ESXi Configuration Guide
ESXi 4.0
vCenter Server 4.0
This document supports the version of each product listed and
supports all subsequent versions until the document is replaced
by a new edition. To check for more recent editions of this
document, see http://www.vmware.com/support/pubs.
EN-000114-04
ESXi Configuration Guide
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
docfeedback@vmware.com
Copyright © 2009–2011 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and
intellectual property laws. VMware products are covered by one or more patents listed at
http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks
and names mentioned herein may be trademarks of their respective companies.
VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2
VMware, Inc.
Contents
Updated Information 7
About This Book 9
1 Introduction to ESXi Configuration 11
Networking
2 Introduction to Networking 15
Networking Concepts Overview 15
Network Services 16
View Networking Information in the vSphere Client 16
View Network Adapter Information in the vSphere Client
17
3 Basic Networking with vNetwork Standard Switches 19
vNetwork Standard Switches 19
Port Groups 20
Port Group Configuration for Virtual Machines
VMkernel Networking Configuration 21
vNetwork Standard Switch Properties 23
20
4 Basic Networking with vNetwork Distributed Switches 27
vNetwork Distributed Switch Architecture 27
Configuring a vNetwork Distributed Switch 28
dvPort Groups 30
Private VLANs 32
Configuring vNetwork Distributed Switch Network Adapters 33
Configuring Virtual Machine Networking on a vNetwork Distributed Switch
37
5 Advanced Networking 39
Internet Protocol Version 6 39
Networking Policies 40
Change the DNS and Routing Configuration 55
MAC Addresses 55
TCP Segmentation Offload and Jumbo Frames 57
NetQueue and Networking Performance 59
VMDirectPath Gen I 60
6 Networking Best Practices, Scenarios, and Troubleshooting 61
Networking Best Practices
VMware, Inc.
61
3
ESXi Configuration Guide
Mounting NFS Volumes 62
Troubleshooting 62
Storage
7 Introduction to Storage 65
About ESXi Storage 65
Types of Physical Storage 66
Supported Storage Adapters 67
Target and Device Representations 67
About ESXi Datastores 70
Comparing Types of Storage 73
Viewing Storage Information in the vSphere Client 74
8 Configuring ESXi Storage 79
Local SCSI Storage 79
Fibre Channel Storage 80
iSCSI Storage 80
Storage Refresh and Rescan Operations 90
Create VMFS Datastores 91
Network Attached Storage 92
Creating a Diagnostic Partition 94
9 Managing Storage 97
Managing Datastores 97
Changing VMFS Datastore Properties 99
Managing Duplicate VMFS Datastores 101
Using Multipathing with ESXi 103
Thin Provisioning 112
Turn Off vCenter Server Storage Filters 115
10 Raw Device Mapping 117
About Raw Device Mapping 117
Raw Device Mapping Characteristics 120
Managing Mapped LUNs 124
Security
11 Security for ESXi Systems 129
ESXi Architecture and Security Features 129
Security Resources and Information 135
12 Securing an ESXi Configuration 137
Securing the Network with Firewalls 137
Securing Virtual Machines with VLANs 143
Securing Virtual Switch Ports 148
Securing iSCSI Storage 149
4
VMware, Inc.
Contents
13 Authentication and User Management 153
Securing ESXi Through Authentication and Permissions 153
Encryption and Security Certificates for ESXi 159
14 Security Deployments and Recommendations 167
Security Approaches for Common ESXi Deployments 167
ESXi Lockdown Mode 170
Virtual Machine Recommendations 171
Host Profiles
15 Managing Host Profiles 179
Host Profiles Usage Model 179
Access Host Profiles View 180
Creating a Host Profile 180
Export a Host Profile 181
Import a Host Profile 181
Edit a Host Profile 182
Manage Profiles 183
Checking Compliance 186
Index 189
VMware, Inc.
5
ESXi Configuration Guide
6
VMware, Inc.
Updated Information
This ESXi Configuration Guide is updated with each release of the product or when necessary.
This table provides the update history of the ESXi Configuration Guide.
Revision
Description
EN-000114-04
In “Comparing Types of Storage,” on page 73, removed VM Cluster from supported vSphere features,
and included citation for Microsoft clustering.
EN-000114-03
n
n
“Add a Virtual Machine Port Group,” on page 20 reflects that the network label for a port group can
contain up to 63 characters.
The Sample vSphere Network Configuration and Traffic Flow figure in “Firewalls for Configurations
with vCenter Server,” on page 138 now reflects the correct functionality of port 5989.
EN-000114-02
The topic “Enabling Jumbo Frames,” on page 57 incorrectly stated that jumbo frames are not supported
for VMkernel networking interfaces in ESXi. This statement is deleted. ESXi supports jumbo frames on
VMkernel ports.
EN-000114-01
The topic “vNetwork Standard Switches,” on page 19 now refers to Configuration Maximums for
vSphere 4.0 for port and port group maximums.
EN-000114-00
Initial release.
VMware, Inc.
7
ESXi Configuration Guide
8
VMware, Inc.
About This Book
This manual, the ESXESXiConfiguration Guide, provides information on how to configure networking for
®
VMware ESXESXi, including how to create virtual switches and ports and how to set up networking for
virtual machines, VMware VMotion™, IP storage, and the service console. It also discusses configuring the
file system and various types of storage such as iSCSI and Fibre Channel. The guide provides a discussion of
security features built into ESXESXi and the measures that you can take to safeguard ESXESXi from attack. In
addition, it includes a list of ESXESXi technical support commands along with their VMware vSphere™ Client
equivalents and a description of the vmkfstools utility.
This information covers ESXi 4.0.
Intended Audience
This manual is intended for anyone who needs to install, upgrade, or use ESXi. The information in this manual
is written for experienced Windows or Linux system administrators who are familiar with virtual machine
technology and datacenter operations.
Document Feedback
VMware welcomes your suggestions for improving our documentation. If you have comments, send your
feedback to docfeedback@vmware.com.
VMware vSphere Documentation
The vSphere documentation consists of the combined VMware vCenter Server and ESXi documentation set.
Abbreviations Used in Figures
The figures in this manual use the abbreviations listed in Table 1.
Table 1. Abbreviations
Abbreviation
Description
database
vCenter Server database
datastore
Storage for the managed host
dsk#
Storage disk for the managed host
hostn
vCenter Server managed hosts
SAN
Storage area network type datastore shared between
managed hosts
tmplt
Template
VMware, Inc.
9
ESXi Configuration Guide
Table 1. Abbreviations (Continued)
Abbreviation
Description
user#
User with access permissions
VC
vCenter Server
VM#
Virtual machines on a managed host
Technical Support and Education Resources
The following technical support resources are available to you. To access the current version of this book and
other books, go to http://www.vmware.com/support/pubs.
Online and Telephone
Support
To use online support to submit technical support requests, view your product
and contract information, and register your products, go to
http://www.vmware.com/support.
Customers with appropriate support contracts should use telephone support
for the fastest response on priority 1 issues. Go to
http://www.vmware.com/support/phone_support.html.
10
Support Offerings
To find out how VMware support offerings can help meet your business needs,
go to http://www.vmware.com/support/services.
VMware Professional
Services
VMware Education Services courses offer extensive hands-on labs, case study
examples, and course materials designed to be used as on-the-job reference
tools. Courses are available onsite, in the classroom, and live online. For onsite
pilot programs and implementation best practices, VMware Consulting
Services provides offerings to help you assess, plan, build, and manage your
virtual environment. To access information about education classes,
certification programs, and consulting services, go to
http://www.vmware.com/services.
VMware, Inc.
Introduction to ESXi Configuration
1
This guide describes the tasks you need to complete to configure ESXi host networking, storage, and security.
In addition, it provides overviews, recommendations, and conceptual discussions to help you understand these
tasks and how to deploy a host to meet your needs.
Before you use this information, read the Introduction to vSphere for an overview of system architecture and the
physical and virtual devices that make up a vSphere system.
This introduction summarizes the contents of this guide.
Networking
The networking information provides you with a conceptual understanding of physical and virtual network
concepts, a description of the basic tasks you need to complete to configure your ESXi host’s network
connections, and a discussion of advanced networking topics and tasks.
Storage
The storage information provides you with a basic understanding of storage, a description of the basic tasks
you perform to configure and manage your ESXi host’s storage, and a discussion of how to set up raw device
mapping (RDM).
Security
The security information discusses safeguards that VMware has built into ESXi and measures that you can
take to protect your host from security threats. These measures include using firewalls, taking advantage of
the security features of virtual switches, and setting up user authentication and permissions.
Host Profiles
This section describes the host profiles feature and how it is used to encapsulate the configuration of a host
into a host profile. This section also describes how to apply this host profile to another host or cluster, edit a
profile, and check a host’s compliance with a profile.
VMware, Inc.
11
ESXi Configuration Guide
12
VMware, Inc.
Networking
VMware, Inc.
13
ESXi Configuration Guide
14
VMware, Inc.
Introduction to Networking
2
This introduction to networking guides you through the basic concepts of ESXi networking and how to set up
and configure a network in a vSphere environment.
This chapter includes the following topics:
n
“Networking Concepts Overview,” on page 15
n
“Network Services,” on page 16
n
“View Networking Information in the vSphere Client,” on page 16
n
“View Network Adapter Information in the vSphere Client,” on page 17
Networking Concepts Overview
A few concepts are essential for a thorough understanding of virtual networking. If you are new to ESXi, it is
helpful to review these concepts.
A physical network is a network of physical machines that are connected so that they can send data to and
receive data from each other. VMware ESXi runs on a physical machine.
A virtual network is a network of virtual machines running on a single physical machine that are connected
logically to each other so that they can send data to and receive data from each other. Virtual machines can be
connected to the virtual networks that you create when you add a network.
A physical Ethernet switch manages network traffic between machines on the physical network. A switch has
multiple ports, each of which can be connected to a single machine or another switch on the network. Each
port can be configured to behave in certain ways depending on the needs of the machine connected to it. The
switch learns which hosts are connected to which of its ports and uses that information to forward traffic to
the correct physical machines. Switches are the core of a physical network. Multiple switches can be connected
together to form larger networks.
A virtual switch, vSwitch, works much like a physical Ethernet switch. It detects which virtual machines are
logically connected to each of its virtual ports and uses that information to forward traffic to the correct virtual
machines. A vSwitch can be connected to physical switches by using physical Ethernet adapters, also referred
to as uplink adapters, to join virtual networks with physical networks. This type of connection is similar to
connecting physical switches together to create a larger network. Even though a vSwitch works much like a
physical switch, it does not have some of the advanced functionality of a physical switch.
A vNetwork Distributed Switch acts as a single vSwitch across all associated hosts on a datacenter. This allows
virtual machines to maintain consistent network configuration as they migrate across multiple hosts.
A dvPort is a port on a vNetwork Distributed Switch that connects to a host’s service console or VMkernel or
to a virtual machine’s network adapter.
VMware, Inc.
15
ESXi Configuration Guide
A port group specifies port configuration options such as bandwidth limitations and VLAN tagging policies
for each member port. Network services connect to vSwitches through port groups. Port groups define how a
connection is made through the vSwitch to the network. Typically, a single vSwitch is associated with one or
more port groups.
A dvPort group is a port group associated with a vNetwork Distributed Switch and specifies port configuration
options for each member port. dvPort Groups define how a connection is made through the vNetwork
Distributed Switch to the network.
NIC teaming occurs when multiple uplink adapters are associated with a single vSwitch to form a team. A
team can either share the load of traffic between physical and virtual networks among some or all of its
members, or provide passive failover in the event of a hardware failure or a network outage.
VLANs enable a single physical LAN segment to be further segmented so that groups of ports are isolated
from one another as if they were on physically different segments. The standard is 802.1Q.
The VMkernel TCP/IP networking stack supports iSCSI, NFS, and VMotion. Virtual machines run their own
systems’ TCP/IP stacks and connect to the VMkernel at the Ethernet level through virtual switches.
IP storage refers to any form of storage that uses TCP/IP network communication as its foundation. iSCSI can
be used as a virtual machine datastore, and NFS can be used as a virtual machine datastore and for direct
mounting of .ISO files, which are presented as CD-ROMs to virtual machines.
TCP Segmentation Offload, TSO, allows a TCP/IP stack to emit very large frames (up to 64KB) even though
the maximum transmission unit (MTU) of the interface is smaller. The network adapter then separates the
large frame into MTU-sized frames and prepends an adjusted copy of the initial TCP/IP headers.
Migration with VMotion enables a virtual machine that is powered on to be transferred from one ESXi host to
another without shutting down the virtual machine. The optional VMotion feature requires its own license
key.
Network Services
A vNetwork provides several different services to the host and virtual machines.
You can to enable two types of network services in ESXi:
n
Connecting virtual machines to the physical network and to each other.
n
Connecting VMkernel services (such as NFS, iSCSI, or VMotion) to the physical network.
View Networking Information in the vSphere Client
The vSphere Client displays general networking information and information specific to network adapters.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
ClickVirtual Switch to view vNetwork Standard Switch networking on the host or Distributed Virtual
Switch to view vNetwork Distributed Switch networking on the host.
The Distributed Virtual Switch option appears only on hosts that are associated with a vNetwork
Distributed Switch.
Networking information is displayed for each virtual switch on the host.
16
VMware, Inc.
Chapter 2 Introduction to Networking
View Network Adapter Information in the vSphere Client
For each physical network adapter on the host, you can view information such as the speed, duplex, and
observed IP ranges.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click Network Adapters.
The network adapters panel displays the following information.
Table 2-1. Network Panel Information
Option
Description
Device
Name of the network adapter
Speed
Actual speed and duplex of the network adapter
Configured
Configured speed and duplex of the network adapter
vSwitch
vSwitch that the network adapter is associated with
Observed IP ranges
IP addresses that the network adapter has access to
Wake on LAN supported
Network adapter ability to support Wake on the LAN
VMware, Inc.
17
ESXi Configuration Guide
18
VMware, Inc.
Basic Networking with vNetwork
Standard Switches
3
The following topics guide you through basic vNetwork Standard Switch (vSwitch) network setup and
configuration in a vSphere environment.
Use the vSphere Client to add networking based on the categories that reflect the types of network services:
n
Virtual machines
n
VMkernel
This chapter includes the following topics:
n
“vNetwork Standard Switches,” on page 19
n
“Port Groups,” on page 20
n
“Port Group Configuration for Virtual Machines,” on page 20
n
“VMkernel Networking Configuration,” on page 21
n
“vNetwork Standard Switch Properties,” on page 23
vNetwork Standard Switches
You can create abstracted network devices called vNetwork Standard Switches (vSwitches). A vSwitch can
route traffic internally between virtual machines and link to external networks.
You can use vSwitches to combine the bandwidth of multiple network adapters and balance communications
traffic among them. You can also configure a vSwitch to handle physical NIC failover.
A vSwitch models a physical Ethernet switch. The default number of logical ports for a vSwitch is 56. You can
connect one network adapter of a virtual machine to each port. Each uplink adapter associated with a vSwitch
uses one port. Each logical port on the vSwitch is a member of a single port group. Each vSwitch can also have
one or more port groups assigned to it. For information on maximum allowed ports and port groups, see
Configuration Maximums for vSphere 4.0.
When two or more virtual machines are connected to the same vSwitch, network traffic between them is routed
locally. If an uplink adapter is attached to the vSwitch, each virtual machine can access the external network
that the adapter is connected to.
VMware, Inc.
19
ESXi Configuration Guide
Port Groups
Port groups aggregate multiple ports under a common configuration and provide a stable anchor point for
virtual machines connecting to labeled networks. You can create a maximum of 512 port groups on a single
host.
Each port group is identified by a network label, which is unique to the current host. Network labels are used
to make virtual machine configuration portable across hosts. All port groups in a datacenter that are physically
connected to the same network (in the sense that each can receive broadcasts from the others) are given the
same label. Conversely, if two port groups cannot receive broadcasts from each other, they have distinct labels.
A VLAN ID, which restricts port group traffic to a logical Ethernet segment within the physical network, is
optional. For a port group to reach port groups located on other VLANs, the VLAN ID must be set to 4095. If
you use VLAN IDs, you must change the port group labels and VLAN IDs together so that the labels properly
represent connectivity.
Port Group Configuration for Virtual Machines
You can add or modify a virtual machine port group from the vSphere Client.
The vSphere Client Add Network wizard guides you through the tasks to create a virtual network to which
virtual machines can connect, including creating a vSwitch and configuring settings for a network label.
When you set up virtual machine networks, consider whether you want to migrate the virtual machines in the
network between hosts. If so, be sure that both hosts are in the same broadcast domain—that is, the same Layer
2 subnet.
ESXi does not support virtual machine migration between hosts in different broadcast domains because the
migrated virtual machine might require systems and resources that it would no longer have access to in the
new network. Even if your network configuration is set up as a high-availability environment or includes
intelligent switches that can resolve the virtual machine’s needs across different networks, you might
experience lag times as the Address Resolution Protocol (ARP) table updates and resumes network traffic for
the virtual machines.
Virtual machines reach physical networks through uplink adapters. A vSwitch can transfer data to external
networks only when one or more network adapters are attached to it. When two or more adapters are attached
to a single vSwitch, they are transparently teamed.
Add a Virtual Machine Port Group
Virtual machine port groups provide networking for virtual machines.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Select the Virtual Switch view.
vSwitches appear in an overview that includes a details layout.
20
4
On the right side of the page, click Add Networking.
5
Accept the default connection type, Virtual Machines, and click Next.
VMware, Inc.
Chapter 3 Basic Networking with vNetwork Standard Switches
6
Select Create a virtual switch or one of the listed existing vSwitches and the associated physical adapters
to use for this port group.
You can create a new vSwitch with or without Ethernet adapters.
If you create a vSwitch without physical network adapters, all traffic on that vSwitch is confined to that
vSwitch. No other hosts on the physical network or virtual machines on other vSwitches can send or
receive traffic over this vSwitch. You might create a vSwitch without physical network adapters if you
want a group of virtual machines to be able to communicate with each other, but not with other hosts or
with virtual machines outside the group.
7
Click Next.
8
In the Port Group Properties group, enter a network label that identifies the port group that you are
creating.
NOTE The network label can contain up to 63 characters.
Use network labels to identify migration-compatible connections common to two or more hosts.
9
(Optional) If you are using a VLAN, for VLAN ID, enter a number between 1 and 4094. If you are not
using a VLAN, leave this blank.
If you enter 0 or leave the option blank, the port group can see only untagged (non-VLAN) traffic. If you
enter 4095, the port group can see traffic on any VLAN while leaving the VLAN tags intact.
10
Click Next.
11
After you determine that the vSwitch is configured correctly, click Finish.
