6.7

Protecting the vCenter Server Windows Host
Protect the Windows host where vCenter Server is running against vulnerabilities and attacks by ensuring
that the host environment is as secure as possible.
n
Maintain a supported operating system, database, and hardware for the vCenter Server system. If
vCenter Server is not running on a supported operating system, it might not run properly, making
vCenter Server vulnerable to attacks.
n
Keep the vCenter Server system properly patched. By staying up-to-date with operating system
patches, the server is less vulnerable to attack.
n
Provide operating system protection on the vCenter Server host. Protection includes antivirus and
anti-malware software.
n
On each Windows computer in the infrastructure, ensure that Remote Desktop (RDP) Host
Configuration settings are set to ensure the highest level of encryption according to industry-standard
guidelines or internal guidelines.
For operating system and database compatibility information, see the vSphere Compatibility Matrixes.
Limiting vCenter Server Network Connectivity
For improved security, avoid putting the vCenter Server system on any network other than a management
network, and ensure that vSphere management traffic is on a restricted network. By limiting network
connectivity, you limit certain types of attack.
vCenter Server requires access to a management network only. Avoid putting the vCenter Server system
on other networks such as your production network or storage network, or on any network with access to
the Internet. vCenter Server does not need access to the network where vMotion operates.
vCenter Server requires network connectivity to the following systems.
n
All ESXi hosts.
n
The vCenter Server database.
n
Other vCenter Server systems (if the vCenter Server systems are part of a common vCenter Single
Sign-On domain for purposes of replicating tags, permissions, and so on).
n
Systems that are authorized to run management clients. For example, the vSphere Web Client, a
Windows system where you use the PowerCLI, or any other SDK-based client.
n
Systems that run add-on components such as VMware vSphere Update Manager.
n
Infrastructure services such as DNS, Active Directory, and NTP.
n
Other systems that run components that are essential to functionality of the vCenter Server system.
Use a local firewall on the Windows system where the vCenter Server system is running or use a network
firewall. Include IP-based access restrictions so that only necessary components can communicate with
the vCenter Server system.
vSphere Security
VMware, Inc. 113