Question on modifying vCenter firewall (VAMI)

[jeffj2000]

I use vCenter firewalls extensively, but I use /24 cidr for our management vlans for access. For instance if you ESXi servers are on 10.0.0.1/24 I would put that in vCenter VAMI. Now I want to restrict it down to the exact hosts. 

My question is this. Will there be any interruption of service or host disconnections if I do this:

1. Add all the hosts in the cluster to the VAMI firewall.
2. Save the firewall
3. Remove the /24 cidr
4. Save the firewall

Would any of the hypervisors disconnect?

[Andrea Consalvi]

No, provided there is never a moment where the ESXi host IPs are no longer allowed.

If you first add explicit ALLOW rules for every ESXi management IP (or the required /32 addresses), save the configuration, verify the rules are in place, and only then remove the broader /24 rule, the hosts should continue communicating with vCenter without disconnecting. The firewall is evaluated based on the active rule set, so as long as each host still matches an allow rule, connectivity is maintained.

The only situation that would cause hosts to disconnect is if you accidentally leave an ESXi management IP uncovered, or if the rule order causes a reject rule to be evaluated before the corresponding allow rule. Rule ordering is critical, especially when using explicit reject entries.

Before making the change, I'd still recommend taking an offline snapshot or ensuring you have a rollback plan, particularly if the vCenter is production, since an incorrect firewall rule can lock you out of the appliance itself.