6.0.3

Enable access to management functionality in a strictly controlled manner by using one of the following
approaches.
n
For especially sensitive environments, congure a controlled gateway or other controlled method to
access the management network. For example, require that administrators connect to the management
network through a VPN, and allow access only to trusted administrators.
n
Congure jump boxes that run management clients.
Isolate Storage Traffic
Ensure that IP-based storage trac is isolated. IP-based storage includes iSCSI and NFS. Virtual machines
might share virtual switches and VLANs with the IP-based storage congurations. This type of
conguration might expose IP-based storage trac to unauthorized virtual machine users.
IP-based storage frequently is not encrypted; anyone with access to this network can view it. To restrict
unauthorized users from viewing the IP-based storage trac, logically separate the IP-based storage
network trac from the production trac. Congure the IP-based storage adapters on separate VLANs or
network segments from the VMkernel management network to limit unauthorized users from viewing the
trac.
Isolate VMotion Traffic
VMotion migration information is transmied in plain text. Anyone with access to the network over which
this information ows can view it. Potential aackers can intercept vMotion trac to obtain the memory
contents of a virtual machine. They might also stage a MiTM aack in which the contents are modied
during migration.
Separate VMotion trac from production trac on an isolated network. Set up the network to be
nonroutable, that is, make sure that no layer-3 router is spanning this and other networks, to prevent outside
access to the network.
The VMotion port group should be in a dedicated VLAN on a common vSwitch. The vSwitch can be shared
with production (virtual machine) trac, as long as the VMotion port group’s VLAN is not used by
production virtual machines.
vSphere Security
246 VMware, Inc.