6.5.1

ESXi Networking Security Recommendations
Isolation of network traffic is essential to a secure ESXi environment. Different networks require different
access and level of isolation.
Your ESXi host uses several networks. Use appropriate security measures for each network, and isolate
traffic for specific applications and functions. For example, ensure that VMware vSphere vMotion
®
traffic
does not travel over networks where virtual machines are located. Isolation prevents snooping. Having
separate networks is also recommended for performance reasons.
n
vSphere infrastructure networks are used for features such as vSphere vMotion, VMware vSphere
Fault Tolerance, and storage. Isolate these networks for their specific functions. It is often not
necessary to route these networks outside a single physical server rack.
n
A management network isolates client traffic, command-line interface (CLI) or API traffic, and third-
party software traffic from other traffic. This network should be accessible only by system, network,
and security administrators. Use jump box or virtual private network (VPN) to secure access to the
management network. Strictly control access within this network.
n
Virtual machine traffic can flow over one or many networks. You can enhance the isolation of virtual
machines by using virtual firewall solutions that set firewall rules at the virtual network controller.
These settings travel with a virtual machine as it migrates from host to host within your vSphere
environment.
Modifying ESXi Web Proxy Settings
When you modify Web proxy settings, you have several encryption and user security guidelines to
consider.
Note Restart the host process after making any changes to host directories or authentication
mechanisms.
n
Do not set up certificates that use a password or pass phrases. ESXi does not support Web proxies
that use passwords or pass phrases, also known as encrypted keys. If you set up a Web proxy that
requires a password or pass phrase, ESXi processes cannot start correctly.
n
To support encryption for user names, passwords, and packets, SSL is enabled by default for
vSphere Web Services SDK connections. If you want to configure these connections so that they do
not encrypt transmissions, disable SSL for your vSphere Web Services SDK connection by switching
the connection from HTTPS to HTTP.
Consider disabling SSL only if you created a fully trusted environment for these clients, where
firewalls are in place and transmissions to and from the host are fully isolated. Disabling SSL can
improve performance, because you avoid the overhead required to perform encryption.
vSphere Security
VMware, Inc. 51