VMkernel Networking Configuration
A VMkernel networking interface is used for VMware VMotion and IP storage.
In ESXi, the VMkernel networking interface provides network connectivity for the ESXi host as well as handling
VMotion and IP storage.
Moving a virtual machine from one host to another is called migration. Using VMotion, you can migrate
powered on virtual machines with no downtime. Your VMkernel networking stack must be set up properly
to accommodate VMotion.
IP storage refers to any form of storage that uses TCP/IP network communication as its foundation, which
includes iSCSI and NFS for ESXi. Because these storage types are network based, they can use the same
VMkernel interface and port group.
The network services that the VMkernel provides (iSCSI, NFS, and VMotion) use a TCP/IP stack in the
VMkernel. This TCP/IP stack is completely separate from the TCP/IP stack used in the service console. Each
of these TCP/IP stacks accesses various networks by attaching to one or more port groups on one or more
vSwitches.
TCP/IP Stack at the VMkernel Level
The VMware VMkernel TCP/IP networking stack provides networking support in multiple ways for each of
the services it handles.
The VMkernel TCP/IP stack handles iSCSI, NFS, and VMotion in the following ways.
n
iSCSI as a virtual machine datastore
n
iSCSI for the direct mounting of .ISO files, which are presented as CD-ROMs to virtual machines
n
NFS as a virtual machine datastore
VMware, Inc.
21
ESXi Configuration Guide
n
NFS for the direct mounting of .ISO files, which are presented as CD-ROMs to virtual machines
n
Migration with VMotion
If you have two or more physical NICs for iSCSI, you can create multiple paths for the software iSCSI by using
the port binding technique. For more information on port binding, see the iSCSI SAN Configuration Guide.
NOTE ESXi supports only NFS version 3 over TCP/IP.
Set Up VMkernel Networking
Create a VMkernel network adapter for use as a VMotion interface or an IP storage port group.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
In the Virtual Switch view, click Add Networking.
4
Select VMkernel and click Next.
5
Select the vSwitch to use, or select Create a virtual switch to create a new vSwitch.
6
Select the check boxes for the network adapters your vSwitch will use.
Select adapters for each vSwitch so that virtual machines or other services that connect through the adapter
can reach the correct Ethernet segment. If no adapters appear under Create a new virtual switch, all the
network adapters in the system are being used by existing vSwitches. You can either create a new vSwitch
without a network adapter, or select a network adapter that an existing vSwitch uses.
7
Click Next.
8
Select or enter a network label and a VLAN ID.
9
Option
Description
Network Label
A name that identifies the port group that you are creating. This is the label
that you specify when configuring a virtual adapter to be attached to this
port group when configuring VMkernel services such as vMotion and IP
storage.
VLAN ID
Identifies the VLAN that the port group’s network traffic will use.
Select Use this port group for VMotion to enable this port group to advertise itself to another host as the
network connection where vMotion traffic should be sent.
You can enable this property for only one vMotion and IP storage port group for each host. If this property
is not enabled for any port group, migration with vMotion to this host is not possible.
10
22
Choose whether to use this port group for fault tolerance logging, and click Next.
VMware, Inc.
Chapter 3 Basic Networking with vNetwork Standard Switches
11
Select Obtain IP settings automaticallyto use DHCP to obtain IP settings, or select Use the following IP
settingsto specify IP settings manually.
If you choose to specify IP settings manually, provide this information.
a
Enter the IP address and subnet mask for the VMkernel interface.
This address must be different from the IP address set for the service console.
b
Click Edit to set the VMkernel Default Gateway for VMkernel services, such as vMotion, NAS, and
iSCSI.
c
On the DNS Configuration tab, the name of the host is entered by default.
The DNS server addresses that were specified during installation are also preselected, as is the
domain.
d
On the Routing tab, the service console and the VMkernel each need their own gateway information.
A gateway is needed for connectivity to machines not on the same IP subnet as the service console or
VMkernel. The default is static IP settings.
e
12
Click OK, then click Next.
On an IPV6-enabled host, select No IPv6 settings to use only IPv4 settings on the VMkernel interface, or
select Use the following IPv6 settings to configure IPv6 for the VMkernel interface.
This screen does not appear when IPv6 is disabled on the host.
13
14
If you choose to use IPv6 for the VMkernel interface, select one of the following options for obtaining IPv6
addresses.
n
Obtain IPv6 addresses automatically through DHCP
n
Obtain IPv6 addresses automatically through router advertisement
n
Static IPv6 addresses
If you choose to use static IPv6 addresses, complete the following steps.
a
Click Add to add a new IPv6 address.
b
Enter the IPv6 address and subnet prefix length, and click OK.
c
To change the VMkernel default gateway, click Edit.
15
Click Next.
16
Review the information, click Back to change any entries, and click Finish.
vNetwork Standard Switch Properties
vNetwork Standard Switch settings control vSwitch-wide defaults for ports, which can be overridden by port
group settings for each vSwitch. You can edit vSwitch properties, such as the uplink configuration and the
number of available ports.
Change the Number of Ports for a vSwitch
A vSwitch serves as a container for port configurations that use a common set of network adapters, including
sets that contain no network adapters at all. Each virtual switch provides a finite number of ports through
which virtual machines and network services can reach one or more networks.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
VMware, Inc.
23
ESXi Configuration Guide
3
On the right side of the page, click Properties for the vSwitch that you want to edit.
4
Click the Ports tab.
5
Select the vSwitch item in the Configuration list, and click Edit.
6
Click the General tab.
7
Choose the number of ports that you want to use from the drop-down menu.
8
Click OK.
What to do next
Changes will not take effect until the system is restarted.
Change the Speed of an Uplink Adapter
You can change the connection speed and duplex of an uplink adapter.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Select a vSwitch and click Properties.
4
Click the Network Adapters tab.
5
To change the configured speed and duplex value of a network adapter, select the network adapter and
click Edit.
6
To select the connection speed manually, select the speed and duplex from the drop-down menu.
Choose the connection speed manually if the NIC and a physical switch might fail to negotiate the proper
connection speed. Symptoms of mismatched speed and duplex include low bandwidth or no link
connectivity.
The adapter and the physical switch port it is connected to must be set to the same value, such as auto and
auto or ND and ND, where ND is some speed and duplex, but not auto and ND.
7
Click OK.
Add Uplink Adapters
You can associate multiple adapters to a single vSwitch to provide NIC teaming. The team can share traffic
and provide failover.
Procedure
24
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Select a vSwitch and click Properties.
4
Click the Network Adapters tab.
5
Click Add to launch the Add Adapter wizard.
6
Select one or more adapters from the list and click Next.
VMware, Inc.
Chapter 3 Basic Networking with vNetwork Standard Switches
7
(Optional) To reorder the NICs into a different category, select a NIC and click Move Up and Move
Down.
Option
Description
Active Adapters
Adapters that the vSwitch uses.
Standby Adapters
Adapters that become active if one or more of the active adapters fails.
8
Click Next.
9
Review the information on the Adapter Summary page, click Back to change any entries, and click
Finish.
The list of network adapters reappears, showing the adapters that the vSwitch now claims.
10
Click Close to exit the vSwitch Properties dialog box.
The Networking section in the Configuration tab shows the network adapters in their designated order
and categories.
Cisco Discovery Protocol
Cisco Discovery Protocol (CDP) allows ESXi administrators to determine which Cisco switch port is connected
to a given vSwitch. When CDP is enabled for a particular vSwitch, you can view properties of the Cisco switch
(such as device ID, software version, and timeout) from the vSphere Client.
In ESXi, CDP is set to listen, which means that ESXi detects and displays information about the associated
Cisco switch port, but information about the vSwitch is not available to the Cisco switch administrator.
View Cisco Switch Information on the vSphere Client
When CDP is set to listen or both, you can view Cisco switch information.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Click the info icon to the right of the vSwitch.
VMware, Inc.
25
ESXi Configuration Guide
26
VMware, Inc.
Basic Networking with vNetwork
Distributed Switches
4
These topics guide you through the basic concepts of networking with vNetwork Distributed Switches and
how to set up and configure networking with vNetwork Distributed Switches in a vSphere environment.
This chapter includes the following topics:
n
“vNetwork Distributed Switch Architecture,” on page 27
n
“Configuring a vNetwork Distributed Switch,” on page 28
n
“dvPort Groups,” on page 30
n
“Private VLANs,” on page 32
n
“Configuring vNetwork Distributed Switch Network Adapters,” on page 33
n
“Configuring Virtual Machine Networking on a vNetwork Distributed Switch,” on page 37
vNetwork Distributed Switch Architecture
A vNetwork Distributed Switch functions as a single virtual switch across all associated hosts. This allows
virtual machines to maintain a consistent network configuration as they migrate across multiple hosts.
Like a vNetwork Standard Switch, each vNetwork Distributed Switch is a network hub that virtual machines
can use. A vNetwork Distributed Switch can forward traffic internally between virtual machines or link to an
external network by connecting to physical Ethernet adapters, also known as uplink adapters.
Each vNetwork Distributed Switch can also have one or more dvPort groups assigned to it. dvPort groups
group multiple ports under a common configuration and provide a stable anchor point for virtual machines
connecting to labeled networks. Each dvPort group is identified by a network label, which is unique to the
current datacenter. A VLAN ID, which restricts port group traffic to a logical Ethernet segment within the
physical network, is optional.
In addition to VMware vNetwork Distributed Switches, vSphere 4 also provides initial support for third-party
virtual switches. For information on configuring these third-party switches, visit
http://www.cisco.com/go/1000vdocs.
VMware, Inc.
27
ESXi Configuration Guide
Configuring a vNetwork Distributed Switch
You can create a vNetwork Distributed Switch on a vCenter Server datacenter. After you have created a
vNetwork Distributed Switch, you can add hosts, create dvPort groups, and edit vNetwork Distributed Switch
properties and policies.
Create a vNetwork Distributed Switch
Create a vNetwork Distributed Switch to handle networking traffic for associated hosts on the datacenter.
Procedure
1
Log in to the vSphere Client and display the datacenter in Networking view.
2
From the Inventory menu, select Datacenter > vNetwork Distributed Switch.
The Create vNetwork Distributed Switch wizard appears.
3
Enter a name for the vNetwork Distributed Switch in the Name field.
4
Select the Number of dvUplink Ports, and click Next.
dvUplink ports connect the vNetwork Distributed Switch to physical NICs on associated ESXi hosts. The
number of dvUplink ports is the maximum number of allowed physical connections to the vNetwork
Distributed Switch per host.
5
Click Next.
6
Choose Add now or Add later.
7
If you chose Add now, select the hosts and physical adapters to use by clicking the check box next to each
host or adapter. You can add only physical adapters that are not already in use during vNetwork
Distributed Switch creation.
8
Click Next.
9
Choose whether to Automatically create a default port group.
This option creates an early-binding port group with 128 ports. For systems with complex port group
requirements, skip the default port group and create a new dvPort group after you have finished adding
the vNetwork Distributed Switch.
10
Review the vNetwork Distributed Switch diagram to ensure proper configuration, and click Finish.
What to do next
If you chose to add hosts later, you must add hosts to the vNetwork Distributed Switch before adding network
adapters.
Network adapters can be added from the host configuration page of the vSphere Client or by using Host
Profiles.
Add a Host to a vNetwork Distributed Switch
Use the Add Host to vNetwork Distributed Switch wizard to associate a host with a vNetwork Distributed
Switch. You can also add hosts to a vNetwork Distributed Switch using Host Profiles.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select Distributed Virtual Switch > Add Host.
The Add Host to vNetwork Distributed Switch wizard appears.
28
VMware, Inc.
Chapter 4 Basic Networking with vNetwork Distributed Switches
3
Select the host to add.
4
Under the selected host, select the physical adapters to add, and click Next.
You may select both free and in use physical adapters. If you select an adapter that is currently in use by
a host, choose whether to move the associated virtual adapters to the vNetwork Distributed Switch.
NOTE Moving a physical adapter to a vNetwork Distributed Switch without moving any associated virtual
adapters will cause those virtual adapters to lose network connectivity.
5
Click Finish.
Edit General vNetwork Distributed Switch Settings
You can edit the general properties for a vNetwork Distributed Switch, such as the vNetwork Distributed
Switch name and the number of uplink ports on the vNetwork Distributed Switch.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select Distributed Virtual Switch > Edit Settings.
3
Select General to edit the following vNetwork Distributed Switch settings.
4
a
Enter the name for the vNetwork Distributed Switch.
b
Select the number of uplink ports.
c
To edit uplink port names, click Edit uplink port names, enter the new names, and click OK.
d
Enter any notes for the vNetwork Distributed Switch.
Click OK.
Edit Advanced vNetwork Distributed Switch Settings
Use the vNetwork Distributed Switch Settings dialog box to configure advanced vNetwork Distributed Switch
settings such as Cisco Discovery Protocol and the maximum MTU for the vNetwork Distributed Switch.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select Distributed Virtual Switch > Edit Settings.
3
Select Advanced to edit the following vNetwork Distributed Switch properties.
4
VMware, Inc.
a
Specify the maximum MTU size.
b
Select the Enable Cisco Discovery Protocol check box to enable CDP, and set the operation to
Listen, Advertise, or Both.
c
Enter the name and other details for the vNetwork Distributed Switch administrator in the Admin
Contact Info section.
Click OK.
29
ESXi Configuration Guide
View Network Adapter Information for a vNetwork Distributed Switch
View physical network adapters and uplink assignments for a vNetwork Distributed Switch from the
networking inventory view of the vSphere Client.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select Distributed Virtual Switch > Edit Settings.
3
On the Network Adapters tab, you can view network adapter and uplink assignments for associated hosts.
This tab is read-only. vNetwork Distributed Switch network adapters must be configured at the host level.
4
Click OK.
dvPort Groups
A dvPort group specifies port configuration options for each member port on a vNetwork Distributed Switch.
dvPort groups define how a connection is made to a network.
Add a dvPort Group
Use the Create dvPort Group wizard to add a dvPort group to a vNetwork Distributed Switch.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select Distributed Virtual Switch > New Port Group.
3
Enter a name and the number of ports for the dvPort group.
4
Choose a VLAN type.
Option
Description
None
Do not use VLAN.
VLAN
In the VLAN ID field, enter a number between 1 and 4094.
VLAN Trunking
Enter a VLAN trunk range.
Private VLAN
Select a private VLAN entry. If you have not created any private VLANs,
this menu is empty.
5
Click Next.
6
Click Finish.
Edit General dvPort Group Properties
Use the dvPort Group Properties dialog box to configure general dvPort group properties such as the dvPort
group name and port group type.
Procedure
30
1
In the vSphere Client, display the Networking inventory view and select the dvPort group.
2
From the Inventory menu, select Network > Edit Settings.
VMware, Inc.
Chapter 4 Basic Networking with vNetwork Distributed Switches
3
4
Select General to edit the following dvPort group properties.
Option
Action
Name
Enter the name for the dvPort group.
Description
Enter a brief description of the dvPort group.
Number of Ports
Enter the number of ports on the dvPort group.
Port binding
Choose when ports are assigned to virtual machines connected to this dvPort
group.
n Select Static binding to assign a port to a virtual machine when the
virtual machine is connected to the dvPort group.
n Select Dynamic binding to assign a port to a virtual machine the first
time the virtual machine powers on after it is connected to the dvPort
group.
n Select Ephemeral for no port binding.
Click OK.
Edit Advanced dvPort Group Properties
Use the dvPort Group Properties dialog box to configure advanced dvPort group properties such as the port
name format and override settings.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the dvPort group.
2
From the Inventory menu, select Network > Edit Settings.
3
Select Advanced to edit the dvPort group properties.
4
a
Select Allow port policies to be overridden to allow dvPort group policies to be overridden on a perport level.
b
Click Edit Override Settings to select which policies can be overridden.
c
Choose whether to allow live port moving.
d
Select Config reset at disconnect to discard per-port configurations when a dvPort is disconnected
from a virtual machine.
e
Select Binding on host allowed to specify that when vCenter Server is down, ESXi can assign a dvPort
to a virtual machine.
f
Select Port name format to provide a template for assigning names to the dvPorts in this group.
Click OK.
Configure dvPort Settings
Use the Port Settings dialog box to configure general dvPort properties such as the port name and description.
Procedure
1
Log in to the vSphere Client and display the vNetwork Distributed Switch.
2
On the Ports tab, right-click the port to modify and select Edit Settings.
3
Click General.
4
Modify the port name and description.
5
Click OK.
VMware, Inc.
31
ESXi Configuration Guide
Private VLANs
Private VLANs are used to solve VLAN ID limitations and the waste of IP addresses for certain network setups.
A private VLAN is identified by its primary VLAN ID. A primary VLAN ID can have multiple secondary
VLAN IDs associated with it. Primary VLANs are promiscuous so that ports on a private VLAN can
communicate with ports configured as the primary VLAN. Ports on a secondary VLAN can be either isolated,
communicating only with promiscuous ports, or community, communicating with both promiscuous ports
and other ports on the same secondary VLAN.
To use private VLANs between an ESXi host and the rest of the physical network, the physical switch connected
to the ESXi host needs to be private VLAN-capable and configured with the VLAN IDs being used by ESXi for
the private VLAN functionality. For physical switches using dynamic MAC+VLAN ID based learning, all
corresponding private VLAN IDs must be first entered into the switch’s VLAN database.
To configure dvPorts to use private VLAN functionality, you must first create the necessary private VLANs
on the vNetwork Distributed Switch that the dvPorts are connected to.
Create a Private VLAN
You can create a private VLAN for use on a vNetwork Distributed Switch and its associated dvPorts.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select vNetwork Distributed Switch > Edit Settings.
3
Select the Private VLAN tab.
4
Under Primary Private VLAN ID, click [Enter a Private VLAN ID here], and enter the number of the
primary private VLAN.
5
Click anywhere in the dialog box, and then select the primary private VLAN that you just added.
The primary private VLAN you added appears under Secondary Private VLAN ID.
6
For each new secondary private VLAN, click [Enter a Private VLAN ID here] under Secondary Private
VLAN ID, and enter the number of the secondary private VLAN.
7
Click anywhere in the dialog box, select the secondary private VLAN that you just added, and select either
Isolated or Community for the port type.
8
Click OK.
Remove a Primary Private VLAN
Remove unused primary private VLANs from the networking inventory view of the vSphere Client.
Prerequisites
Before removing a private VLAN, be sure that no port groups are configured to use it.
Procedure
32
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select vNetwork Distributed Switch > Edit Settings.
3
Select the Private VLAN tab.
VMware, Inc.
Chapter 4 Basic Networking with vNetwork Distributed Switches
4
Select the primary private VLAN to remove.
