View Only
  • 1.  required firewall service details

    Posted May 26, 2014 11:51 AM

    Dear Team,

    Following services are selected on ESXi firewall , just want to know which service is safe to stop as we have audit in our environment also want to know the the detail info related to these services


    Mr Vmware

  • 2.  RE: required firewall service details
    Best Answer

    Posted May 26, 2014 12:25 PM

    Well, it all depends upon the environment need your server is placed.

    For ex: if you dont want users to meddle with ssh to the server, then you can stop the SSH,

    NTP is not configured, then you can stop NTP.

    N1KV* does note to Cisco switch. So I wouldnt recommend to stop it, if you are using Cisco N1K

    Do refer to the VMware Security Hardening Guides | United States

    on the required services for ESXi to work and securing them :smileyhappy:

  • 3.  RE: required firewall service details

    Posted May 26, 2014 08:22 PM


    Welcome to communities.

    DHCP client if you are not running DHCP server and NTP client if not using

    Global NTP server for synchronisation.

  • 4.  RE: required firewall service details

    Posted May 27, 2014 04:50 PM

    When you install ESXi 5 the firewall is enabled by default, with it only allowing the essential traffic, and denying the rest. You can manage the firewall using the vSphere client, or from the CLI.

    In the vSphere client the firewall settings can be accessed from the Security Profile section of the Configuration tab:


    By accessing the firewall properties you can see which ports are open and which services are started:


    Clicking the ‘Firewall’ button will allow you to allow connections only from specific IP addresses/ranges:


    Service Automation

    You can choose how to start services by clicking on the services properties:


    Clicking options will allow you to change how the service starts:


    You have the following options for starting services:

    1. Start automatically if any ports are open, and stop when all ports are closed
    2. Start and stop with host
    3. Start and stop manually (Select this to effectively disable the service)

    Working with the Firewall using the GUI is fairly straight forward so, for the rest of this post I’ll focus on interacting with the ESXi firewall using the CLI.

    Using ESXCLI to Configure the ESXi Firewall

    With ESXi 5 the esxcfg-firewall command has been replaced by the esxcli network firewall command/namespace. You can list the current status of the firewall by running:

    esxcli network firewall get


    To enable and disable the firewall service we can use the following commands:

    esxcli network firewall set  –enabled false

    esxcli network firewall set  –enabled true

    To list the current firewall rules you can run:

    esxcli network firewall rulesset list


    We can enable a rule by running

    esxcli network firewall ruleset –enabled true –ruleset-id rulesetName