Knowledge

• Identify esxcli firewall configuration commands
  
• Explain the three firewall security levels

Skills and Abilities

• Enable/Disable pre-configured services
  
• Configure service behavior automation
  
• Open/Close ports in the firewall
  
• Create a custom service
  
• Set firewall security level

Enable/Disable pre-configured services

Official Documentation:

vSphere Security Guide, Chapter 3 “Securing the Management Interface”, section “Automating Service Behavior Based on Firewall Settings”, page 37.

ESXi can automate whether services start based on the status of firewall ports.
Automation helps ensure that services start if the environment is configured to enable their function. For example, starting a network service only if some ports are open can help avoid the situation where services are started, but are unable to complete the communications required to complete their intended purpose.

In addition, having accurate information about the current time is a requirement for some protocols, such as Kerberos. The NTP service is a way of getting accurate time information, but this service only works when required ports are opened in the firewall. The service cannot achieve its goal if all ports are closed. The NTP services provide an option to configure the conditions when the service starts or stops. This configuration includes options that account for whether firewall ports are opened, and then start or stop the NTP service based on those conditions. Several possible configuration options exist, all of which are also applicable to the SSH server.

NOTE The settings described in this section only apply to service settings configured through the vSphere Client or applications created with the vSphere Web services SDK. Configurations made through other means, such as the ESXi Shell or configuration files in /etc/init.d/, are not affected by these settings.

• Start automatically if any ports are open, and stop when all ports are closed: The default setting for these services that VMware recommends. If any port is open, the client attempts to contact the network resources pertinent to the service in question. If some ports are open, but the port for a particular service is closed, the attempt fails, but there is little drawback to such a case. If and when the applicable outgoing port is opened, the service begins completing its tasks.
  
• Start and stop with host: The service starts shortly after the host starts and closes shortly before the host shuts down. Much like Start automatically if any ports are open, and stop when all ports are closed, this option means that the service regularly attempts to complete its tasks, such as contacting the specified NTP server. If the port was closed but is subsequently opened, the client begins completing its tasks shortly thereafter.
  
• Start and stop manually: The host preserves the user-determined service settings, regardless of whether ports are open or not. When a user starts the NTP service, that service is kept running as long as the host is powered on. If the service is started and the host is powered off, the service is stopped as part of the shutdown process, but as soon as the host is powered on, the service is started again, preserving the userdetermined state.
  

NOTE ESXi firewall automates when rule sets are enabled or disabled based on the service startup policy.
When a service starts, its corresponding rule set is enabled. When a service stops, the rule set is disabled.

Set Service or Client Startup Options
By default, daemon processes start when any of their ports are opened and stop when all of their ports are closed. You can change this startup policy for the selected service or client.

Procedure 

1. Log in to a vCenter Server system using the vSphere Client.
   
2. Select the host in the inventory panel.
   
3. Click the Configuration tab and click Security Profile.
   
4. In the Firewall section, click Properties.
   The Firewall Properties dialog box lists all the services and management agents you can configure for the host.
   
5. Select the service or management agent to configure and click Options.
   The Startup Policy dialog box determines when the service starts. This dialog box also provides information about the current state of the service and provides an interface for manually starting, stopping, or restarting the service.
   
6. Select a policy from the Startup Policy list.
   
7. Click OK.
   

Configure service behavior automation 

Official Documentation:

vSphere Security Guide, Chapter 3 “Securing the Management Interface”, section “Automating Service Behavior Based on Firewall Settings”, page 37.

See previous objective.
Open/Close ports in the firewall

Official Documentation:

vSphere Security Guide, Chapter 3 “Securing the Management Interface”, page 34.

ESXi includes a firewall between the management interface and the network. The firewall is enabled by default.
At installation time, the ESXi firewall is configured to block incoming and outgoing traffic, except traffic for the default services listed in “TCP and UDP Ports for Management Access,” on page 19 or table below.

NOTE The firewall also allows Internet Control Message Protocol (ICMP) pings and communication with DHCP and DNS (UDP only) clients.

Supported services and management agents that are required to operate the host are described in a rule set configuration file in the ESXi firewall directory /etc/vmware/firewall/. The file contains firewall rules and lists each rule’s relationship with ports and protocols.

You cannot add a rule to the ESXi firewall unless you create and install a VIB that contains the rule set configuration file. The VIB authoring tool is available to VMware partners.

NOTE The behavior of the NFS Client rule set (nfsClient) is different from other rule sets. When the NFS Client rule set is enabled, all outbound TCP ports are open for the destination hosts in the list of allowed IP addresses. See “NFS Client Rule Set Behavior,” on page 36 for more information.

TCP and UDP Ports for Management Access
vCenter Server, ESXi hosts, and other network components are accessed using predetermined TCP and UDP ports. If you manage network components from outside a firewall, you might be required to reconfigure the firewall to allow access on the appropriate ports.

The table lists TCP and UDP ports, and the purpose and the type of each. Ports that are open by default at installation time are indicated by (Default).

Table. TCP and UDP Ports 

Create a custom service

Official Documentation:

vSphere Security Guide, Chapter 3 “Securing the Management Interface”, section “Rule Set Configuration Files”, page 34.

A rule set configuration file contains firewall rules and describes each rule’s relationship with ports and protocols. The rule set configuration file can contain rule sets for multiple services.
Rule set configuration files are located in the /etc/vmware/firewall/ directory. To add a service to the host security profile, VMware partners can create a VIB that contains the port rules for the service in a configuration file. VIB authoring tools are available to VMware partners only.
Each set of rules for a service in the rule set configuration file contains the following information. 

• A numeric identifier for the service, if the configuration file contains more than one service.
  
• A unique identifier for the rule set, usually the name of the service.
  
• For each rule, the file contains one or more port rules, each with a definition for direction, protocol, port type, and port number or range of port numbers.
  
• An indication of whether the service is enabled or disabled when the rule set is applied.
  
• An indication of whether the rule set is required and cannot be disabled.
  

Other exam notes

• The Saffageek VCAP5-DCA Objectives http://thesaffageek.co.uk/vcap5-dca-objectives/
  
• Paul Grevink The VCAP5-DCA diaries http://paulgrevink.wordpress.com/the-vcap5-dca-diaries/
  
• Edward Grigson VCAP5-DCA notes http://www.vexperienced.co.uk/vcap5-dca/
  
• Jason Langer VCAP5-DCA notes http://www.virtuallanger.com/vcap-dca-5/
  
• The Foglite VCAP5-DCA notes http://thefoglite.com/vcap-dca5-objective/
  

VMware vSphere official documentation

Disclaimer.
The information in this article is provided “AS IS” with no warranties, and confers no rights. This article does not represent the thoughts, intentions, plans or strategies of my employer. It is solely my opinion.