5
Click Remove under Primary Private VLAN ID, and click OK.
Removing a primary private VLAN also removes all associated secondary private VLANs.
Remove a Secondary Private VLAN
Remove unused secondary private VLANs from the networking inventory view of the vSphere Client.
Prerequisites
Before removing a private VLAN, be sure that no port groups are configured to use it.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select vNetwork Distributed Switch > Edit Settings.
3
Select the Private VLAN tab.
4
Select a primary private VLAN to display its associated secondary private VLANs.
5
Select the secondary private VLAN to remove.
6
Click Remove under Secondary Private VLAN ID, and click OK.
Configuring vNetwork Distributed Switch Network Adapters
The vNetwork Distributed Switch networking view of the host configuration page displays the configuration
of the host’s associated vNetwork Distributed Switches and allows you to configure the vNetwork Distributed
Switch network adapters and uplink ports.
Managing Physical Adapters
For each host associated with a vNetwork Distributed Switch, you must assign physical network adapters, or
uplinks, to the vNetwork Distributed Switch. You can assign one uplink on each host per uplink port on the
vNetwork Distributed Switch.
Add an Uplink to a vNetwork Distributed Switch
Physical uplinks must be added to a vNetwork Distributed Switch in order for virtual machines and virtual
network adapters connected to the vNetwork Distributed Switch to connect to networks outside the hosts on
which they reside.
Procedure
1
Log in to the vSphere Client and select a host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Select the vNetwork Distributed Switch view.
4
Click Manage Physical Adapters.
5
Click Click to Add NIC for the uplink port to add an uplink to.
6
Select the physical adapter to add. If you select an adapter that is attached to another switch, it is removed
from that switch and reassigned to this vNetwork Distributed Switch.
7
Click OK.
VMware, Inc.
33
ESXi Configuration Guide
Remove an Uplink from a vNetwork Distributed Switch
An uplink that is associated with a vNetwork Distributed Switch cannot be added to a vSwitch or another
vNetwork Distributed Switch.
Procedure
1
Log in to the vSphere Client and select a host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Select the vNetwork Distributed Switch view.
4
Click Manage Physical Adapters.
5
Click Remove for the uplink to remove.
6
Click OK.
Managing Virtual Network Adapters
Virtual network adapters handle host network services over a vNetwork Distributed Switch.
You can configure VMkernel virtual adapters for an ESXi host through an associated vNetwork Distributed
Switch either by creating new virtual adapters or migrating existing virtual adapters.
Create a VMkernel Network Adapter on a vNetwork Distributed Switch
Create a VMkernel network adapter for use as a VMotion interface or an IP storage port group.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Select the vNetwork Distributed Switch view.
4
Click Manage Virtual Adapters.
5
Click Add.
6
Select New virtual adapter, and click Next.
7
Select VMkernel, and click Next.
8
Under Network Connection, select the vNetwork Distributed Switch and the associated port group, or
select the standalone port to which to add this virtual adapter.
9
Select Use this virtual adapter for VMotion to enable this port group to advertise itself to another ESXi
host as the network connection where VMotion traffic is sent.
You can enable this property for only one VMotion and IP storage port group for each ESXi host. If this
property is not enabled for any port group, migration with VMotion to this host is not possible.
10
Choose whether to use this virtual adapter for fault tolerance logging.
11
Choose whether to use this virtual adapter for management traffic, and click Next.
12
Under IP Settings, specify the IP address and subnet mask.
13
Click Edit to set the VMkernel default gateway for VMkernel services, such as VMotion, NAS, and iSCSI.
On the DNS Configuration tab, the name of the host is entered by default. The DNS server addresses and
domain that were specified during installation are also preselected.
34
VMware, Inc.
Chapter 4 Basic Networking with vNetwork Distributed Switches
14
On the Routing tab, the service console and the VMkernel each need their own gateway information.
A gateway is needed for connectivity to machines not on the same IP subnet as the service console or
VMkernel. Static IP settings is the default.
15
Click OK, and then click Next.
16
Click Finish.
Migrate an Existing Virtual Adapter to a vNetwork Distributed Switch
You migrate an existing virtual adapter from a vNetwork Standard Switch to a vNetwork Distributed Switch
from the host configuration page.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Select the vNetwork Distributed Switch view.
4
Click Manage Virtual Adapters.
5
Click Add.
6
Select Migrate existing virtual network adapters, and click Next.
7
In the Select by drop-down menu, choose whether to connect this virtual adapter to a port group or a
standalone dvPort.
8
Select one or more virtual network adapters to migrate.
9
For each selected adapter, choose a port group or dvPort from the Select a port group or Select a port
drop-down menu.
10
Click Next.
11
Click Finish.
Migrate a Virtual Adapter to a vNetwork Standard Switch
Use the Migrate to Virtual Switch wizard to migrate an existing virtual adapter from a vNetwork Distriubted
Switch to a vNetwork Standard Switch.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
The hardware configuration page for this server appears.
2
Click the Configuration tab and click Networking.
3
Select the vNetwork Distributed Switch view.
4
Click Manage Virtual Adapters.
5
Select the virtual adapter to migrate, and click Migrate to Virtual Switch.
The Migrate Virtual Adapter wizard appears.
6
Select the vSwitch to migrate the adapter to and click Next.
7
Enter a Network Label and optionally a VLAN ID for the virtual adapter, and click Next.
8
Click Finish to migrate the virtual adapter and complete the wizard.
VMware, Inc.
35
ESXi Configuration Guide
Edit the VMkernel Configuration on a vNetwork Distributed Switch
You can edit the properties of an existing VMkernel adapter on a vNetwork Distributed Switch from the
associated host.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Select the vNetwork Distributed Switch view.
4
Click Manage Virtual Adapters.
5
Select the VMkernel adapter to modify and click Edit.
6
Under Network Connection, select the vNetwork Distributed Switch and the associated port group, or
select the standalone port to which to add this virtual adapter.
7
Select Use this virtual adapter for VMotion to enable this port group to advertise itself to another ESXi
host as the network connection where VMotion traffic is sent.
You can enable this property for only one VMotion and IP storage port group for each ESXi host. If this
property is not enabled for any port group, migration with VMotion to this host is not possible.
8
Choose whether to use this virtual adapter for fault tolerance logging.
9
Choose whether to Use this virtual adapter for management traffic, and click Next.
10
Under IP Settings, specify the IP address and subnet mask, or select Obtain IP settings automatically.
11
Click Edit to set the VMkernel default gateway for VMkernel services, such as VMotion, NAS, and iSCSI.
On the DNS Configuration tab, the name of the host is entered by default. The DNS server addresses and
domain that were specified during installation are also preselected.
12
Click OK.
Remove a Virtual Adapter
Remove a virtual network adapter from a vNetwork Distributed Switch in the Manage Virtual Adapters dialog
box.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
Select the vNetwork Distributed Switch view.
4
Click Manage Virtual Adapters.
5
Select the virtual adapter to remove and click Remove.
A dialog box appears with the message, Are you sure you want to remove <adapter name>?
6
36
Click Yes.
VMware, Inc.
Chapter 4 Basic Networking with vNetwork Distributed Switches
Configuring Virtual Machine Networking on a vNetwork Distributed
Switch
Virtual machines can be connected to a vNetwork Distributed Switch either by configuring an individual
virtual machine NIC or migrating groups of virtual machines from the vNetwork Distributed Switch itself.
Virtual machines are connected to vNetwork Distributed Switches by connecting their associated virtual
network adapters to dvPort groups. This can be done either for an individual virtual machine by modifying
the virtual machine’s network adapter configuration, or for a group of virtual machines by migrating virtual
machines from an existing virtual network to a vNetwork Distributed Switch.
Migrate Virtual Machines to or from a vNetwork Distributed Switch
In addition to connecting virtual machines to a vNetwork Distributed Switch at the individual virtual machine
level, you can migrate a group of virtual machines between a vNetwork Distributed Switch network and a
vNetwork Standard Switch network.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select Distributed Virtual Switch > Migrate Virtual Machine Networking.
The Migrate Virtual Machine Networking wizard appears.
3
In the Select Source Network drop-down menu, select the virtual network to migrate from.
4
Select the virtual network to migrate to from the Select Destination Network drop-down menu.
5
Click Show Virtual Machines.
Virtual machines associated with the virtual network you are migrating from are displayed in the Select
Virtual Machines field.
6
Select virtual machines to migrate to the destination virtual network, and click OK.
Connect an Individual Virtual Machine to a dvPort Group
Connect an individual virtual machine to a vNetwork Distributed Switch by modifying the virtual machine's
NIC configuration.
Procedure
1
Log in to the vSphere Client and select the virtual machine from the inventory panel.
2
On the Summary tab, click Edit Settings.
3
On the Hardware tab, select the virtual network adapter.
4
Select the dvPort group to migrate to from the Network Label drop-down menu, and click OK.
VMware, Inc.
37
ESXi Configuration Guide
38
VMware, Inc.
Advanced Networking
5
The following topics guide you through advanced networking in an ESXi environment, and how to set up and
change advanced networking configuration options.
This chapter includes the following topics:
n
“Internet Protocol Version 6,” on page 39
n
“Networking Policies,” on page 40
n
“Change the DNS and Routing Configuration,” on page 55
n
“MAC Addresses,” on page 55
n
“TCP Segmentation Offload and Jumbo Frames,” on page 57
n
“NetQueue and Networking Performance,” on page 59
n
“VMDirectPath Gen I,” on page 60
Internet Protocol Version 6
vSphere supports both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) environments.
The Internet Engineering Task Force has designated IPv6 as the successor to IPv4. The adoption of IPv6, both
as a standalone protocol and in a mixed environment with IPv4, is rapidly increasing. With IPv6, you can use
vSphere features such as NFS in an IPv6 environment.
A major difference between IPv4 and IPv6 is address length. IPv6 uses a 128-bit address rather than the 32-bit
addresses used by IPv4. This helps alleviate the problem of address exhaustion that is present with IPv4 and
eliminates the need for network address translation (NAT). Other notable differences include link-local
addresses that appear as the interface is initialized, addresses that are set by router advertisements, and the
ability to have multiple IPv6 addresses on an interface.
An IPv6-specific configuration in vSphere involves providing IPv6 addresses, either by entering static
addresses or by using DHCP for all relevant vSphere networking interfaces. IPv6 addresses can also be
configured using stateless autoconfiguration sent by router advertisement.
Enable IPv6 Support on an ESXi Host
You can enable or disable IPv6 support on the host.
Procedure
1
Click the arrow next to the Inventory button in the navigation bar and select Hosts and Clusters.
2
Select the host and click the Configuration tab.
3
Click the Networking link under Hardware.
VMware, Inc.
39
ESXi Configuration Guide
4
In the Virtual Switch view, click the Properties link.
5
Select Enable IPv6 support on this host and click OK.
6
Reboot the host.
Networking Policies
Any policies set at the vSwitch or dvPort group level are applied to all port groups on that vSwitch or dvPorts
in the dvPort group, except for the configuration options that are overridden at the port group or dvPort level.
The following networking policies can be applied:
n
Load balancing and failover
n
VLAN (vNetwork Distributed Switch only)
n
Security
n
Traffic shaping
n
Port blocking policies (vNetwork Distributed Switch only)
Load Balancing and Failover Policy
Load balancing and failover policies allow you to determine how network traffic is distributed between
adapters and how to re-route traffic in the event of adapter failure.
You can edit your load balancing and failover policy by configuring the following parameters:
n
Load Balancing policy determines how outgoing traffic is distributed among the network adapters
assigned to a vSwitch.
NOTE Incoming traffic is controlled by the load balancing policy on the physical switch.
n
Failover Detection controls the link status and beacon probing. Beaconing is not supported with guest
VLAN tagging.
n
Network Adapter Order can be active or standby.
Edit the Failover and Load Balancing Policy on a vSwitch
Failover and load balancing policies allow you to determine how network traffic is distributed between
adapters and how to re-route traffic in the event of an adapter failure..
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click Networking.
3
Select a vSwitch and click Properties.
4
In the vSwitch Properties dialog box, click the Ports tab.
5
To edit the failover and load balancing values for the vSwitch, select the vSwitch item and click
Properties.
6
Click the NIC Teaming tab.
You can override the failover order at the port group level. By default, new adapters are active for all
policies. New adapters carry traffic for the vSwitch and its port group unless you specify otherwise.
40
VMware, Inc.
Chapter 5 Advanced Networking
7
Specify the settings in the Policy Exceptions group.
Option
Description
Load Balancing
Specify how to choose an uplink.
Route based on the originating port ID — Choose an uplink based on
the virtual port where the traffic entered the virtual switch.
n Route based on ip hash — Choose an uplink based on a hash of the
source and destination IP addresses of each packet. For non-IP packets,
whatever is at those offsets is used to compute the hash.
n Route based on source MAC hash — Choose an uplink based on a hash
of the source Ethernet.
n Use explicit failover order — Always use the highest order uplink from
the list of Active adapters which passes failover detection criteria.
NOTE IP-based teaming requires that the physical switch be configured with
etherchannel. For all other options, etherchannel should be disabled.
n
8
VMware, Inc.
Network Failover Detection
Specify the method to use for failover detection.
n Link Status only – Relies solely on the link status that the network
adapter provides. This option detects failures, such as cable pulls and
physical switch power failures, but not configuration errors, such as a
physical switch port being blocked by spanning tree or that is
misconfigured to the wrong VLAN or cable pulls on the other side of a
physical switch.
n Beacon Probing – Sends out and listens for beacon probes on all NICs
in the team and uses this information, in addition to link status, to
determine link failure. This detects many of the failures previously
mentioned that are not detected by link status alone.
Notify Switches
Select Yes or No to notify switches in the case of failover.
If you select Yes, whenever a virtual NIC is connected to the vSwitch or
whenever that virtual NIC’s traffic would be routed over a different physical
NIC in the team because of a failover event, a notification is sent out over the
network to update the lookup tables on physical switches. In almost all cases,
this process is desirable for the lowest latency of failover occurrences and
migrations with VMotion.
NOTE Do not use this option when the virtual machines using the port group
are using Microsoft Network Load Balancing in unicast mode. No such issue
exists with NLB running in multicast mode.
Failback
Select Yes or No to disable or enable failback.
This option determines how a physical adapter is returned to active duty
after recovering from a failure. If failback is set to Yes (default), the adapter
is returned to active duty immediately upon recovery, displacing the standby
adapter that took over its slot, if any. If failback is set to No, a failed adapter
is left inactive even after recovery until another currently active adapter fails,
requiring its replacement.
Failover Order
Specify how to distribute the work load for uplinks. If you want to use some
uplinks but reserve others for emergencies in case the uplinks in use fail, set
this condition by moving them into different groups:
n Active Uplinks — Continue to use the uplink when the network adapter
connectivity is up and active.
n Standby Uplinks— Use this uplink if one of the active adapter’s
connectivity is down.
n Unused Uplinks— Do not use this uplink.
Click OK.
41
ESXi Configuration Guide
Edit the Failover and Load Balancing Policy on a Port Group
You can edit the failover and load balancing policy configuration for a port group.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click Networking.
3
Select a port group and click Edit.
4
In the Properties dialog box, click the Ports tab.
5
To edit the Failover and Load Balancing values for the vSwitch, select the vSwitch item and click
Properties.
6
Click the NIC Teaming tab.
You can override the failover order at the port-group level. By default, new adapters are active for all
policies. New adapters carry traffic for the vSwitch and its port group unless you specify otherwise.
42
VMware, Inc.
Chapter 5 Advanced Networking
7
Specify the settings in the Policy Exceptions group.
Option
Description
Load Balancing
Specify how to choose an uplink.
Route based on the originating port ID — Choose an uplink based on
the virtual port where the traffic entered the virtual switch.
n Route based on ip hash — Choose an uplink based on a hash of the
source and destination IP addresses of each packet. For non-IP packets,
whatever is at those offsets is used to compute the hash.
n Route based on source MAC hash — Choose an uplink based on a hash
of the source Ethernet.
n Use explicit failover order — Always use the highest order uplink from
the list of Active adapters which passes failover detection criteria.
NOTE IP-based teaming requires that the physical switch be configured with
etherchannel. For all other options, etherchannel should be disabled.
n
8
VMware, Inc.
Network Failover Detection
Specify the method to use for failover detection.
n Link Status only – Relies solely on the link status that the network
adapter provides. This option detects failures, such as cable pulls and
physical switch power failures, but not configuration errors, such as a
physical switch port being blocked by spanning tree or that is
misconfigured to the wrong VLAN or cable pulls on the other side of a
physical switch.
n Beacon Probing – Sends out and listens for beacon probes on all NICs
in the team and uses this information, in addition to link status, to
determine link failure. This detects many of the failures previously
mentioned that are not detected by link status alone.
Notify Switches
Select Yes or No to notify switches in the case of failover.
If you select Yes, whenever a virtual NIC is connected to the vSwitch or
whenever that virtual NIC’s traffic would be routed over a different physical
NIC in the team because of a failover event, a notification is sent out over the
network to update the lookup tables on physical switches. In almost all cases,
this process is desirable for the lowest latency of failover occurrences and
migrations with VMotion.
NOTE Do not use this option when the virtual machines using the port group
are using Microsoft Network Load Balancing in unicast mode. No such issue
exists with NLB running in multicast mode.
Failback
Select Yes or No to disable or enable failback.
This option determines how a physical adapter is returned to active duty
after recovering from a failure. If failback is set to Yes (default), the adapter
is returned to active duty immediately upon recovery, displacing the standby
adapter that took over its slot, if any. If failback is set to No, a failed adapter
is left inactive even after recovery until another currently active adapter fails,
requiring its replacement.
Failover Order
Specify how to distribute the work load for uplinks. If you want to use some
uplinks but reserve others for emergencies in case the uplinks in use fail, set
this condition by moving them into different groups:
n Active Uplinks — Continue to use the uplink when the network adapter
connectivity is up and active.
n Standby Uplinks— Use this uplink if one of the active adapter’s
connectivity is down.
n Unused Uplinks— Do not use this uplink.
Click OK.
43
ESXi Configuration Guide
Edit the Teaming and Failover Policy on a dvPort Group
Teaming and Failover policies allow you to determine how network traffic is distributed between adapters
and how to re-route traffic in the event of an adapter failure.
Procedure
44
1
In the vSphere Client, display the Networking inventory view and select the dvPort group.
2
From the Inventory menu, select Network > Edit Settings.
3
Select Policies.
VMware, Inc.
Chapter 5 Advanced Networking
4
In the Teaming and Failover group, specify the following.
Option
Description
Load Balancing
Specify how to choose an uplink.
