6.7

See ESXi Networking Security Recommendations.
Use firewalls to secure
virtual network
elements
You can open and close firewall ports and secure each element in the
virtual network separately. For ESXi hosts, firewall rules associate services
with corresponding firewalls and can open and close the firewall according
to the status of the service. See ESXi Firewall Configuration.
You can also open ports on Platform Services Controller and
vCenter Server instances explicitly. See Required Ports for vCenter Server
and Platform Services Controller and Additional vCenter Server TCP and
UDP Ports.
Consider network
security policies
Network security policies provide protection of traffic against MAC address
impersonation and unwanted port scanning. The security policy of a
standard or distributed switch is implemented in Layer 2 (Data Link Layer)
of the network protocol stack. The three elements of the security policy are
promiscuous mode, MAC address changes, and forged transmits.
See the vSphere Networking documentation for instructions.
Secure VM networking The methods that you use to secure VM networking depend on several
factors, including:
n
The guest operating system that is installed.
n
Whether the VMs operate in a trusted environment
Virtual switches and distributed virtual switches provide significant
protection when used with other common security practices, such as
installing firewalls.
See Chapter 10 Securing vSphere Networking.
Consider VLANs to
protect your
environment
ESXi supports IEEE 802.1q VLANs. VLANs let you segment a physical
network. You can use VLANs to further protect the VM network or storage
configuration. When you use VLANS, two VMs on the same physical
network cannot send packets to or receive packets from each other unless
they are on the same VLAN.
See Securing Virtual Machines with VLANs.
Secure connections to
virtualized storage
A VM stores operating system files, program files, and other data on a
virtual disk. Each virtual disk appears to the VM as a SCSI drive that is
connected to a SCSI controller. A VM is isolated from storage details and
cannot access the information about the LUN where its virtual disk resides.
The Virtual Machine File System (VMFS) is a distributed file system and
volume manager that presents virtual volumes to the ESXi host. You are
responsible for securing the connection to storage. For example, if you are
using iSCSI storage, you can set up your environment to use CHAP. If
required by company policy, you can set up mutual CHAP. Use
vSphere Web Client or CLIs to set up CHAP.
vSphere Security
VMware, Inc. 14