一些怎样receive data from outside sources. For example, the company uses External
Network 1 to receive FTP traffic from vendors and allow vendors access to data
stored on externally available servers though FTP. In addition to servicing
Virtual Machine 1, External Network 1 services FTP servers configured on
different ESXi hosts throughout the site.
16 VMware, Inc.
Chapter 1 Security for ESXi Systems
Because Virtual Machine 1 does not share a virtual switch or physical network
adapter with any virtual machines in the host, the other resident virtual
machines cannot transmit packets to or receive packets from the Virtual
Machine 1 network. This restriction prevents sniffing attacks, which require
sending network traffic to the victim. More importantly, an attacker cannot use
the natural vulnerability of FTP to access any of the host’s other virtual
machines.
Internal virtual machines Virtual Machines 2 through 5 are reserved for internal use. These virtual
machines process and store company-private data such as medical records,
legal settlements, and fraud investigations. As a result, the system
administrators must ensure the highest level of protection for these virtual
machines.
These virtual machines connect to Internal Network 2 through their own virtual
switch and network adapter. Internal Network 2 is reserved for internal use by
personnel such as claims processors, in-house lawyers, or adjustors.
Virtual Machines 2 through 5 can communicate with one another through the
virtual switch and with internal virtual machines elsewhere on Internal
Network 2 through the physical network adapter. They cannot communicate
with externally facing machines. As with the FTP server, these virtual machines
cannot send packets to or receive packets from the other virtual machines’
networks. Similarly, the host’s other virtual machines cannot send packets to
or receive packets from Virtual Machines 2 through 5.
DMZ Virtual Machines 6 through 8 are configured as a DMZ that the marketing
group uses to publish the company’s external Web site.
This group of virtual machines is associated with External Network 2 and
Internal Network 1. The company uses External Network 2 to support the Web
servers that use the marketing and financial department to host the corporate
Web site and other Web facilities that it hosts to outside users. Internal Network
1 is the conduit that the marketing department uses to publish content to the
corporate Web site, post downloads, and maintain services like user forums.
Because these networks are separate from External Network 1 and Internal
Network 2, and the virtual machines have no shared points of contact (switches
or adapters), there is no risk of attack to or from the FTP server or the internal
virtual machine group.
By capitalizing on virtual machine isolation, correctly configuring virtual switches, and maintaining network separation, the system administrator can house all three virtual machine zones in the same ESXi host and be confident that there will be no data or resource breaches.
The company enforces isolation among the virtual machine groups by using multiple internal and external networks and making sure that the virtual switches and physical network adapters for each group are
completely separate from those of other groups.
Because none of the virtual switches straddle virtual machine zones, the system administrator succeeds in
eliminating the risk of packet leakage from one zone to another. A virtual switch, by design, cannot leak packets directly to another virtual switch. The only way for packets to travel from one virtual switch to another is under the following circumstances:
n The virtual switches are connected to the same physical LAN.
n The virtual switches connect to a common virtual machine, which could be used to transmit packets.
Neither of these conditions occur in the sample configuration. If system administrators want to verify that no common virtual switch paths exist, they can check for possible shared points of contact by reviewing the
network switch layout in the vSphere Client.
VMware, Inc. 17
To safeguard the virtual machines’ resources, the system administrator lowers the risk of DoS and DDoS attacks by configuring a resource reservation and a limit for each virtual machine. The system administrator further protects the ESXi host and virtual machines by installing software firewalls at the front and back ends of the DMZ, ensuring that the host is behind a physical firewall, and configuring the networked storage resources so that each has its own virtual switch.
Security Resources and Information
You can find additional information about security on the VMware Web site.
The table lists security topics and the location of additional information about these topics.
Table 1-1. VMware Security Resources on the Web
Topic Resource
VMware security policy, up-to-date security
alerts, security downloads, and focus
discussions of security topics
b54cec67b84ae45c3b358c66/security/
Corporate security response policy b54cec67b84ae45c3b358c66/support/policies/security_response
VMware is committed to helping you maintain a secure environment.
Security issues are corrected in a timely manner. The VMware Security
Response Policy states our commitment to resolve possible
vulnerabilities in our products.
Third-party software support policy b54cec67b84ae45c3b358c66/support/policies/
VMware supports a variety of storage systems, software agents such as
backup agents, system management agents, and so forth. You can find
lists of agents, tools, and other software that supports ESXi by searching
b54cec67b84ae45c3b358c66/vmtn/resources/ for ESXi compatibility
guides.
The industry offers more products and configurations than VMware can
test. If VMware does not list a product or configuration in a compatibility
guide, Technical Support will attempt to help you with any problems,
but cannot guarantee that the product or configuration can be used.
Always evaluate security risks for unsupported products or
configurations carefully.
General information about virtualization and security VMware Virtual Security Technical Resource Center b54cec67b84ae45c3b358c66/go/security/
Compliance and security standards, as well as
partner solutions and in-depth content about
virtualization and compliance
b54cec67b84ae45c3b358c66/go/compliance/
Information about VMsafe technology for protection of virtual machines, including a list of partner solutions b54cec67b84ae45c3b358c66/go/vmsafe/
vSphere Security
18 VMware, Inc.
Securing ESXi Configurations2 You can take measures to promote a secure environment for your ESXi hosts, virtual machines, and iSCSI
SANs. Consider network configuration planning from a security perspective and the steps that you can take to protect the components in your configuration from attack.
This chapter includes the following topics:
n“Securing the Network with Firewalls,” on page 19
n“Securing Virtual Machines with VLANs,” on page 24
n“Securing Standard Switch Ports,” on page 29
n“Internet Protocol Security,” on page 30
n“Securing iSCSI Storage,” on page 34
n“Cipher Strength,” on page 36
n“Control CIM-Based Hardware Monitoring Tool Access,” on page 36
Securing the Network with Firewalls
Security administrators use firewalls to safeguard the network or selected components in the network from intrusion.
Firewalls control access to devices within their perimeter by closing all communication pathways, except for those that the administrator explicitly or implicitly designates as authorized. The pathways, or ports, that
administrators open in the firewall allow traffic between devices on different sides of the firewall.
I MPORTANT The ESXi firewall in ESXi 5.0 does not allow per-network filtering of vMotion traffic. Therefore,
you must install rules on your external firewall to ensure that no incoming connections can be made to the vMotion socket.
In a virtual machine environment, you can plan your layout for firewalls between components.
n Physical machines such as vCenter Server systems and ESXi hosts.
n One virtual machine and another—for example, between a virtual machine acting as an external Web server and a virtual machine connected to your company’s internal network.
n A physical machine and a virtual machine, such as when you place a firewall between a physical network adapter card and a virtual machine.
VMware, Inc. 19
vSphere Security
How you use firewalls in your ESXi configuration is based on how you plan to use the network and how secure any given component needs to be. For example, if you create a virtual network where each virtual machine is dedicated to running a different benchmark test suite for the same department, the risk of unwanted access from one virtual machine to the next is minimal. Therefore, a configuration where firewalls are present between the virtual machines is not necessary. However, to prevent interruption of a test run from an outside host, you might set up the configuration so that a firewall is present at the entry point of the virtual network to protect the entire set of virtual machines.
Firewalls for Configurations with vCenter Server
If you access ESXi hosts through vCenter Server, you typically protect vCenter Server using a firewall. This firewall provides basic protection for your network.
A firewall might lie between the clients and vCenter Server. Alternatively, vCenter Server and the clients can