Route based on the originating port ID — Choose an uplink based on
the virtual port where the traffic entered the virtual switch.
n Route based on ip hash — Choose an uplink based on a hash of the
source and destination IP addresses of each packet. For non-IP packets,
whatever is at those offsets is used to compute the hash.
n Route based on source MAC hash — Choose an uplink based on a hash
of the source Ethernet.
n Use explicit failover order — Always use the highest order uplink from
the list of Active adapters which passes failover detection criteria.
NOTE IP-based teaming requires that the physical switch be configured with
etherchannel. For all other options, etherchannel should be disabled.
n
5
VMware, Inc.
Network Failover Detection
Specify the method to use for failover detection.
n Link Status only – Relies solely on the link status that the network
adapter provides. This option detects failures, such as cable pulls and
physical switch power failures, but not configuration errors, such as a
physical switch port being blocked by spanning tree or that is
misconfigured to the wrong VLAN or cable pulls on the other side of a
physical switch.
n Beacon Probing – Sends out and listens for beacon probes on all NICs
in the team and uses this information, in addition to link status, to
determine link failure. This detects many of the failures previously
mentioned that are not detected by link status alone.
NOTE Do not use beacon probing with IP-has load balancing.
Notify Switches
Select Yes or No to notify switches in the case of failover.
If you select Yes, whenever a virtual NIC is connected to the vSwitch or
whenever that virtual NIC’s traffic would be routed over a different physical
NIC in the team because of a failover event, a notification is sent out over the
network to update the lookup tables on physical switches. In almost all cases,
this process is desirable for the lowest latency of failover occurrences and
migrations with VMotion.
NOTE Do not use this option when the virtual machines using the port group
are using Microsoft Network Load Balancing in unicast mode. No such issue
exists with NLB running in multicast mode.
Failback
Select Yes or No to disable or enable failback.
This option determines how a physical adapter is returned to active duty
after recovering from a failure. If failback is set to Yes (default), the adapter
is returned to active duty immediately upon recovery, displacing the standby
adapter that took over its slot, if any. If failback is set to No, a failed adapter
is left inactive even after recovery until another currently active adapter fails,
requiring its replacement.
Failover Order
Specify how to distribute the work load for uplinks. If you want to use some
uplinks but reserve others for emergencies in case the uplinks in use fail, set
this condition by moving them into different groups:
n Active Uplinks — Continue to use the uplink when the network adapter
connectivity is up and active.
n Standby Uplinks— Use this uplink if one of the active adapter’s
connectivity is down.
n Unused Uplinks— Do not use this uplink.
NOTE When using IP-has load balancing, do not configure standby uplinks.
Click OK.
45
ESXi Configuration Guide
Edit dvPort Teaming and Failover Policies
Teaming and Failover policies allow you to determine how network traffic is distributed between adapters
and how to re-route traffic in the event of an adapter failure.
Prerequisites
To edit the teaming and failover policies on an individual dvPort, the associated dvPort group must be set to
allow policy overrides.
Procedure
1
Log in to the vSphere Client and display the vNetwork Distributed Switch.
2
On the Ports tab, right-click the port to modify and select Edit Settings.
The Port Settings dialog box appears.
3
46
Click Policies to view and modify port networking policies.
VMware, Inc.
Chapter 5 Advanced Networking
4
In the Teaming and Failover group, specify the following.
Option
Description
Load Balancing
Specify how to choose an uplink.
Route based on the originating port ID — Choose an uplink based on
the virtual port where the traffic entered the virtual switch.
n Route based on ip hash — Choose an uplink based on a hash of the
source and destination IP addresses of each packet. For non-IP packets,
whatever is at those offsets is used to compute the hash.
n Route based on source MAC hash — Choose an uplink based on a hash
of the source Ethernet.
n Use explicit failover order — Always use the highest order uplink from
the list of Active adapters which passes failover detection criteria.
NOTE IP-based teaming requires that the physical switch be configured with
etherchannel. For all other options, etherchannel should be disabled.
n
5
VMware, Inc.
Network Failover Detection
Specify the method to use for failover detection.
n Link Status only – Relies solely on the link status that the network
adapter provides. This option detects failures, such as cable pulls and
physical switch power failures, but not configuration errors, such as a
physical switch port being blocked by spanning tree or that is
misconfigured to the wrong VLAN or cable pulls on the other side of a
physical switch.
n Beacon Probing – Sends out and listens for beacon probes on all NICs
in the team and uses this information, in addition to link status, to
determine link failure. This detects many of the failures previously
mentioned that are not detected by link status alone.
NOTE Do not use beacon probing with IP-has load balancing.
Notify Switches
Select Yes or No to notify switches in the case of failover.
If you select Yes, whenever a virtual NIC is connected to the vSwitch or
whenever that virtual NIC’s traffic would be routed over a different physical
NIC in the team because of a failover event, a notification is sent out over the
network to update the lookup tables on physical switches. In almost all cases,
this process is desirable for the lowest latency of failover occurrences and
migrations with VMotion.
NOTE Do not use this option when the virtual machines using the port group
are using Microsoft Network Load Balancing in unicast mode. No such issue
exists with NLB running in multicast mode.
Failback
Select Yes or No to disable or enable failback.
This option determines how a physical adapter is returned to active duty
after recovering from a failure. If failback is set to Yes (default), the adapter
is returned to active duty immediately upon recovery, displacing the standby
adapter that took over its slot, if any. If failback is set to No, a failed adapter
is left inactive even after recovery until another currently active adapter fails,
requiring its replacement.
Failover Order
Specify how to distribute the work load for uplinks. If you want to use some
uplinks but reserve others for emergencies in case the uplinks in use fail, set
this condition by moving them into different groups:
n Active Uplinks — Continue to use the uplink when the network adapter
connectivity is up and active.
n Standby Uplinks— Use this uplink if one of the active adapter’s
connectivity is down.
n Unused Uplinks— Do not use this uplink.
NOTE When using IP-has load balancing, do not configure standby uplinks.
Click OK.
47
ESXi Configuration Guide
VLAN Policy
The VLAN policy allows virtual networks to join physical VLANs.
Edit the VLAN Policy on a dvPort Group
You can edit the VLAN policy configuration on a dvPort group.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the dvPort group.
2
From the Inventory menu, select Network > Edit Settings.
3
Select VLAN.
4
Select the VLAN Type to use.
Option
Description
None
Do not use VLAN.
VLAN
In the VLAN ID field, enter a number between 1 and 4094.
VLAN Trunking
Enter a VLAN trunk range.
Private VLAN
Select an available private VLAN to use.
Edit dvPort VLAN Policies
A VLAN policy set at the dvPort level allows the individual dvPort to override the VLAN policy set at the
dvPort group level.
Prerequisites
To edit the VLAN policies on an individual dvPort, the associated dvPort group must be set to allow policy
overrides.
Procedure
1
Log in to the vSphere Client and display the vNetwork Distributed Switch.
2
On the Ports tab, right-click the port to modify and select Edit Settings.
3
Click Policies.
4
Select the VLAN type to use.
5
Option
Action
None
Do not use a VLAN.
VLAN
For the VLAN ID, enter a number between 1 and 4095.
VLAN Trunking
Enter a VLAN trunk range.
Private VLAN
Select an available private VLAN to use.
Click OK.
Security Policy
Networking security policies determine how the adapter filters inbound and outbound frames.
Layer 2 is the Data Link Layer. The three elements of the security policy are promiscuous mode, MAC address
changes, and forged transmits.
48
VMware, Inc.
Chapter 5 Advanced Networking
In nonpromiscuous mode, a guest adapter listens only to traffic forwarded to own MAC address. In
promiscuous mode, it can listen to all the frames. By default, guest adapters are set to nonpromiscuous mode.
Edit the Layer 2 Security Policy on a vSwitch
You can control how inbound and outbound frames are handled by editing Layer 2 security policies.
Procedure
1
Log in to the VMware vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click Networking.
3
Click Properties for the vSwitch to edit.
4
In the Properties dialog box, click the Ports tab.
5
Select the vSwitch item and click Edit.
6
In the Properties dialog box, click the Security tab.
By default, Promiscuous Mode is set to Reject, and MAC Address Changes and Forged Transmits are
set to Accept.
The policy applies to all virtual adapters on the vSwitch, unless the port group for the virtual adapter
specifies a policy exception.
7
In the Policy Exceptions pane, select whether to reject or accept the security policy exceptions.
Option
Description
Promiscuous Mode - Reject
Has no effect on which frames are received by the guest adapter.
Promiscuous Mode - Accept
The guest adapter detects all frames passed on the vSwitch that are allowed
under the VLAN policy for the port group that the adapter is connected to.
MAC Address Changes - Reject
If the guest OS changes the MAC address of the adapter to anything other
than what is in the .vmx configuration file, all inbound frames are dropped.
If the guest OS changes the MAC address back to match the MAC address
in the .vmx configuration file, inbound frames are sent again.
8
MAC Address Changes - Accept
If the MAC address from the guest OS changes, frames to the new MAC
address are received.
Forged Transmits -Reject
Outbound frames with a source MAC address that is different from the one
set on the adapter are dropped.
Forged Transmits - Accept
No filtering is performed, and all outbound frames are passed.
Click OK.
Edit the Layer 2 Security Policy Exception on a Port Group
Control how inbound and outbound frames are handled by editing Layer 2 Security policies.
Procedure
1
Log in to the VMware vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click Networking.
3
Click Properties for the port group to edit.
4
In the Properties dialog box, click the Ports tab.
5
Select the port group item and click Edit.
VMware, Inc.
49
ESXi Configuration Guide
6
In the Properties dialog box for the port group, click the Security tab.
By default, Promiscuous Mode is set to Reject. MAC Address Changes and Forged Transmitsare set to
Accept.
The policy exception overrides any policy set at the vSwitch level.
7
In the Policy Exceptions pane, select whether to reject or accept the security policy exceptions.
Option
Description
Promiscuous Mode - Reject
Has no effect on which frames are received by the guest adapter.
Promiscuous Mode - Accept
The guest adapter detects all frames passed on the vSwitch that are allowed
under the VLAN policy for the port group that the adapter is connected to.
MAC Address Changes - Reject
If the guest OS changes the MAC address of the adapter to anything other
than what is in the .vmx configuration file, all inbound frames are dropped.
If the guest OS changes the MAC address back to match the MAC address
in the .vmx configuration file, inbound frames are sent again.
8
MAC Address Changes - Accept
If the MAC address from the guest OS changes, frames to the new MAC
address are received.
Forged Transmits -Reject
Outbound frames with a source MAC address that is different from the one
set on the adapter are dropped.
Forged Transmits - Accept
No filtering is performed, and all outbound frames are passed.
Click OK.
Edit the Security Policy on a dvPort Group
Control how inbound and outbound frames for a dvPort group are handled by editing the Security policies.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the dvPort group.
2
From the Inventory menu, select Network > Edit Settings.
3
In the Properties dialog box for the port group, click the Security tab.
By default, Promiscuous Mode is set to Reject. MAC Address Changes and Forged Transmitsare set to
Accept.
The policy exception overrides any policy set at the vSwitch level.
4
In the Policy Exceptions pane, select whether to reject or accept the security policy exceptions.
Option
Description
Promiscuous Mode - Reject
Has no effect on which frames are received by the guest adapter.
Promiscuous Mode - Accept
The guest adapter detects all frames passed on the vSwitch that are allowed
under the VLAN policy for the port group that the adapter is connected to.
MAC Address Changes - Reject
If the guest OS changes the MAC address of the adapter to anything other
than what is in the .vmx configuration file, all inbound frames are dropped.
If the guest OS changes the MAC address back to match the MAC address
in the .vmx configuration file, inbound frames are sent again.
5
50
MAC Address Changes - Accept
If the MAC address from the guest OS changes, frames to the new MAC
address are received.
Forged Transmits -Reject
Outbound frames with a source MAC address that is different from the one
set on the adapter are dropped.
Forged Transmits - Accept
No filtering is performed, and all outbound frames are passed.
Click OK.
VMware, Inc.
Chapter 5 Advanced Networking
Edit dvPort Security Policies
Control how inbound and outbound frames for a dvPort are handled by editing the Security policies.
Prerequisites
To edit the Security policies on an individual dvPort, the associated dvPort group must be set to allow policy
overrides.
Procedure
1
Log in to the vSphere Client and display the vNetwork Distributed Switch.
2
On the Ports tab, right-click the port to modify and select Edit Settings.
3
Click Policies.
By default, Promiscuous Mode is set to Reject, and MAC Address Changes and Forged Transmitsare
set to Accept.
4
In the Security group, select whether to reject or accept the security policy exceptions:
Option
Description
Promiscuous Mode - Reject
Has no effect on which frames are received by the guest adapter.
Promiscuous Mode - Accept
The guest adapter detects all frames passed on the vSwitch that are allowed
under the VLAN policy for the port group that the adapter is connected to.
MAC Address Changes - Reject
If the guest OS changes the MAC address of the adapter to anything other
than what is in the .vmx configuration file, all inbound frames are dropped.
If the guest OS changes the MAC address back to match the MAC address
in the .vmx configuration file, inbound frames are sent again.
5
VMware, Inc.
MAC Address Changes - Accept
If the MAC address from the guest OS changes, frames to the new MAC
address are received.
Forged Transmits -Reject
Outbound frames with a source MAC address that is different from the one
set on the adapter are dropped.
Forged Transmits - Accept
No filtering is performed, and all outbound frames are passed.
Click OK.
51
ESXi Configuration Guide
Traffic Shaping Policy
A traffic shaping policy is defined by three characteristics: average bandwidth, peak bandwidth, and burst
size. You can establish a traffic shaping policy for each port group and each dvPort or dvPort group.
ESXi shapes outbound network traffic on vSwitches and both inbound and outbound traffic on a vNetwork
Distributed Switch. Traffic shaping restricts the network bandwidth available on a port, but can also be
configured to allow “bursts” of traffic to flow through at higher speeds.
Average Bandwidth
Establishes the number of bits per second to allow across a port, averaged over
time—the allowed average load.
Peak Bandwidth
The maximum number of bits per second to allow across a port when it is
sending or receiving a burst of traffic. This tops the bandwidth used by a port
whenever it is using its burst bonus.
Burst Size
The maximum number of bytes to allow in a burst. If this parameter is set, a
port might gain a burst bonus if it does not use all its allocated bandwidth.
Whenever the port needs more bandwidth than specified by Average
Bandwidth, it might be allowed to temporarily transmit data at a higher speed
if a burst bonus is available. This parameter tops the number of bytes that have
accumulated in the burst bonus and thus transfers at a higher speed.
Edit the Traffic Shaping Policy on a vSwitch
Use traffic shaping policies to control the bandwidth and burst size on a vSwitch.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click Networking.
3
Click Properties for the vSwitch to edit.
4
In the Properties dialog box, click the Ports tab.
5
Select the vSwitch item and click Edit.
6
In the Properties dialog box, click the Traffic Shaping tab.
When traffic shaping is disabled, the options are dimmed. You can selectively override all traffic-shaping
features at the port group level if traffic shaping is enabled.
This policy is applied to each individual virtual adapter attached to the port group, not to the vSwitch as
a whole.
NOTE Peak bandwidth cannot be less than the specified average bandwidth.
52
Option
Description
Status
If you enable the policy exception in the Status field, you are setting limits
on the amount of networking bandwidth allocated for each virtual adapter
associated with this particular port group. If you disable the policy, services
have a free and clear connection to the physical network.
Average Bandwidth
A value measured over a particular period of time.
Peak Bandwidth
Limits the maximum bandwidth during a burst. It can never be smaller than
the average bandwidth.
Burst Size
Specifies how large a burst can be in kilobytes (KB).
VMware, Inc.
Chapter 5 Advanced Networking
Edit the Traffic Shaping Policy on a Port Group
Use traffic shaping policies to control the bandwidth and burst size on a port group.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click Networking.
3
Click Properties for the port group to edit.
4
In the Properties dialog box, click the Ports tab.
5
Select the port group item and click Edit.
6
In the Properties dialog box for the port group, click the Traffic Shaping tab.
When traffic shaping is disabled, the options are dimmed.
Option
Description
Status
If you enable the policy exception in the Status field, you are setting limits
on the amount of networking bandwidth allocated for each virtual adapter
associated with this particular port group. If you disable the policy, services
have a free and clear connection to the physical network.
Average Bandwidth
A value measured over a particular period of time.
Peak Bandwidth
Limits the maximum bandwidth during a burst. It can never be smaller than
the average bandwidth.
Burst Size
Specifies how large a burst can be in kilobytes (KB).
Edit the Traffic Shaping Policy on a dvPort Group
You can shape both inbound and outbound traffic on vNetwork Distributed Switches. You can restrict the
network bandwidth available to a port, but you can also temporarily allow bursts of traffic to flow through a
port at higher speeds.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the dvPort group.
2
From the Inventory menu, select Network > Edit Settings.
3
Select Traffic Shaping.
4
In the Properties dialog box for the port group, click the Traffic Shaping tab.
You can configure both inbound traffic shaping and outbound traffic shaping. When traffic shaping is
disabled, the options are dimmed.
NOTE Peak bandwidth cannot be less than the specified average bandwidth.
VMware, Inc.
Option
Description
Status
If you enable the policy exception in the Status field, you are setting limits
on the amount of networking bandwidth allocated for each virtual adapter
associated with this particular port group. If you disable the policy, services
have a free and clear connection to the physical network.
Average Bandwidth
A value measured over a particular period of time.
Peak Bandwidth
Limits the maximum bandwidth during a burst. It can never be smaller than
the average bandwidth.
Burst Size
Specifies how large a burst can be in kilobytes (KB).
53
ESXi Configuration Guide
Edit dvPort Traffic Shaping Policies
You can shape both inbound and outbound traffic on vNetwork Distributed Switches. You can restrict the
network bandwidth available to a port, but you can also temporarily allow bursts of traffic to flow through a
port at higher speeds.
A traffic shaping policy is defined by three characteristics: average bandwidth, peak bandwidth, and burst
size.
Prerequisites
To edit the traffic shaping policies on an individual dvPort, the associated dvPort group must be set to allow
policy overrides.
Procedure
1
Log in to the vSphere Client and display the vNetwork Distributed Switch.
2
On the Ports tab, right-click the port to modify, and select Edit Settings.
3
Click Policies.
4
In the Traffic Shaping group, you can configure both inbound traffic shaping and outbound traffic shaping.
When traffic shaping is disabled, the options are dimmed.
5
Option
Description
Status
If you enable the policy exception in the Status field, you are setting limits
on the amount of networking bandwidth allocated for each virtual adapter
associated with this particular port group. If you disable the policy, services
have a free and clear connection to the physical network.
Average Bandwidth
A value measured over a particular period of time.
