一些怎样be behind the firewall, depending on your deployment. The main point is to ensure that a firewall is present at what you consider to be an entry point for the system.
For a comprehensive list of TCP and UDP ports, including those for vSphere vMotion? and vSphere Fault Tolerance, see “TCP and UDP Ports for Management Access,” on page 23.
Networks configured with vCenter Server can receive communications through the vSphere Client or third-party network management clients that use the SDK to interface with the host. During normal operation,
vCenter Server listens for data from its managed hosts and clients on designated ports. vCenter Server also assumes that its managed hosts listen for data from vCenter Server on designated ports. If a firewall is present between any of these elements, you must ensure that the firewall has open ports to support data transfer.
You might also include firewalls at a variety of other access points in the network, depending on how you plan to use the network and the level of security various devices require. Select the locations for your firewalls based on the security risks that you have identified for your network configuration. The following is a list of firewall locations common to ESXi implementations.
n Between the vSphere Client or a third-party network-management client and vCenter Server.
n If your users access virtual machines through a Web browser, between the Web browser and the ESXi host.
n If your users access virtual machines through the vSphere Client, between the vSphere Client and the ESXi host. This connection is in addition to the connection between the vSphere Client and vCenter Server,
and it requires a different port.
n Between vCenter Server and the ESXi hosts.
n Between the ESXi hosts in your network. Although traffic between hosts is usually considered trusted, you can add firewalls between them if you are concerned about security breaches from machine to
machine.
If you add firewalls between ESXi hosts and plan to migrate virtual machines between the servers, perform
cloning, or use vMotion, you must also open ports in any firewall that pides the source host from the
target hosts so that the source and targets can communicate.
n Between the ESXi hosts and network storage such as NFS or iSCSI storage. These ports are not specific to VMware, and you configure them according to the specifications for your network.
20 VMware, Inc.
Chapter 2 Securing ESXi Configurations
Firewalls for Configurations Without vCenter Server
If you connect clients directly to your ESXi network instead of using vCenter Server, your firewall configuration is somewhat simpler.
Networks configured without vCenter Server receive communications through the same types of clients as they do if vCenter Server were present: the vSphere Client or third-party network management clients. For the most part, the firewall needs are the same, but there are several key differences.
n As you would for configurations that include vCenter Server, be sure a firewall is present to protect your ESXi layer or, depending on your configuration, your clients and ESXi layer. This firewall provides basic
protection for your network. The firewall ports you use are the same as those you use if vCenter Server is
in place.
n Licensing in this type of configuration is part of the ESXi package that you install on each of the hosts.
Because licensing is resident to the server, a separate license server is not required. This eliminates the
need for a firewall between the license server and the ESXi network.
Connecting to vCenter Server Through a Firewall
The port that vCenter Server uses to listen for data transfer from its clients is 443. If you have a firewall between vCenter Server and its clients, you must configure a connection through which vCenter Server can receive data from the clients.
To enable vCenter Server to receive data from the vSphere Client, open port 443 in the firewall to allow data transfer from the vSphere Client to vCenter Server. Contact the firewall system administrator for additional information on configuring ports in a firewall.
If you are using the vSphere Client and do not want to use port 443 as the port for vSphere Client-to-vCenter Server communication, you can switch to another port by changing the vCenter Server settings in the vSphere Client. To learn how to change these settings, see the vCenter Server and Host Management documentation.
Connecting to the Virtual Machine Console Through a Firewall
When you connect your client to ESXi hosts through vCenter Server, certain ports are required for user and administrator communication with virtual machine consoles. These ports support different client functions, interface with different layers on ESXi, and use different authentication protocols.
Port 902This is the port that vCenter Server assumes is available for receiving data from
ESXi. The vSphere Client uses this port to provide a connection for guest
operating system mouse, keyboard, screen (MKS) activities on virtual
machines. It is through this port that users interact with the virtual machine
guest operating systems and applications. Port 902 is the port that the vSphere
Client assumes is available when interacting with virtual machines.
VMware, Inc. 21
