6.5.1

4 Verify that VLAN trunk links are connected only to physical switch ports that function as trunk links.
When connecting a virtual switch to a VLAN trunk port, you must properly configure both the virtual
switch and the physical switch at the uplink port. If the physical switch is not properly configured,
frames with the VLAN 802.1q header are forwarded to a switch that not expecting their arrival.
Adopting Network Isolation Practices
Network isolation practices significantly bolster network security in your vSphere environment.
Isolate the Management Network
The vSphere management network provides access to the vSphere management interface on each
component. Services running on the management interface provide an opportunity for an attacker to gain
privileged access to the systems. Remote attacks are likely to begin with gaining access to this network. If
an attacker gains access to the management network, it provides the staging ground for further intrusion.
Strictly control access to management network by protecting it at the security level of the most secure VM
running on an ESXi host or cluster. No matter how the management network is restricted, administrators
must have access to this network to configure the ESXi hosts and vCenter Server system.
Place the vSphere management port group in a dedicated VLAN on a common standard switch.
Production (VM) traffic can share the standard switch if the vSphere management port group's VLAN is
not used by production VMs.
Check that the network segment is not routed, except to networks where other management-related
entities are found. Routing a network segment might make sense for vSphere Replication. In particular,
make sure that production VM traffic cannot be routed to this network.
Strictly control access to management functionality by using one of the following approaches.
n
For especially sensitive environments, configure a controlled gateway or other controlled method to
access the management network. For example, require that administrators connect to the
management network through a VPN. Allow access to the management network only to trusted
administrators.
n
Configure jump boxes that run management clients.
Isolate Storage Trac
Ensure that IP-based storage traffic is isolated. IP-based storage includes iSCSI and NFS. VMs might
share virtual switches and VLANs with the IP-based storage configurations. This type of configuration
might expose IP-based storage traffic to unauthorized VM users.
IP-based storage frequently is not encrypted. Anyone with access to this network can view IP-based
storage traffic. To restrict unauthorized users from viewing IP-based storage traffic, logically separate the
IP-based storage network traffic from the production traffic. Configure the IP-based storage adapters on
separate VLANs or network segments from the VMkernel management network to limit unauthorized
users from viewing the traffic.
vSphere Security
VMware, Inc. 198