6.5.1

Use templates and
scripted management
VM templates enable you to set up the operating system so that it meets
your requirements, and to create other VMs with the same settings.
If you want to change VM settings after initial deployment, consider using
scripts, for example, PowerCLI. This documentation explains how to
perform tasks using the GUI. Consider using scripts instead of the GUI to
keep your environment consistent. In large environments, you can group
VMs into folders to optimize scripting.
For information on templates, see Use Templates to Deploy Virtual
Machines and the vSphere Virtual Machine Administration. For information
on PowerCLI, see the VMware PowerCLI documentation.
Minimize use of the
virtual machine console
The virtual machine console provides the same function for a VM that a
monitor on a physical server provides. Users with access to a virtual
machine console have access to VM power management and to removable
device connectivity controls. As a result, virtual machine console access
might allow a malicious attack on a VM.
Consider UEFI secure
boot
Starting with vSphere 6.5, you can configure your VM to use UEFI boot. If
the operating system supports secure UEFI boot, you can select that option
for your VMs for additional security. See Enable or Disable UEFI Secure
Boot for a Virtual Machine.
Securing the Virtual Networking Layer
The virtual networking layer includes virtual network adapters, virtual switches, distributed virtual
switches, and ports and port groups. ESXi relies on the virtual networking layer to support
communications between VMs and their users. In addition, ESXi uses the virtual networking layer to
communicate with iSCSI SANs, NAS storage, and so on.
vSphere includes the full array of features necessary for a secure networking infrastructure. You can
secure each element of the infrastructure, such as virtual switches, distributed virtual switches, and virtual
network adapters, separately. In addition, consider the following guidelines, discussed in more detail in
Chapter 8 Securing vSphere Networking.
Isolate network traffic Isolation of network traffic is essential to a secure ESXi environment.
Different networks require different access and level of isolation. A
management network isolates client traffic, command-line interface (CLI) or
API traffic, and third-party software traffic from normal traffic. Ensure that
the management network is accessible only by system, network, and
security administrators.
vSphere Security
VMware, Inc. 14