6.5.1

5 Label all vSphere Distributed Switches.
vSphere Distributed Switches associated with an ESXi host require a text box for the name of the
switch. This label serves as a functional descriptor for the switch, just like the host name associated
with a physical switch. The label on the vSphere Distributed Switch indicates the function or the IP
subnet of the switch. For example, you can label the switch as internal to indicate that it is only for
internal networking on a virtual machine’s private virtual switch. No traffic goes over physical network
adapters.
6 Disable network health check for your vSphere Distributed Switches if you are not actively using it.
Network health check is disabled by default. Once enabled, the health check packets contain
information about the host, switch, and port that an attacker can potentially use. Use network health
check only for troubleshooting, and turn it off when troubleshooting is finished.
7 Protect virtual traffic against impersonation and interception Layer 2 attacks by configuring a security
policy on port groups or ports.
The security policy on distributed port groups and ports includes the following options:
n
MAC address changes (see MAC Address Changes)
n
Promiscuous mode (see Promiscuous Mode Operation)
n
Forged transmits (see Forged Transmits)
You can view and change the current settings by selecting Manage Distributed Port Groups from
the right-button menu of the distributed switch and selecting Security in the wizard. See the vSphere
Networking documentation.
Securing Virtual Machines with VLANs
The network can be one of the most vulnerable parts of any system. Your virtual machine network
requires as much protection as your physical network. Using VLANs can improve networking security in
your environment.
VLANs are an IEEE standard networking scheme with specific tagging methods that allow routing of
packets to only those ports that are part of the VLAN. When properly configured, VLANs provide a
dependable means for you to protect a set of virtual machines from accidental or malicious intrusions.
VLANs let you segment a physical network so that two machines in the network are unable to transmit
packets back and forth unless they are part of the same VLAN. For example, accounting records and
transactions are among a company’s most sensitive internal information. In a company whose sales,
shipping, and accounting employees all use virtual machines in the same physical network, you might
protect the virtual machines for the accounting department by setting up VLANs.
vSphere Security
VMware, Inc. 186