6.5.1

The company enforces isolation among the virtual machine groups by using multiple internal and external
networks and making sure that the virtual switches and physical network adapters for each group are
completely separate from those of other groups.
Because none of the virtual switches straddle virtual machine zones, the system administrator succeeds
in eliminating the risk of packet leakage from one zone to another. A virtual switch, by design, cannot leak
packets directly to another virtual switch. The only way for packets to travel from one virtual switch to
another is under the following circumstances:
n
The virtual switches are connected to the same physical LAN.
n
The virtual switches connect to a common virtual machine, which could be used to transmit packets.
Neither of these conditions occur in the sample configuration. If system administrators want to verify that
no common virtual switch paths exist, they can check for possible shared points of contact by reviewing
the network switch layout in the vSphere Web Client.
To safeguard the virtual machines’ resources, the system administrator lowers the risk of DoS and DDoS
attacks by configuring a resource reservation and a limit for each virtual machine. The system
administrator further protects the ESXi host and virtual machines by installing software firewalls at the
front and back ends of the DMZ, ensuring that the host is behind a physical firewall, and configuring the
networked storage resources so that each has its own virtual switch.
Internet Protocol Security
Internet Protocol Security (IPsec) secures IP communications coming from and arriving at a host. ESXi
hosts support IPsec using IPv6.
When you set up IPsec on a host, you enable authentication and encryption of incoming and outgoing
packets. When and how IP traffic is encrypted depends on how you set up the system's security
associations and security policies.
A security association determines how the system encrypts traffic. When you create a security
association, you specify the source and destination, encryption parameters, and a name for the security
association.
A security policy determines when the system should encrypt traffic. The security policy includes source
and destination information, the protocol and direction of traffic to be encrypted, the mode (transport or
tunnel) and the security association to use.
List Available Security Associations
ESXi can provide a list of all security associations available for use by security policies. The list includes
both user created security associations and any security associations the VMkernel installed using
Internet Key Exchange.
You can get a list of available security associations using the esxcli vSphere CLI command.
Procedure
u
At the command prompt, enter the command esxcli network ip ipsec sa list.
vSphere Security
VMware, Inc. 191