Peak Bandwidth
Limits the maximum bandwidth during a burst. It can never be smaller than
the average bandwidth.
Burst Size
Specifies how large a burst can be in kilobytes (KB).
Click OK.
Port Blocking Policies
Set blocking policies for dvPorts from the miscellaneous policies dialog box.
Edit the Port Blocking Policy on a dvPort Group
Set the port blocking policy for a dvPort group under miscellaneous policies.
Procedure
54
1
In the vSphere Client, display the Networking inventory view and select the dvPort group.
2
From the Inventory menu, select Network > Edit Settings.
3
Select Miscellaneous.
4
Choose whether to Block all ports on this dvPort group.
VMware, Inc.
Chapter 5 Advanced Networking
Edit dvPort Port Blocking Policy
The Miscellaneous policies dialog allows you to configure port blocking policies for a dvPort.
Procedure
1
Log in to the vSphere Client and display the vNetwork Distributed Switch.
2
On the Ports tab, right-click the port to modify and select Edit Settings.
3
Click Policies.
4
In the Miscellaneous group, select whether to Block all ports.
5
Click OK.
Change the DNS and Routing Configuration
You can change the DNS server and default gateway information provided during installation from the host
configuration page in the vSphere Client.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click DNS and Routing.
3
On the right side of the window, click Properties.
4
In the DNS Configuration tab, enter a name and domain.
5
Choose whether to obtain the DNS server address automatically or use a DNS server address.
6
Specify the domains in which to look for hosts.
7
On the Routing tab, change the default gateway information as needed.
8
Click OK.
MAC Addresses
MAC addresses are generated for virtual network adapters that the service console, the VMkernel, and virtual
machines use.
In most cases, the generated MAC addresses are appropriate. However, you might need to set a MAC address
for a virtual network adapter, as in the following cases:
n
Virtual network adapters on different physical hosts share the same subnet and are assigned the same
MAC address, causing a conflict.
n
To ensure that a virtual network adapter always has the same MAC address.
To circumvent the limit of 256 virtual network adapters per physical machine and possible MAC address
conflicts between virtual machines, system administrators can manually assign MAC addresses. VMware uses
the Organizationally Unique Identifier (OUI) 00:50:56 for manually generated addresses.
The MAC address range is 00:50:56:00:00:00-00:50:56:3F:FF:FF.
You can set the addresses by adding the following line to a virtual machine‘s configuration file:
ethernet<number>.address = 00:50:56:XX:YY:ZZ
VMware, Inc.
55
ESXi Configuration Guide
where <number> refers to the number of the Ethernet adapter, XX is a valid hexadecimal number between 00
and 3F, and YY and ZZ are valid hexadecimal numbers between 00 and FF. The value for XX must not be greater
than 3F to avoid conflict with MAC addresses that are generated by the VMware Workstation and VMware
Server products. The maximum value for a manually generated MAC address is:
ethernet<number>.address = 00:50:56:3F:FF:FF
You must also set the option in a virtual machine’s configuration file:
ethernet<number>.addressType="static"
Because VMware ESXi virtual machines do not support arbitrary MAC addresses, you must use the above
format. As long as you choose a unique value for XX:YY:ZZ among your hard-coded addresses, conflicts
between the automatically assigned MAC addresses and the manually assigned ones should never occur.
MAC Address Generation
Each virtual network adapter in a virtual machine is assigned its own unique MAC address. Each network
adapter manufacturer is assigned a unique three-byte prefix called an Organizationally Unique Identifier
(OUI), which it can use to generate unique MAC addresses.
VMware has the following OUIs:
n
Generated MAC addresses
n
Manually set MAC addresses
n
For legacy virtual machines, but no longer used with ESXi
The first three bytes of the MAC address that is generated for each virtual network adapter consists of the OUI.
The MAC address-generation algorithm produces the other three bytes. The algorithm guarantees unique
MAC addresses within a machine and attempts to provide unique MAC addresses across machines.
The network adapters for each virtual machine on the same subnet should have unique MAC addresses.
Otherwise, they can behave unpredictably. The algorithm puts a limit on the number of running and suspended
virtual machines at any one time on any given host. It also does not handle all cases when virtual machines on
distinct physical machines share a subnet.
The VMware Universally Unique Identifier (UUID) generates MAC addresses that are checked for conflicts.
The generated MAC addresses are created by using three parts: the VMware OUI, the SMBIOS UUID for the
physical ESXi machine, and a hash based on the name of the entity that the MAC address is being generated
for.
After the MAC address has been generated, it does not change unless the virtual machine is moved to a different
location, for example, to a different path on the same server. The MAC address in the configuration file of the
virtual machine is saved. All MAC addresses that have been assigned to network adapters of running and
suspended virtual machines on a given physical machine are tracked.
The MAC address of a powered off virtual machine is not checked against those of running or suspended
virtual machines. It is possible that when a virtual machine is powered on again, it can acquire a different MAC
address. This acquisition is caused by a conflict with a virtual machine that was powered on when this virtual
machine was powered off.
Set Up a MAC Address
You can change a powered-down virtual machine's virtual NICs to use statically assigned MAC addresses.
Procedure
56
1
Log in to the vSphere Client and select the virtual machine from the inventory panel.
2
Click the Summary tab, and click Edit Settings.
3
Select the network adapter from the Hardware list.
VMware, Inc.
Chapter 5 Advanced Networking
4
In the MAC Address group, select Manual.
5
Enter the desired static MAC address, and click OK.
TCP Segmentation Offload and Jumbo Frames
Jumbo frames must be enabled at the host level using the command-line interface to configure the MTU size
for each vSwitch. TCP Segmentation Offload (TSO) is enabled on the VMkernel interface by default, but must
be enabled at the virtual machine level.
Enabling TSO
To enable TSO at the virtual machine level, you must replace the existing vmxnet or flexible virtual network
adapters with enhanced vmxnet virtual network adapters. This might result in a change in the MAC address
of the virtual network adapter.
TSO support through the enhanced vmxnet network adapter is available for virtual machines running the
following guest operating systems:
n
Microsoft Windows 2003 Enterprise Edition with Service Pack 2 (32 bit and 64 bit)
n
Red Hat Enterprise Linux 4 (64 bit)
n
Red Hat Enterprise Linux 5 (32 bit and 64 bit)
n
SuSE Linux Enterprise Server 10 (32 bit and 64 bit)
Enable TSO Support for a Virtual Machine
You can enable TSO support on a virtual machine by using an enhanced vmxnet adapter for that virtual
machine.
Procedure
1
Log in to the vSphere Client and select the virtual machine from the inventory panel.
2
Click the Summary tab, and click Edit Settings.
3
Select the network adapter from the Hardware list.
4
Record the network settings and MAC address that the network adapter is using.
5
Click Remove to remove the network adapter from the virtual machine.
6
Click Add.
7
Select Ethernet Adapter and click Next.
8
In the Adapter Type group, select Enhanced vmxnet.
9
Select the network setting and MAC address that the old network adapter was using and click Next.
10
Click Finish and then click OK.
11
If the virtual machine is not set to upgrade VMware Tools at each power on, you must upgrade VMware
Tools manually.
TSO is enabled on a VMkernel interface. If TSO becomes disabled for a particular VMkernel interface, the only
way to enable TSO is to delete that VMkernel interface and recreate it with TSO enabled.
Enabling Jumbo Frames
Jumbo frames allow ESXi to send larger frames out onto the physical network. The network must support
jumbo frames end-to-end.
Jumbo frames up to 9kB (9000 bytes) are supported.
VMware, Inc.
57
ESXi Configuration Guide
Jumbo frames must be enabled for each vSwitch through the remote CLI on your ESXi host and for each virtual
machine by choosing the Enhanced vmxnet network adapter in the vSphere Client. Before enabling Jumbo
frames, check with your hardware vendor to ensure that your physical network adapter supports jumbo
frames.
Create a Jumbo Frames-Enabled vSwitch
You configure a vSwitch for jumbo frames by changing the MTU size for that vSwitch.
Procedure
1
Use the vicfg-vswitch -m <MTU> <vSwitch> command in the VMware vSphere CLI to set the MTU size
for the vSwitch.
This command sets the MTU for all uplinks on that vSwitch. Set the MTU size to the largest MTU size
among all the virtual network adapters connected to the vSwitch.
2
Use the vicfg-vswitch -l command to display a list of vSwitches on the host and check that the
configuration of the vSwitch is correct.
Enable Jumbo Frames on a vNetwork Distributed Switch
You enable a vNetwork Distributed Switch for jumbo frames by changing the MTU size for that vNetwork
Distributed Switch.
Procedure
1
In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch.
2
From the Inventory menu, select Distributed Virtual Switch > Edit Settings.
3
On the Properties tab, select Advanced.
4
Set the Maximum MTU to the largest MTU size among all the virtual network adapters connected to the
vNetwork Distributed Switch, and click OK.
Enable Jumbo Frame Support on a Virtual Machine
Enabling jumbo frame support on a virtual machine requires an enhanced vmxnet adapter for that virtual
machine.
Procedure
58
1
Log in to the vSphere Client and select the virtual machine from the inventory panel.
2
Click the Summarytab, and click Edit Settings.
3
Select the network adapter from the Hardware list.
4
Record the network settings and MAC address that the network adapter is using.
5
Click Remove to remove the network adapter from the virtual machine.
6
Click Add.
7
Select Ethernet Adapter and click Next.
8
In the Adapter Type group, select Enhanced vmxnet.
9
Select the network that the old network adapter was using and click Next.
10
Click Finish.
11
Select the new network adapter from the Hardware list.
12
Under MAC Address, select Manual, and enter the MAC address that the old network adapter was using.
VMware, Inc.
Chapter 5 Advanced Networking
13
Click OK.
14
Check that the Enhanced vmxnet adapter is connected to a vSwitch with jumbo frames enabled.
15
Inside the guest operating system, configure the network adapter to allow jumbo frames.
See your guest operating system’s documentation for details.
16
Configure all physical switches and any physical or virtual machines to which this virtual machine
connects to support jumbo frames.
NetQueue and Networking Performance
NetQueue in ESXi takes advantage of the capability of some network adapters to deliver network traffic to the
system in multiple receive queues that can be processed separately. This allows processing to be scaled to
multiple CPUs, improving receive-side networking performance.
Enable NetQueue on an ESXi Host
NetQueue is enabled by default. To use NetQueue after it has been disabled, you must reenable it.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click Advanced Settings from the Software menu.
3
Select VMkernel.
4
Select VMkernel.Boot.netNetQueueEnable and click OK.
5
Use the VMware vSphere CLI to configure the NIC driver to use NetQueue.
See the VMware vSphere Command-Line Interface Installation and Reference guide.
6
Reboot the ESXi host.
Disable NetQueue on an ESXi Host
NetQueue is enabled by default.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab, and click Advanced Settings.
3
Deselect VMkernel.Boot.netNetQueueEnable and click OK.
4
To disable NetQueue on the NIC driver, use the vicfg-module -s "" [module name] command.
For example, if you are using the s2io NIC driver, use vicfg-module -s "" s2io.
For information on the VMware vSphere CLI, see the VMware vSphere Command-Line Interface Installation
and Reference guide.
5
VMware, Inc.
Reboot the host.
59
ESXi Configuration Guide
VMDirectPath Gen I
With vSphere 4, ESXi supports a direct PCI device connection for virtual machines running on Intel Nehalem
platforms. Each virtual machine can connect up to two passthrough devices.
The following features are unavailable for virtual machines configured with VMDirectPath:
n
VMotion
n
Hot adding and removing of virtual devices
n
Suspend and resume
n
Record and replay
n
Fault tolerance
n
High availability
n
DRS (limited availability; the virtual machine can be part of a cluster, but cannot migrate across hosts)
Configure Passthrough Devices on a Host
You can configure passthrough networking devices on a host.
Procedure
1
Select a host from the inventory panel of the vSphere Client.
2
On the Configuration tab, click Advanced Settings.
The Passthrough Configuration page appears, listing all available passthrough devices. A green icon
indicates that a device is enabled and active. An orange icon indicates that the state of the device has
changed and the host must be rebooted before the device can be used.
3
Click Edit.
4
Select the devices to be used for passthrough and click OK.
Configure a PCI Device on a Virtual Machine
You can configure a passthrough PCI device on a virtual machine.
Procedure
1
Select a virtual machine from the inventory panel of the vSphere Client.
2
From the Inventory menu, select Virtual Machine > Edit Settings.
3
On the Hardware tab, click Add.
4
Select PCI Device and click Next.
5
Select the passthrough device to use, and click Next.
6
Click Finish.
Adding a VMDirectPath device to a virtual machine sets memory reservation to the memory size of the virtual
machine.
60
VMware, Inc.
Networking Best Practices, Scenarios,
and Troubleshooting
6
These topics describe networking best practices and common networking configuration and troubleshooting
scenarios.
This chapter includes the following topics:
n
“Networking Best Practices,” on page 61
n
“Mounting NFS Volumes,” on page 62
n
“Troubleshooting,” on page 62
Networking Best Practices
When configuring your network, consider these best practices.
n
Separate network services from one another to achieve greater security or better performance.
To have a particular set of virtual machines function at the highest performance levels, put them on a
separate physical NIC. This separation allows for a portion of the total networking workload to be more
evenly shared across multiple CPUs. The isolated virtual machines can then better serve traffic from a
Web client, for instance.
n
Keep the VMotion connection on a separate network devoted to VMotion. When migration with VMotion
occurs, the contents of the guest operating system’s memory is transmitted over the network. You can do
this either by using VLANs to segment a single physical network or separate physical networks (the latter
is preferable).
n
When using passthrough devices with a Linux kernel version 2.6.20 or earlier, avoid MSI and MSI-X modes
because these modes have significant performance impact.
n
To physically separate network services and to dedicate a particular set of NICs to a specific network
service, create a vSwitch for each service. If this is not possible, separate them on a single vSwitch by
attaching them to port groups with different VLAN IDs. In either case, confirm with your network
administrator that the networks or VLANs you choose are isolated in the rest of your environment and
that no routers connect them.
n
You can add and remove NICs from the vSwitch without affecting the virtual machines or the network
service that is running behind that vSwitch. If you remove all the running hardware, the virtual machines
can still communicate among themselves. Moreover, if you leave one NIC intact, all the virtual machines
can still connect with the physical network.
n
To protect your most sensitive virtual machines, deploy firewalls in virtual machines that route between
virtual networks with uplinks to physical networks and pure virtual networks with no uplinks.
VMware, Inc.
61
ESXi Configuration Guide
Mounting NFS Volumes
In ESXi, the model of how ESXi accesses NFS storage of ISO images that are used as virtual CD-ROMs for
virtual machines is different from the model used in ESX Server 2.x.
ESXi has support for VMkernel-based NFS mounts. The new model is to mount your NFS volume with the
ISO images through the VMkernel NFS functionality. All NFS volumes mounted in this way appear as
datastores in the vSphere Client. The virtual machine configuration editor allows you to browse the service
console file system for ISO images to be used as virtual CD-ROM devices.
Troubleshooting
The following topics guide you through troubleshooting common networking issues that you might encounter
in an ESXi environment.
Troubleshooting Physical Switch Configuration
You might lose vSwitch connectivity when a failover or failback event occurs. This causes the MAC addresses
that the virtual machines associated with that vSwitch to appear on a different switch port.
To avoid this problem, put your physical switch in PortFast or PortFast trunk mode.
Troubleshooting Port Group Configuration
Changing the name of a port group when virtual machines are already connected to that port group causes an
invalid network configuration for the virtual machines configured to connect to that port group.
The connection from virtual network adapters to port groups is made by name, and the name is what is stored
in the virtual machine configuration. Changing the name of a port group does not cause a mass reconfiguration
of all the virtual machines connected to that port group. Virtual machines that are already powered on continue
to function until they are powered off, because their connections to the network are already established.
Avoid renaming networks after they are in use. After you rename a port group, you must reconfigure each
associated virtual machine by using the service console to reflect the new port group name.
62
VMware, Inc.
Storage
VMware, Inc.
63
ESXi Configuration Guide
64
VMware, Inc.
Introduction to Storage
7
This introduction describes available storage options for ESXi and explains how to configure your ESXi system
so that it can use and manage different types of storage.
This chapter includes the following topics:
n
“About ESXi Storage,” on page 65
n
“Types of Physical Storage,” on page 66
n
“Supported Storage Adapters,” on page 67
n
“Target and Device Representations,” on page 67
n
“About ESXi Datastores,” on page 70
n
“Comparing Types of Storage,” on page 73
n
“Viewing Storage Information in the vSphere Client,” on page 74
About ESXi Storage
ESXi storage is storage space on a variety of physical storage systems, local or networked, that a host uses to
store virtual machine disks.
A virtual machine uses a virtual hard disk to store its operating system, program files, and other data associated
with its activities. A virtual disk is a large physical file, or a set of files, that can be copied, moved, archived,
and backed up as easily as any other file. To store virtual disk files and manipulate the files, a host requires
dedicated storage space.
The host uses storage space on a variety of physical storage systems, including your host’s internal and external
devices, or networked storage, dedicated to the specific tasks of storing and protecting data.
The host can discover storage devices to which it has access and format them as datastores. The datastore is a
special logical container, analogous to a file system on a logical volume, where ESXi places virtual disk files
and other files that encapsulate essential components of a virtual machine. Deployed on different devices, the
datastores hide specifics of each storage product and provide a uniform model for storing virtual machine
files.
Using the vSphere Client, you can set up datastores on any storage device that your host discovers. In addition,
you can use folders to create logical groups of datastores for organizational purposes, and for setting
permissions and alarms across the datastore group.
VMware, Inc.
65
ESXi Configuration Guide
Types of Physical Storage
The ESXi storage management process starts with a storage space that your storage administrator preallocates
on different storage systems.
ESXi supports the following types of storage:
Local Storage
Stores virtual machine files on internal or external storage disks or arrays
attached to your host through a direct connection.
Networked Storage
Stores virtual machine files on external shared storage systems located outside
of your host. The host communicates with the networked devices through a
high-speed network.
Local Storage
Local storage can be internal hard disks located inside your ESXi host, or external storage systems located
outside and connected to the host directly.
Local storage does not require a storage network to communicate with your host. All you need is a cable
connected to the storage unit and, when required, a compatible HBA in your host.
Generally, you can connect multiple hosts to a single local storage system. The actual number of hosts you
connect varies depending on the type of storage device and topology you use.
Many local storage systems support redundant connection paths to ensure fault tolerance.
When multiple hosts connect to the local storage unit, they access storage devices in the unshared mode. The
unshared mode does not permit several hosts to access the same VMFS datastore concurrently. However, a
few SAS storage systems offer shared access to multiple hosts. This type of access permits multiple hosts to
access the same VMFS datastore on a LUN.
