSphere
Replication. In particular, make sure that production virtual machine trac cannot be routed to this
network.
Chapter 8 Securing vSphere Networking
VMware, Inc. 245