6.5.1

Securing the Network With Firewalls
Security administrators use firewalls to safeguard the network or selected components in the network
from intrusion.
Firewalls control access to devices within their perimeter by closing all ports except for ports that the
administrator explicitly or implicitly designates as authorized. The ports that administrators open allow
traffic between devices on different sides of the firewall.
Important The ESXi firewall in ESXi 5.5 and later does not allow per-network filtering of vMotion traffic.
Therefore, you must install rules on your external firewall to ensure that no incoming connections can be
made to the vMotion socket.
In a virtual machine environment, you can plan the layout for firewalls between components.
n
Firewalls between physical machines such as vCenter Server systems and ESXi hosts.
n
Firewalls between one virtual machine and another, for example, between a virtual machine acting as
an external Web server and a virtual machine connected to your company’s internal network.
n
Firewalls between a physical machine and a virtual machine, such as when you place a firewall
between a physical network adapter card and a virtual machine.
How you use firewalls in your ESXi configuration is based on how you plan to use the network and how
secure any given component has to be. For example, if you create a virtual network where each virtual
machine is dedicated to running a different benchmark test suite for the same department, the risk of
unwanted access from one virtual machine to the next is minimal. Therefore, a configuration where
firewalls are present between the virtual machines is not necessary. However, to prevent interruption of a
test run from an outside host, you can configure a firewall at the entry point of the virtual network to
protect the entire set of virtual machines.
For a diagram of firewall ports, see VMware Knowledge Base article 2131180.
Firewalls for Configurations With vCenter Server
If you access ESXi hosts through vCenter Server, you typically protect vCenter Server using a firewall.
Firewalls must be present at entry points. A firewall might lie between the clients and vCenter Server or
vCenter Server and the clients can both be behind a firewall.
For a comprehensive list of TCP and UDP ports, see Required Ports for vCenter Server and Platform
Services Controller and Additional vCenter Server TCP and UDP Ports.
Networks configured with vCenter Server can receive communications through the vSphere Web Client,
other UI clients, or clients that use the vSphere API. During normal operation, vCenter Server listens for
data from its managed hosts and clients on designated ports. vCenter Server also assumes that its
managed hosts listen for data from vCenter Server on designated ports. If a firewall is present between
any of these elements, you must ensure that the firewall has open ports to support data transfer.
vSphere Security
VMware, Inc. 177