ESXi supports a variety of internal or external local storage devices, including SCSI, IDE, SATA, USB, and SAS
storage systems. No matter which type of storage you use, your host hides a physical storage layer from virtual
machines.
When you set up your local storage, keep in mind the following:
n
You cannot use IDE/ATA drives to store virtual machines.
n
Use local SATA storage, internal and external, in unshared mode only. SATA storage does not support
sharing the same LUNs and, therefore, the same VMFS datastore across multiple hosts.
n
Some SAS storage systems can offer shared access to the same LUNs (and, therefore, the same VMFS
datastores) to multiple hosts.
Networked Storage
Networked storage consists of external storage systems that your ESXi host uses to store virtual machine files
remotely. The host accesses these systems over a high-speed storage network.
ESXi supports the following networked storage technologies.
NOTE Accessing the same storage through different transport protocols, such as iSCSI and Fibre Channel, at
the same time is not supported.
Fibre Channel (FC)
66
Stores virtual machine files remotely on an FC storage area network (SAN). FC
SAN is a specialized high-speed network that connects your hosts to highperformance storage devices. The network uses Fibre Channel protocol to
transport SCSI traffic from virtual machines to the FC SAN devices.
VMware, Inc.
Chapter 7 Introduction to Storage
To connect to the FC SAN, your host should be equipped with Fibre Channel
host bus adapters (HBAs) and, unless you use Fibre Channel direct connect
storage, with Fibre Channel switches that help route storage traffic.
Internet SCSI (iSCSI)
Stores virtual machine files on remote iSCSI storage devices. iSCSI packages
SCSI storage traffic into the TCP/IP protocol so that it can travel through
standard TCP/IP networks instead of the specialized FC network. With an iSCSI
connection, your host serves as the initiator that communicates with a target,
located in remote iSCSI storage systems.
ESXi offers the following types of iSCSI connections:
Hardwareinitiated iSCSI
Your host connects to storage through a third-party
iSCSI HBA.
Softwareinitiated iSCSI
Your host uses a software-based iSCSI initiator in the
VMkernel to connect to storage. With this type of iSCSI
connection, your host needs only a standard network
adapter for network connectivity.
Stores virtual machine files on remote file servers accessed over a standard
TCP/IP network. The NFS client built into ESXi uses Network File System (NFS)
protocol version 3 to communicate with the NAS/NFS servers. For network
connectivity, the host requires a standard network adapter.
Network-attached
Storage (NAS)
Supported Storage Adapters
Storage adapters provide connectivity for your ESXi host to a specific storage unit or network.
Depending on the type of storage you use, you might need to install or enable a storage adapter on your host.
ESXi supports different classes of adapters, including SCSI, iSCSI, RAID, Fibre Channel, and Ethernet. ESXi
accesses the adapters directly through device drivers in the VMkernel.
Target and Device Representations
In the ESXi context, the term target identifies a single storage unit that the host can access. The terms device
and LUN describe a logical volume that represents storage space on a target. Typically, the terms device and
LUN, in the ESXi context, mean a SCSI volume presented to the host from a storage target and available for
formatting.
Different storage vendors present the storage systems to ESXi hosts in different ways. Some vendors present
a single target with multiple storage devices or LUNs on it, while others present multiple targets with one
LUN each.
Figure 7-1. Target and LUN Representations
target
LUN
LUN
storage array
LUN
target
target
target
LUN
LUN
LUN
storage array
In this illustration, three LUNs are available in each configuration. In one case, the host sees one target, but
that target has three LUNs that can be used. Each LUN represents an individual storage volume. In the other
example, the host sees three different targets, each having one LUN.
VMware, Inc.
67
ESXi Configuration Guide
Targets that are accessed through the network have unique names that are provided by the storage systems.
The iSCSI targets use iSCSI names, while Fibre Channel targets use World Wide Names (WWNs).
NOTE ESXi does not support accessing the same LUN through different transport protocols, such as iSCSI and
Fibre Channel.
A device, or LUN, is identified by its UUID name.
Understanding Fibre Channel Naming
In Fibre Channel SAN, a World Wide Name (WWN) uniquely identifies each element in the network, such as
a Fibre Channel adapter or storage device.
The WWN is a 64-bit address that consists of 16 hexadecimal numbers and might look like this:
20:00:00:e0:8b:8b:38:77 21:00:00:e0:8b:8b:38:77
The WWN is assigned to every Fibre Channel SAN element by its manufacturer.
68
VMware, Inc.
Chapter 7 Introduction to Storage
Understanding iSCSI Naming and Addressing
In an iSCSI network, each iSCSI element that uses the network has a unique and permanent iSCSI name and
is assigned an address for access.
iSCSI Name
Identifies a particular iSCSI element, regardless of its physical location. The
iSCSI name can use IQN or EUI format.
n
IQN (iSCSI qualified name). Can be up to 255 characters long and has the
following format:
iqn.yyyy-mm.naming-authority:unique name
n
yyyy-mm is the year and month when the naming authority was
established.
n
naming-authority is usually reverse syntax of the Internet domain
name of the naming authority. For example, the iscsi.vmware.com
naming authority could have the iSCSI qualified name form of iqn.
1998-01.com.vmware.iscsi. The name indicates that the vmware.com
domain name was registered in January of 1998, and iscsi is a
subdomain, maintained by vmware.com.
n
unique nameis any name you want to use, for example, the name of
your host. The naming authority must make sure that any names
assigned following the colon are unique, such as:
n
n
iqn.1998-01.com.vmware.iscsi:name1
n
iqn.1998-01.com.vmware.iscsi:name2
n
iqn.1998-01.com.vmware.iscsi:name999
EUI (extended unique identifier). Includes the eui. prefix, followed by the
16-character name. The name includes 24 bits for the company name
assigned by the IEEE and 40 bits for a unique ID, such as a serial number.
For example,
eui.0123456789ABCDEF
iSCSI Alias
A more manageable, easy-to-remember name to use instead of the iSCSI name.
iSCSI aliases are not unique, and are intended to be just a friendly name to
associate with the node.
IP Address
An address associated with each iSCSI element so that routing and switching
equipment on the network can establish the connection between different
elements, such as the host and storage. This is just like the IP address you assign
to a computer to get access to your company's network or the Internet.
VMware, Inc.
69
ESXi Configuration Guide
Understanding Storage Device Naming
In the vSphere Client, each storage device, or LUN, is identified by several names, including a friendly name,
a UUID, and a runtime name.
Name
A friendly name that the ESXi host assigns to a device based on the storage type
and manufacturer. You can modify the name using the vSphere Client. When
you modify the name of the device on one host, the change takes affect across
all hosts that have access to this device.
Identifier
A universally unique identifier assigned to a device. Depending on the type of
storage, different algorithms are used to create the identifier. The identifier is
persistent across reboots and is the same for all hosts sharing the device.
Runtime Name
The name of the first path to the device. The runtime name is created by the
host, is not a reliable identifier for the device, and is not persistent.
The runtime name has the following format: vmhba#:C#:T#:L#, where
n
vmhba# is the name of the storage adapter. The name refers to the physical
adapter on the host, not to the SCSI controller used by the virtual machines.
n
C# is the storage channel number.
Software iSCSI initiators use the channel number to show multiple paths
to the same target.
n
T# is the target number. Target numbering is decided by the host and might
change if there is a change in the mappings of targets visible to the host.
Targets that are shared by different ESXi hosts might not have the same
target number.
n
L# is the LUN number that shows the position of the LUN within the target.
The LUN number is provided by the storage system. If a target has only
one LUN, the LUN number is always zero (0).
For example, vmhba1:C0:T3:L1 represents LUN1 on target 3 accessed through
the storage adapter vmhba1 and channel 0.
About ESXi Datastores
Datastores are logical containers, analogous to file systems, that hide specifics of each storage device and
provide a uniform model for storing virtual machine files. Datastores can also be used for storing ISO images,
virtual machine templates, and floppy images.
You use the vSphere Client to access different types of storage devices that your ESXi host discovers and to
deploy datastores on them.
Depending on the type of storage you use, datastores can be backed by the following file system formats:
Virtual Machine File
System (VMFS)
High-performance file system optimized for storing virtual machines. Your
host can deploy a VMFS datastore on any SCSI-based local or networked
storage device, including Fibre Channel and iSCSI SAN equipment.
As an alternative to using the VMFS datastore, your virtual machine can have
direct access to raw devices and use a mapping file (RDM) as a proxy.
Network File System
(NFS)
70
File system on a NAS storage device. ESXi supports NFS version 3 over TCP/IP.
The host can access a designated NFS volume located on an NFS server, mount
the volume, and use it for any storage needs.
VMware, Inc.
Chapter 7 Introduction to Storage
VMFS Datastores
ESXi can format SCSI-based storage devices as VMFS datastores. VMFS datastores primarily serve as
repositories for virtual machines.
You can store multiple virtual machines on the same VMFS volume. Each virtual machine, encapsulated in a
set of files, occupies a separate single directory. For the operating system inside the virtual machine, VMFS
preserves the internal file system semantics, which ensures correct application behavior and data integrity for
applications running in virtual machines.
In addition, you can use the VMFS datastores to store other files, such as virtual machine templates and ISO
images.
VMFS supports the following file and block sizes, enabling your virtual machines to run even the most dataintensive applications, including databases, ERP, and CRM, in virtual machines:
n
Maximum virtual disk size: 2TB with 8MB block size
n
Maximum file size: 2TB with 8MB block size
n
Block size: 1MB (default), 2MB, 4MB, and 8MB
Creating and Increasing VMFS Datastores
You can set up VMFS datastores on any SCSI-based storage devices that your ESXi host discovers. After you
create the VMFS datastore, you can edit its properties.
You can have up to 256 VMFS datastores per system, with a minimum volume size of 1.2GB.
NOTE Always have only one VMFS datastore for each LUN.
If your VMFS datastore requires more space, you can increase the VMFS volume. You can dynamically add
new extents to any VMFS datastore and grow the datastore up to 64TB. An extent is a LUN or partition on a
physical storage device. The datastore can stretch over multiple extents, yet appear as a single volume.
Another option is to grow the existing datastore extent if the storage device where your datastore resides has
free space. You can grow the extent up to 2 TB.
Sharing a VMFS Volume Across ESXi Hosts
As a cluster file system, VMFS lets multiple ESXi hosts access the same VMFS datastore concurrently. You can
connect up to 32 hosts to a single VMFS volume.
Figure 7-2. Sharing a VMFS Volume Across Hosts
host
A
host
B
host
C
VM1
VM2
VM3
VMFS volume
disk1
disk2
virtual
disk
files
disk3
VMware, Inc.
71
ESXi Configuration Guide
To ensure that the same virtual machine is not accessed by multiple servers at the same time, VMFS provides
on-disk locking.
Sharing the same VMFS volume across multiple hosts offers the following advantages:
n
You can use VMware Distributed Resource Scheduling and VMware High Availability.
You can distribute virtual machines across different physical servers. That means you run a mix of virtual
machines on each server so that not all experience high demand in the same area at the same time. If a
server fails, you can restart virtual machines on another physical server. In case of a failure, the on-disk
lock for each virtual machine is released.
n
You can use vMotion to migrate running virtual machines from one physical server to another.
n
You can use VMware Consolidated Backup, which lets a proxy server, called VCB proxy, back up a
snapshot of a virtual machine while the virtual machine is powered on and is reading and writing to its
storage.
NFS Datastore
ESXi can access a designated NFS volume located on a NAS server, mount the volume, and use it for its storage
needs. You can use NFS volumes to store and boot virtual machines in the same way that you use VMFS
datastores.
ESXi supports the following shared storage capabilities on NFS volumes:
n
vMotion
n
VMware DRS and VMware HA
n
ISO images, which are presented as CD-ROMs to virtual machines
n
Virtual machine snapshots
How Virtual Machines Access Storage
When a virtual machine communicates with its virtual disk stored on a datastore, it issues SCSI commands.
Because datastores can exist on various types of physical storage, these commands are encapsulated into other
forms, depending on the protocol that the ESXi host uses to connect to a storage device.
ESXi supports Fibre Channel (FC), Internet SCSI (iSCSI), and NFS protocols. Regardless of the type of storage
device your host uses, the virtual disk always appears to the virtual machine as a mounted SCSI device. The
virtual disk hides a physical storage layer from the virtual machine’s operating system. This allows you to run
operating systems that are not certified for specific storage equipment, such as SAN, inside the virtual machine.
Figure 7-3 depicts five virtual machines using different types of storage to illustrate the differences between
each type.
72
VMware, Inc.
Chapter 7 Introduction to Storage
Figure 7-3. Virtual machines accessing different types of storage
Host
requires TCP/IP connectivity
virtual
machine
virtual
machine
virtual
machine
virtual
machine
virtual
machine
local
ethernet
SCSI
fibre
channel
HBA
VMFS
SAN
Key
software
initiator
iSCSI
hardware
initiator
ethernet
NIC
LAN
ethernet
NIC
LAN
LAN
physical
disk
datastore
virtual
disk
VMFS
VMFS
fibre array
NFS
iSCSI array
NAS appliance
NOTE This diagram is for conceptual purposes only. It is not a recommended configuration.
Comparing Types of Storage
Whether certain vSphere functionality is supported might depend on the storage technology that you use.
Table 7-1 compares networked storage technologies that ESXi supports.
Table 7-1. Networked Storage that ESXi Supports
Technology
Protocols
Transfers
Interface
Fibre Channel
FC/SCSI
Block access of data/LUN
FC HBA
iSCSI
IP/SCSI
Block access of data/LUN
n
n
NAS
IP/NFS
File (no direct LUN access)
iSCSI HBA (hardware-initiated iSCSI)
NIC (software-initiated iSCSI)
NIC
Table 7-2 compares the vSphere features that different types of storage support.
Table 7-2. vSphere Features Supported by Storage
Storage Type
Boot VM
vMotion
Datastore
RDM
VMware HA
and DRS
VCB
Local Storage
Yes
No
VMFS
No
No
Yes
Fibre Channel
Yes
Yes
VMFS
Yes
Yes
Yes
iSCSI
Yes
Yes
VMFS
Yes
Yes
Yes
NAS over NFS
Yes
Yes
NFS
No
Yes
Yes
See Setup for Failover Clustering and Microsoft Cluster Service for support information concerning Microsoft
clustering.
VMware, Inc.
73
ESXi Configuration Guide
Viewing Storage Information in the vSphere Client
The vSphere Client displays detailed information on storage adapters and devices, and any available
datastores.
Displaying Storage Adapters
The host uses storage adapters to access different storage devices. You can display the available storage
adapters and review their information.
Table 7-3 lists information that you can see when you display details for each adapter. Certain adapters, for
example iSCSI, need to be configured or enabled before you can view their information.
Table 7-3. Storage Adapter Information
Adapter Information
Description
Model
Model of the adapter.
Targets (Fibre Channel and
SCSI)
Number of targets accessed through the adapter.
Connected Targets (iSCSI)
Number of connected targets on an iSCSI adapter.
WWN (Fibre Channel)
World Wide Name formed according to Fibre Channel standards that uniquely identifies
the FC adapter.
iSCSI Name (iSCSI)
Unique name formed according to iSCSI standards that identifies the iSCSI adapter.
iSCSI Alias (iSCSI)
A friendly name used instead of the iSCSI name.
IP Address (hardware iSCSI)
Address assigned to the iSCSI adapter.
Discovery Methods (iSCSI)
Discovery methods the iSCSI adapter uses to access iSCSI targets.
Devices
All storage devices or LUNs the adapter can access.
Paths
All paths the adapter uses to access storage devices.
View Storage Adapters Information
You can display storage adapters that your host uses and review their information.
Procedure
1
In Inventory, select Hosts and Clusters.
2
Select a host and click the Configuration tab.
3
In Hardware, select Storage Adapters.
4
To view details for a specific adapter, select the adapter from the Storage Adapters list.
5
To list all storage devices the adapter can access, click Devices.
6
To list all paths the adapter uses, click Paths.
Copy Storage Adapter Identifiers to the Clipboard
If your storage adapters use unique identifiers, such as an iSCSI Name or WWN, you can copy them to a
clipboard directly from the UI.
Procedure
74
1
In Inventory, select Hosts and Clusters.
2
Select a host and click the Configuration tab.
VMware, Inc.
Chapter 7 Introduction to Storage
3
In Hardware, select Storage Adapters.
4
Select the adapter from the Storage Adapters list.
5
In the Details panel, right-click the value in the name field, and select Copy.
Viewing Storage Devices
You can display all storage devices or LUNs available to the host, including all local and networked devices.
If you use third-party multipathing plug-ins, the storage devices available through the plug-ins also appear
on the list.
For each storage adapter, you can display a separate list of storage devices available just for this adapter.
Generally, when you review a list of storage devices, you see the following information.
Table 7-4. Storage Device Information
Storage Device Information
Description
Name
A friendly name that the ESXi host assigns to the device based on the storage type and
manufacturer. You can change this name to a name of your choice.
Identifier
A universally unique identifier that is intrinsic to the device.
Runtime Name
The name of the first path to the device.
LUN
The LUN number that shows the position of the LUN within the target.
Type
Type of device, for example, disk or CD-ROM.
Transport
Transportation protocol your host uses to access the device.
Capacity
Total capacity of the storage device.
Owner
The plug-in, such as the NMP or a third-party plug-in, that the host uses to manage the
storage device.
Details for each storage device include the following:
n
A path to the storage device in the /vmfs/devices/ directory.
n
Primary and logical partitions, including a VMFS datastore, if configured.
Display Storage Devices for a Host
You can display all storage devices or LUNs available to a host. If you use any third-party multipathing plugins,
the storage devices available through the plugins also appear on the list.
Procedure
1
In Inventory, select Hosts and Clusters.
2
Select a host and click the Configuration tab.
3
In Hardware, select Storage.
4
Click Devices.
5
To view additional details about a specific device, select the device from the list.
VMware, Inc.
75
ESXi Configuration Guide
Display Storage Devices for an Adapter
You can display a list of storage devices accessible to a specific storage adapter on the host.
Procedure
1
In Inventory, select Hosts and Clusters.
2
Select a host and click the Configuration tab.
3
In Hardware, select Storage Adapters.
4
Select the adapter from the Storage Adapters list.
5
Click Devices.
Copy Storage Device Identifiers to the Clipboard
A storage device identifier is a universally unique ID assigned to a storage device or LUN. Depending on the
type of storage, different algorithms are used to create the identifier, and it can be long and complex. You can
copy the storage device identifier directly from the UI.
Procedure
1
Display a list of storage devices.
2
Right-click a device and select Copy identifier to clipboard.
Displaying Datastores
You can display all datastores available to your hosts and analyze their properties.
Datastores are added to the vSphere Client in the following ways:
n
Created on an available storage device.
n
Discovered when a host is added to the inventory. When you add a host to the inventory, the vSphere
Client displays any datastores available to the host.
If your vSphere Client is connected to a vCenter Server system, you can see datastore information in the
Datastores view. This view displays all datastores in the inventory, arranged by a datacenter. Through this
view, you can organize datastores into folder hierarchies, create new datastores, edit their properties, or remove
existing datastores.
This view is comprehensive and shows all information for your datastores including hosts and virtual machines
using the datastores, storage reporting information, permissions, alarms, tasks and events, storage topology,
and storage reports. Configuration details for each datastore on all hosts connected to this datastore are
provided on the Configuration tab of the Datastores view.
NOTE The Datastores view is not available when the vSphere client connects directly to your host. In this case,
review datastore information through the host storage configuration tab.
Generally, you can see the following datastore configuration details:
76
n
Target storage device where the datastore is located
n
File system that the datastore uses
n
Location of the datastore
n
Total capacity, including the used and available space
n
Individual extents that the datastore spans and their capacity (VMFS datastores only)
n
Paths used to access the storage device (VMFS datastores only)
VMware, Inc.
Chapter 7 Introduction to Storage
Review Datastore Properties
You can display all datastores available to the hosts and analyze their properties.
Procedure
1
Display the host in the inventory.
2
Select a host in the inventory and click the Configuration tab.
3
In Hardware, select Storage.
4
Click the Datastores view.
5
To display details for a particular datastore, select the datastore from the list.
VMware, Inc.
77
ESXi Configuration Guide
78
VMware, Inc.
Configuring ESXi Storage
8
The following topics contain information about configuring local SCSI storage devices, Fibre Channel SAN
storage, iSCSI storage, and NFS storage.
This chapter includes the following topics:
n
“Local SCSI Storage,” on page 79
n
“Fibre Channel Storage,” on page 80
n
“iSCSI Storage,” on page 80
n
“Storage Refresh and Rescan Operations,” on page 90
n
“Create VMFS Datastores,” on page 91
n
“Network Attached Storage,” on page 92
n
“Creating a Diagnostic Partition,” on page 94
Local SCSI Storage
Local storage uses a SCSI-based device such as your ESXi host’s hard disk or any external dedicated storage
system connected directly to your host.
Figure 8-1 depicts a virtual machine using local SCSI storage.
Figure 8-1. Local Storage
Host
virtual
machine
local
ethernet
SCSI
VMFS
In this example of a local storage topology, the ESXi host uses a single connection to plug into a disk. On that
disk, you can create a VMFS datastore, which you use to store virtual machine disk files.
VMware, Inc.
79
ESXi Configuration Guide
Although this storage configuration is possible, it is not a recommended topology. Using single connections
between storage arrays and hosts creates single points of failure (SPOF) that can cause interruptions when a
connection becomes unreliable or fails.
To ensure fault tolerance, some DAS systems support redundant connection paths.
Fibre Channel Storage
ESXi supports Fibre Channel adapters, which allow a host to connect to a SAN and see storage devices on the
SAN.
You must install Fibre Channel (FC) adapters before the host can display FC storage devices.
Figure 8-2 depicts virtual machines using Fibre Channel storage.
Figure 8-2. Fibre Channel Storage
Host
virtual
machine
fibre
channel
HBA
SAN
VMFS
fibre array
In this configuration, an ESXi host connects to SAN fabric, which consists of Fibre Channel switches and storage
arrays, using a Fibre Channel adapter. LUNs from a storage array become available to the host. You can access
the LUNs and create a datastore for your storage needs. The datastore uses the VMFS format.
For specific information on setting up the FC SAN fabric and storage arrays to work with ESXi, see the Fibre
Channel SAN Configuration Guide.
iSCSI Storage
ESXi supports iSCSI technology that allows your host to use an IP network while accessing remote storage.
With iSCSI, SCSI storage commands that your virtual machine issues to its virtual disk are converted into
TCP/IP packets and transmitted to a remote device, or target, that stores the virtual disk.
To access remote targets, the host uses iSCSI initiators. Initiators transport SCSI requests and responses between
the host and the target storage device on the IP network. ESXi supports hardware-based and software-based
iSCSI initiators.
You must configure iSCSI initiators for the host to access and display iSCSI storage devices.
Figure 8-3 depicts two virtual machines that use different types of iSCSI initiators.
80
VMware, Inc.
Chapter 8 Configuring ESXi Storage
Figure 8-3. iSCSI Storage
Host
virtual
machine
virtual
machine
software
initiator
iSCSI
hardware
initiator
ethernet
NIC
LAN
LAN
VMFS
iSCSI array
In the left example, the host uses the hardware iSCSI adapter to connect to the iSCSI storage system.
In the right example, the host is configured with the software iSCSI initiator. Using the software initiator, the
host connects to the iSCSI storage through an existing network adapter.
iSCSI storage devices from the storage system become available to the host. You can access the storage devices
and create VMFS datastores for your storage needs.
For specific information on setting up the iSCSI SAN fabric to work with ESXi, see the iSCSI SAN Configuration
Guide.
Setting Up Hardware iSCSI Initiators
With hardware-based iSCSI storage, you use a specialized third-party adapter capable of accessing iSCSI
storage over TCP/IP. This iSCSI initiator handles all iSCSI and network processing and management for your
ESXi system.
You must install and configure the hardware iSCSI adapter for your host to be able to access the iSCSI storage
device. For installation information, see vendor documentation.
View Hardware iSCSI Initiators
View an iSCSI hardware initiator to verify that it is correctly installed and ready for configuration.
Prerequisites
Before you begin configuring the hardware iSCSI initiator, make sure that the iSCSI HBA is successfully
installed and appears on the list of initiators available for configuration. If the initiator is installed, you can
view its properties.
Procedure
1
Log in to the vSphere Client, and select a host from the inventory panel.
2
Click the Configuration tab and click Storage Adapters in the Hardware panel.
The hardware iSCSI initiator appears in the list of storage adapters.
VMware, Inc.
81
ESXi Configuration Guide
3
Select the initiator to view.
The default details for the initiator appear, including the model, iSCSI name, iSCSI alias, IP address, and
target and paths information.
4
Click Properties.
The iSCSI Initiator Properties dialog box appears. The General tab displays additional characteristics of
the initiator.
You can now configure your hardware initiator or change its default characteristics.
Change Name and IP Address for Hardware Initiators
When you configure your hardware iSCSI initiators, make sure that their names and IP addresses are formatted
properly.
Procedure
1
Log in to the vSphere Client, and select a host from the inventory panel.
2
Click the Configuration tab and click Storage Adapters in the Hardware panel.
3
Select the initiator to configure and click Properties > Configure.
4
To change the default iSCSI name for your initiator, enter the new name.
Make sure the name you enter is worldwide unique and properly formatted or some storage devices might
not recognize the hardware iSCSI initiator.
5
(Optional) Enter the iSCSI alias.
The alias is a name that you use to identify the hardware iSCSI initiator.
6
Change the default IP settings.
You must change the default IP settings so that they are configured properly for the IP SAN. Work with
your network administrator to determine the IP setting for the HBA.
7
Click OK to save your changes.
If you change the iSCSI name, it is used for new iSCSI sessions. For existing sessions, new settings are not used
until logout and re-login.
Setting Up Software iSCSI Initiators
With the software-based iSCSI implementation, you can use standard network adapters to connect your
ESXi host to a remote iSCSI target on the IP network. The software iSCSI initiator that is built into ESXi facilitates
this connection by communicating with the network adapter through the network stack.
Before you configure the software iSCSI initiator, you must perform the following tasks:
1
Create a VMkernel port for physical network adapters.
2
Enable the software iSCSI initiator.
3
If you use multiple network adapters, activate multipathing on your host using the port binding technique.
For more information on port binding, see the iSCSI SAN Configuration Guide.
4
If needed, enable Jumbo Frames. Jumbo Frames must be enabled for each vSwitch through the vSphere
CLI. Also, if you use an ESX host, you must create a VMkernel network interface enabled with Jumbo
Frames.
See the Networking section for more information.
82
VMware, Inc.
Chapter 8 Configuring ESXi Storage
Networking Configuration for Software iSCSI Storage
Networking configuration for software iSCSI involves creating an iSCSI VMkernel port and mapping it to a
physical NIC that handles iSCSI traffic.
Depending on the number of physical NICs you use for iSCSI traffic, the networking setup can be different:
n
If you have one physical NIC, create one VMkernel port on a vSwitch and map the port to the NIC. VMware
recommends that you designate a separate network adapter entirely for iSCSI. No additional network
configuration steps are required.
For information on creating a port, see “Create a VMkernel Port for Software iSCSI,” on page 83.
n
If you have two or more physical NICs for iSCSI, you can create multiple paths for the software iSCSI by
using the port binding technique.
For more information on port binding, see the iSCSI SAN Configuration Guide.
Create a VMkernel Port for Software iSCSI
This procedure lets you connect the VMkernel, which runs services for iSCSI storage, to the physical network
adapter.
Procedure
1
Log in to the vSphere Client and select the host from the inventory panel.
2
Click the Configuration tab and click Networking.
3
In the Virtual Switch view, click Add Networking.
4
Select VMkernel and click Next.
5
Select Create a virtual switchto create a new vSwitch.
If no adapters appear under Create a virtual switch, existing vSwitches are using all of the network
adapters in the system. You can use an existing vSwitch for your iSCSI traffic.
6
Select an adapter you want to use for iSCSI traffic.
IMPORTANT Do not use iSCSI on 100Mbps or slower adapters.
7
Click Next.
8
Under Port Group Properties, enter a network label. Network label is a friendly name that identifies the
VMkernel port that you are creating.
9
Click Next.
10
Specify the IP settings and click Next.
11
Review the information and click Finish.
What to do next
You can now enable your software initiator.
VMware, Inc.
83
ESXi Configuration Guide
Enable the Software iSCSI Initiator
You must enable your software iSCSI initiator so that ESXi can use it to access iSCSI storage.
Procedure
1
Log in to the vSphere Client, and select a server from the inventory panel.
2
Click the Configuration tab and click Storage Adapters in the Hardware panel.
The list of available storage adapters appears.
3
Select the iSCSI initiator to configure and click Properties.
4
Click Configure.
The General Properties dialog box displays the initiator’s status, default name, and alias.
5
To enable the initiator, select Enabled.
6
To change the default iSCSI name for your initiator, enter the new name.
Make sure the name you enter is worldwide unique and properly formatted or some storage devices might
not recognize the software iSCSI initiator.
7
Click OK to save your changes.
If you change the iSCSI name, it is used for new iSCSI sessions. For existing sessions, new settings are not used
until you logout and re-login.
Configuring Discovery Addresses for iSCSI Initiators
Set up target discovery addresses so that the iSCSI initiator can determine which storage resource on the
network is available for access.
The ESXi system supports these discovery methods:
Dynamic Discovery
Also known as Send Targets discovery. Each time the initiator contacts a
specified iSCSI server, the initiator sends the Send Targets request to the server.
The server responds by supplying a list of available targets to the initiator. The
names and IP addresses of these targets appear on the Static Discovery tab. If
you remove a static target added by dynamic discovery, the target might be
returned to the list the next time a rescan happens, the HBA is reset, or the host
is rebooted.
Static Discovery
The initiator does not have to perform any discovery. The initiator has a list of
targets it can contact and uses their IP addresses and target names to
communicate with them.
Set Up Dynamic Discovery
With Dynamic Discovery, each time the initiator contacts a specified iSCSI server, it sends the Send Targets
request to the server. The server responds by supplying a list of available targets to the initiator.
Procedure
1
Log in to the vSphere Client and select a server from the inventory panel.
2
Click the Configuration tab and click Storage Adapters in the Hardware panel.
The list of available storage adapters appears.
3
84
Select the iSCSI initiator to configure and click Properties.
VMware, Inc.
Chapter 8 Configuring ESXi Storage
4
In the iSCSI Initiator Properties dialog box, click the Dynamic Discovery tab.
5
To add an address for the Send Targets discovery, click Add.
The Add Send Targets Server dialog box appears.
6
Enter the IP address or DNS name of the storage system and click OK.
After your host establishes the Send Targets session with this system, any newly discovered targets appear
in the Static Discovery list.
7
To delete a specific Send Targets server, select it and click Remove.
After you remove a Send Targets server, it might still appear in the Inheritance field as the parent of static
targets. This entry indicates where the static targets were discovered and does not affect the functionality.
NOTE You cannot change the IP address, DNS name, or port number of an existing Send Targets server. To
make changes, delete the existing server and add a new one.
Set Up Static Discovery
With iSCSI initiators, in addition to the dynamic discovery method, you can use static discovery and manually
enter information for the targets.
Procedure
1
Log in to the vSphere Client and select a server from the inventory panel.
2
Click the Configuration tab and click Storage Adapters in the Hardware panel.
The list of available storage adapters appears.
3
Select the iSCSI initiator to configure and click Properties.
4
In the iSCSI Initiator Properties dialog box, click the Static Discovery tab.
The tab displays all dynamically discovered targets and any static targets already entered.
5
To add a target, click Add and enter the target’s information.
6
To delete a specific target, select the target and click Remove.
NOTE You cannot change the IP address, DNS name, iSCSI target name, or port number of an existing target.
To make changes, remove the existing target and add a new one.
Configuring CHAP Parameters for iSCSI Initiators
Because the IP networks that the iSCSI technology uses to connect to remote targets do not protect the data
they transport, you must ensure security of the connection. One of the protocols that iSCSI implements is the
Challenge Handshake Authentication Protocol (CHAP), which verifies the legitimacy of initiators that access
targets on the network.
CHAP uses a three-way handshake algorithm to verify the identity of your host and, if applicable, of the iSCSI
target when the host and target establish a connection. The verification is based on a predefined private value,
or CHAP secret, that the initiator and target share.
ESXi supports CHAP authentication at the adapter level. In this case, all targets receive the same CHAP name
and secret from the iSCSI initiator. For software iSCSI, ESXi also supports per-target CHAP authentication,
which allows you to configure different credentials for each target to achieve greater level of security.
VMware, Inc.
85
ESXi Configuration Guide
Choosing CHAP Authentication Method
ESXi supports one-way CHAP for both hardware and software iSCSI, and mutual CHAP for software iSCSI
only.
Before configuring CHAP, check whether CHAP is enabled at the iSCSI storage system and check the CHAP
authentication method the system supports. If CHAP is enabled, enable it for your initiators, making sure that
the CHAP authentication credentials match the credentials on the iSCSI storage.
ESXi supports the following CHAP authentication methods:
One-way CHAP
In one-way, or unidirectional, CHAP authentication, the target authenticates
the initiator, but the initiator does not authenticate the target.
Mutual CHAP (software
iSCSI only)
In mutual, or bidirectional, CHAP authentication, an additional level of
security enables the initiator to authenticate the target.
For software iSCSI only, you can set one-way CHAP and mutual CHAP for each initiator or at the target level.
Hardware iSCSI supports CHAP only at the initiator level.
When you set the CHAP parameters, specify a security level for CHAP.
Table 8-1. CHAP Security Level
CHAP Security Level
Description
Supported
Do not use CHAP
The host does not use CHAP authentication. Select this
option to disable authentication if it is currently enabled.
Software iSCSI
Hardware iSCSI
Do not use CHAP unless
required by target
The host prefers a non-CHAP connection, but can use a
CHAP connection if required by the target.
Software iSCSI
Use CHAP unless prohibited by
target
The host prefers CHAP, but can use non-CHAP
connections if the target does not support CHAP.
Software iSCSI
Hardware iSCSI
Use CHAP
The host requires successful CHAP authentication. The
connection fails if CHAP negotiation fails.
Software iSCSI
Set Up CHAP Credentials for an iSCSI Initiator
For increased security, you can set up all targets to receive the same CHAP name and secret from the iSCSI
initiator at the initiator level. By default, all discovery addresses or static targets inherit CHAP parameters that
you set up at the initiator level.
Prerequisites
Before setting up CHAP parameters for software iSCSI, determine whether to configure one-way or mutual
CHAP. Hardware iSCSI does not support mutual CHAP.
n
In one-way CHAP, the target authenticates the initiator.
n
In mutual CHAP, both the target and initiator authenticate each other. Make sure to use different secrets
for CHAP and mutual CHAP.
When configuring CHAP parameters, make sure that they match the parameters on the storage side.
For software iSCSI, the CHAP name should not exceed 511 and the CHAP secret 255 alphanumeric characters.
For hardware iSCSI, the CHAP name should not exceed 255 and the CHAP secret 100 alphanumeric characters.
86
VMware, Inc.
Chapter 8 Configuring ESXi Storage
Procedure
1
Log in to the vSphere Client and select a server from the inventory panel.
2
Click the Configuration tab and click Storage Adapters in the Hardware panel.
The list of available storage adapters appears.
3
Select the iSCSI initiator to configure and click Properties.
4
On the General tab, click CHAP.
5
To configure one-way CHAP, under CHAP specify the following.
a
b
Select one of the following options:
n
Do not use CHAP unless required by target (software iSCSI only)
n
Use CHAP unless prohibited by target
n
Use CHAP (software iSCSI only). To be able to configure mutual CHAP, you must select this
option.
Specify the CHAP name.
Make sure that the name you specify matches the name configured on the storage side.
c
6
n
To set the CHAP name to the iSCSI initiator name, select Use initiator name.
n
To set the CHAP name to anything other than the iSCSI initiator name, deselect Use initiator
name and enter a name in the Name field.
Enter a one-way CHAP secret to be used as part of authentication. Make sure to use the same secret
that you enter on the storage side.
To configure mutual CHAP, first configure one-way CHAP by following directions in Step 5.
Make sure to select Use CHAP as an option for one-way CHAP. Then, specify the following under Mutual
CHAP:
a
Select Use CHAP.
b
Specify the mutual CHAP name.
c
Enter the mutual CHAP secret. Make sure to use different secrets for the one-way CHAP and mutual
CHAP.
7
Click OK.
8
Rescan the initiator.
If you change the CHAP or mutual CHAP parameters, they are used for new iSCSI sessions. For existing
sessions, new settings are not used until you log out and login again.
Set Up CHAP Credentials for a Target
For software iSCSI, you can configure different CHAP credentials for each discovery address or static target.
When configuring CHAP parameters, make sure that they match the parameters on the storage side. For
software iSCSI, the CHAP name should not exceed 511 and the CHAP secret 255 alphanumeric characters.
VMware, Inc.
87
ESXi Configuration Guide
Prerequisites
Before setting up CHAP parameters for software iSCSI, determine whether to configure one-way or mutual
CHAP.
n
In one-way CHAP, the target authenticates the initiator.
n
In mutual CHAP, both the target and initiator authenticate each other. Make sure to use different secrets
for CHAP and mutual CHAP.
Procedure
1
Log in to the vSphere Client and select a server from the inventory panel.
2
Click the Configuration tab and click Storage Adapters in the Hardware panel.
The list of available storage adapters appears.
3
Select the software iSCSI initiator to configure and click Properties.
4
Select either Dynamic Discovery tab or Static Discovery tab.
5
From the list of available targets, select a target you want to configure and click Settings > CHAP.
6
To configure one-way CHAP, under CHAP specify the following.
a
Deselect Inherit from parent.
b
Select one of the following options:
c
n
Do not use CHAP unless required by target
n
Use CHAP unless prohibited by target
n
Use CHAP. To be able to configure mutual CHAP, you must select this option.
Specify the CHAP name.
Make sure that the name you specify matches the name configured on the storage side.
d
7
n
To set the CHAP name to the iSCSI initiator name, select Use initiator name.
n
To set the CHAP name to anything other than the iSCSI initiator name, deselect Use initiator
name and enter a name in the Name field.
Enter a one-way CHAP secret to be used as part of authentication. Make sure to use the same secret
that you enter on the storage side.
To configure mutual CHAP, first configure one-way CHAP by following directions in Step 6.
Make sure to select Use CHAP as an option for one-way CHAP. Then, specify the following under Mutual
CHAP:
a
Deselect Inherit from parent.
b
Select Use CHAP.
c
Specify the mutual CHAP name.
d
Enter the mutual CHAP secret. Make sure to use different secrets for the one-way CHAP and mutual
CHAP.
8
Click OK.
9
Rescan the initiator.
If you change the CHAP or mutual CHAP parameters, they are used for new iSCSI sessions. For existing
sessions, new settings are not used until you log out and login again.
88
VMware, Inc.
Chapter 8 Configuring ESXi Storage
Disable CHAP
You can disable CHAP if your storage system does not require it.
If you disable CHAP on a system that requires CHAP authentication, existing iSCSI sessions remain active
until you reboot your ESXi host or the storage system forces a logout. After the session ends, you can no longer
connect to targets that require CHAP.
Procedure
1
Open the CHAP Credentials dialog box.
2
For software iSCSI, to disable just the mutual CHAP, select Do not use CHAP under Mutual CHAP.
3
To disable one-way CHAP, select Do not use CHAP under CHAP.
The mutual CHAP, if set up, automatically turns to Do not use CHAP when you disable the one-way
CHAP.
4
Click OK.
Configuring Additional Parameters for iSCSI
You might need to configure additional parameters for your iSCSI initiators. For example, some iSCSI storage
systems require ARP (Address Resolution Protocol) redirection to move iSCSI traffic dynamically from one
port to another. In this case, you must activate ARP redirection on your host.
Do not make any changes to the advanced iSCSI settings unless you are working with the VMware support
team or otherwise have thorough information about the values to provide for the settings.
Table 8-2 lists advanced iSCSI parameters that you can configure using the vSphere Client. In addition, you
can use the vicfg-iscsi vSphere CLI command to configure some of the advanced parameters. For
information, see the VMware vSphere Command-Line Interface Installation and Reference Guide.
Table 8-2. Additional Parameters for iSCSI Initiators
Advanced Parameter
Description
Configurable On
Header Digest
Increases data integrity. When header digest is enabled, the system
performs a checksum over each iSCSI Protocol Data Unit’s (PDU’s)
header part and verifies using the CRC32C algorithm.
Software iSCSI
Data Digest
Increases data integrity. When data digest is enabled, the system
performs a checksum over each PDU's data part and verifies using
the CRC32C algorithm.
NOTE Systems that use Intel Nehalem processors offload the iSCSI
digest calculations for software iSCSI, thus reducing the impact on
performance.
Software iSCSI
Maximum
Outstanding R2T
Defines the R2T (Ready to Transfer) PDUs that can be in transition
before an acknowledge PDU is received.
Software iSCSI
First Burst Length
Specifies the maximum amount of unsolicited data an iSCSI initiator
can send to the target during the execution of a single SCSI command,
in bytes.
Software iSCSI
Maximum Burst
Length
Maximum SCSI data payload in a Data-In or a solicited Data-Out
iSCSI sequence, in bytes.
Software iSCSI
Maximum Receive
Data Segment Length
Maximum data segment length, in bytes, that can be received in an
iSCSI PDU.
Software iSCSI
VMware, Inc.
89
ESXi Configuration Guide
Table 8-2. Additional Parameters for iSCSI Initiators (Continued)
Advanced Parameter
Description
Configurable On
ARP Redirect
Allows storage systems to move iSCSI traffic dynamically from one
port to another. ARP is required by storage systems that do arraybased failover.
Hardware iSCSI
Allows systems to delay acknowledgment of received data packets.
Software iSCSI
Delayed ACK
(Configurable through
vSphere CLI)
Configure Advanced Parameters for iSCSI
The advanced iSCSI settings control such parameters as header and data digest, ARP redirection, delayed ACK,
and so on. Generally, you do not need to change these settings because your ESXi host works with the assigned
predefined values.
CAUTION Do not make any changes to the advanced iSCSI settings unless you are working with the VMware
support team or otherwise have thorough information about the values to provide for the settings.
Procedure
1
Log in to the vSphere Client, and select a host from the inventory panel.
2
Click Configuration tab and click Storage Adapters.
3
Select the iSCSI initiator to configure and click Properties.
4
To configure advanced parameters at the initiator level, on the General tab, click Advanced. Proceed to
Step 6.
5
Configure advanced parameters at the target level.
At the target level, advanced parpameters can be configured only for software iSCSI.
6
a
Select either the Dynamic Discovery tab or Static Discovery tab.
b
From the list of available targets, select a target to configure and click Settings > Advanced.
Enter any required values for the advanced parameters you want to modify and click OK to save your
changes.
Storage Refresh and Rescan Operations
The refresh operation updates the datastore lists and storage information, such as the datastore capacity,
displayed in the vSphere Client. When you make changes in your ESXi host or SAN configuration, you need
to use the rescan operation.
You can rescan all adapters on your host. If the changes you make are isolated to a specific adapter, rescan
only this adapter. If your vSphere Client is connected to a vCenter Server system, you can rescan adapters on
all hosts managed by the vCenter Server system.
Perform a rescan each time you make one of the following changes.
90
n
Create new LUNs on a SAN.
n
Change the path masking on a host.
VMware, Inc.
Chapter 8 Configuring ESXi Storage
n
Reconnect a cable.
n
Make a change to a host in a cluster.
IMPORTANT Do not rescan when a path is unavailable. If one path fails, another takes over and your system
continues to be fully functional. If, however, you rescan at a time when a path is not available, the host removes
the path from its list of paths to the device. The path cannot be used by the host until the next time a rescan is
performed while the path is active.
Rescan Storage Adapters
When you make changes in your ESXi host or SAN configuration, you might need to rescan your storage
adapters. You can rescan all adapters on your host. If the changes you make are isolated to a specific adapter,
rescan only this adapter.
Use this procedure if you want to limit the rescan to a particular host or an adapter on the host. If you want to
rescan adapters on all hosts managed by your vCenter Server system, you can do so by right-clicking a
datacenter, cluster, or folder that contains the hosts and selecting Rescan for Datastores.
Procedure
1
In the vSphere Client, select a host and click the Configuration tab.
2
In the Hardware panel, select Storage Adapters, and click Rescan above the Storage Adapters panel.
You can also right-click an individual adapter and click Rescan to rescan just that adapter.
IMPORTANT On ESXi, it is not possible to rescan a single storage adapter. If you rescan a single adapter,
all adapters are rescanned.
3
To discover new disks or LUNs, select Scan for New Storage Devices.
If new LUNs are discovered, they appear in the device list.
4
To discover new datastores or update a datastore after its configuration has been changed, select Scan for
New VMFS Volumes.
If new datastores or VMFS volumes are discovered, they appear in the datastore list.
Create VMFS Datastores
VMFS datastores serve as repositories for virtual machines. You can set up VMFS datastores on any SCSI-based
storage devices that the host discovers.
Prerequisites
Before creating datastores, you must install and configure any adapters that your storage requires. Rescan the
adapters to discover newly added storage devices.
Procedure
1
Log in to the vSphere Client and select the host from the Inventory panel.
2
Click the Configuration tab and click Storage in the Hardware panel.
3
Click Datastores and click Add Storage.
4
Select the Disk/LUN storage type and click Next.
VMware, Inc.
91
ESXi Configuration Guide
5
Select a device to use for your datastore and click Next.
NOTE Select the device that does not have a datastore name displayed in the VMFS Label column. If a
name is present, the device contains a copy of an existing VMFS datastore.
If the disk you are formatting is blank, the Current Disk Layout page automatically presents the entire
disk space for storage configuration.
6
If the disk is not blank, review the current disk layout in the top panel of the Current Disk Layout page
and select a configuration option from the bottom panel.
Option
Description
Use all available partitions
Dedicates the entire disk or LUN to a single VMFS datastore. If you select
this option, all file systems and data currently stored on this device is
destroyed.
Use free space
Deploys a VMFS datastore in the remaining free space of the disk.
7
Click Next.
8
In the Properties page, enter a datastore name and click Next.
9
If needed, adjust the file system and capacity values.
By default, the entire free space on the storage device is available.
10
Click Next.
11
In the Ready to Complete page, review the datastore configuration information and click Finish.
A datastore on the SCSI-based storage device is created. If you use the vCenter Server system to manage your
hosts, the newly created datastore is automatically added to all hosts.
Network Attached Storage
ESXi supports using NAS through the NFS protocol. The NFS protocol enables communication between an
NFS client and an NFS server.
The NFS client built into ESXi lets you access the NFS server and use NFS volumes for storage. ESXi supports
only NFS Version 3 over TCP.
You use the vSphere Client to configure NFS volumes as datastores. Configured NFS datastores appear in the
vSphere Client, and you can use them to store virtual disk files in the same way that you use VMFS-based
datastores.
NOTE ESXi does not support the delegate user functionality that enables access to NFS volumes using nonroot credentials.
Figure 8-4 depicts a virtual machine using the NFS volume to store its files. In this configuration, the host
connects to the NFS server, which stores the virtual disk files, through a regular network adapter.
92
VMware, Inc.
Chapter 8 Configuring ESXi Storage
Figure 8-4. NFS Storage
Host
virtual
machine
ethernet
NIC
LAN
NFS
NAS appliance
The virtual disks that you create on NFS-based datastores use a disk format dictated by the NFS server, typically
a thin format that requires on-demand space allocation. If the virtual machine runs out of space while writing
to this disk, the vSphere Client notifies you that more space is needed. You have the following options:
n
Free up additional space on the volume so that the virtual machine continues writing to the disk.
n
Terminate the virtual machine session. Terminating the session shuts down the virtual machine.
CAUTION When your host accesses a virtual machine disk file on an NFS-based datastore, a .lck-XXX lock file
is generated in the same directory where the disk file resides to prevent other hosts from accessing this virtual
disk file. Do not remove the .lck-XXX lock file, because without it, the running virtual machine cannot access
its virtual disk file.
NFS Datastores as Repositories for Commonly Used Files
In addition to storing virtual disks on NFS datastores, you can also use NFS as a central repository for ISO
images, virtual machine templates, and so on.
To use NFS as a shared repository, you create a directory on the NFS server and then mount it as a datastore
on all hosts. If you use the datastore for ISO images, you can connect the virtual machine's CD-ROM device to
an ISO file on the datastore and install a guest operating system from the ISO file.
For information on configuring virtual machines, see Basic System Administration.
NOTE If the underlying NFS volume, on which the files are stored, is read-only, make sure that the volume is
exported as a read-only share by the NFS server, or configure it as a read-only datastore on the ESXi host.
Otherwise, the host considers the datastore to be read-write and might not be able to open the files.
VMware, Inc.
93
ESXi Configuration Guide
Create an NFS-Based Datastore
You can use the Add Storage wizard to mount an NFS volume and use it as if it were a VMFS datastore.
Prerequisites
Because NFS requires network connectivity to access data stored on remote servers, before configuring NFS,
you must first configure VMkernel networking.
Procedure
1
Log in to the vSphere Client and select the host from the Inventory panel.
2
Click the Configuration tab and click Storage in the Hardware panel.
3
Click Datastores and click Add Storage.
4
Select Network File System as the storage type and click Next.
5
Enter the server name, the mount point folder name, and the datastore name.
NOTE When you mount the same NFS volume on different hosts, make sure that the server and folder
names are identical across the hosts. If the names do not match exactly, for example, if you enter share as
the folder name on one host and /share on the other, the hosts see the same NFS volume as two different
datastores. This might result in a failure of such features as vMotion.
6
(Optional) Select Mount NFS read only if the volume is exported as read only by the NFS server.
7
Click Next.
8
In the Network File System Summary page, review the configuration options and click Finish.
Creating a Diagnostic Partition
To run successfully, your host must have a diagnostic partition or a dump partition to store core dumps for
debugging and technical support. You can create the diagnostic partition on a local disk or on a private or
shared SAN LUN.
A diagnostic partition cannot be located on an iSCSI LUN accessed through a software iSCSI initiator.
Each host must have a diagnostic partition of 100MB. If multiple hosts share a SAN, configure a diagnostic
partition with 100MB for each host.
CAUTION If two hosts that share a diagnostic partition fail and save core dumps to the same slot, the core
dumps might be lost. To collect core dump data, reboot a host and extract log files immediately after the host
fails. However, if another host fails before you collect the diagnostic data of the first host, the second host will
fail to save the core dump.
Create a Diagnostic Partition
You can create a diagnostic partition on your host.
Procedure
94
1
Log in to the vSphere Client and select the host from the Inventory panel.
2
Click the Configuration tab and click Storage in the Hardware panel.
3
Click Datastores and click Add Storage.
VMware, Inc.
Chapter 8 Configuring ESXi Storage
4
Select Diagnosticand click Next.
If you do not see Diagnostic as an option, the host already has a diagnostic partition.
You can query and scan the host’s diagnostic partition using the vicfg-dumppart -l command on the
vSphere CLI.
5
Specify the type of diagnostic partition.
Option
Description
Private Local
Creates the diagnostic partition on a local disk. This partition stores fault
information only for your host.
Private SAN Storage
Creates the diagnostic partition on a non-shared SAN LUN. This partition
stores fault information only for your host.
Shared SAN Storage
Creates the diagnostic partition on a shared SAN LUN. This partition is
accessed by multiple hosts and can store fault information for more than one
host.
6
Click Next.
7
Select the device to use for the diagnostic partition and click Next.
8
Review the partition configuration information and click Finish.
VMware, Inc.
95
ESXi Configuration Guide
96
VMware, Inc.
Managing Storage
9
After you create datastores, you can change their properties, use folders to group datastores based on your
business needs, or delete unused datastores. You might also need to set up multipathing for your storage or
resignature datastore copies.
This chapter includes the following topics:
n
“Managing Datastores,” on page 97
n
“Changing VMFS Datastore Properties,” on page 99
n
“Managing Duplicate VMFS Datastores,” on page 101
n
“Using Multipathing with ESXi,” on page 103
n
“Thin Provisioning,” on page 112
n
“Turn Off vCenter Server Storage Filters,” on page 115
Managing Datastores
An ESXi system uses datastores to store all files associated with its virtual machines. After you create datastores,
you can manage them by performing a number of tasks.
A datastore is a logical storage unit that can use disk space on one physical device, one disk partition, or span
several physical devices. The datastore can exist on different types of physical devices, including SCSI, iSCSI,
Fibre Channel SAN, or NFS.
Datastores are added to the vSphere Client in one of the following ways:
n
Created by default when the ESXi host is booted for the first time. The software formats any visible blank
local disks or partitions with VMFS datastores so that you can create virtual machines on the datastores.
n
Discovered when a host is added to the inventory. The vSphere Client displays any datastores that the
host can recognize.
n
Created on an available storage device using the Add Storage command.
After the datastores are created, you can use them to store virtual machine files. You can manage them by
renaming, removing, and setting access control permissions. In addition, you can group datastores to organize
them and set the same permissions across the group at one time.
For information on setting access control permissions on a datastore, see the vSphere Client Help.
VMware, Inc.
97
ESXi Configuration Guide
Rename Datastores
You can change the name of an existing datastore.
Procedure
1
Display the datastores.
2
Right-click the datastore to rename and select Rename.
3
Type a new datastore name.
If you use the vCenter Server system to manage your hosts, the new name appears on all hosts that have access
to the datastore.
Group Datastores
If you use the vCenter Server system to manage your hosts, group datastores into folders. This allows you to
organize your datastores according to business practices and to assign the same permissions and alarms on
the datastores in the group at one time.
Procedure
1
Log in to the vSphere Client.
2
If necessary, create the datastores.
For details, see the vSphere Client Help.
3
In the Inventory panel, choose Datastores.
4
Select the datacenter containing the datastores to group.
5
In the shortcut menu, click the New Folder icon.
6
Give the folder a descriptive name.
7
Click and drag each datastore onto the folder.
Delete Datastores
You can delete any type of VMFS datastore, including copies that you have mounted without resignaturing.
When you delete a datastore, it is destroyed and disappears from all hosts that have access to the datastore.
Prerequisites
Before deleting a datastore, remove all virtual machines from the datastore. Make sure that no other host is
accessing the datastore.
Procedure
98
1
Display the datastores.
2
Right-click the datastore to delete and click Delete.
3
Confirm that you want to delete the datastore.
VMware, Inc.
Chapter 9 Managing Storage
Unmount Datastores
When you unmount a datastore, it remains intact, but can no longer be seen from the hosts that you specify.
It continues to appear on other hosts, where it remains mounted.
You can unmount only the following types of datastores:
n
NFS datastores
n
VMFS datastore copies mounted without resignaturing
Procedure
1
Display the datastores.
2
Right-click the datastore to unmount and select Unmount.
3
If the datastore is shared, specify which hosts should no longer access the datastore.
a
If needed, deselect the hosts where you want to keep the datastore mounted.
By default, all hosts are selected.
4
b
Click Next.
c
Review the list of hosts from which to unmount the datastore, and click Finish.
Confirm that you want to unmount the datastore.
Changing VMFS Datastore Properties
After you create a VMFS-based datastore, you can modify it. For example, you can increase it if you need more
space. If you have VMFS-2 datastores, you can upgrade them to VMFS-3 format.
Datastores that use the VMFS format are deployed on SCSI-based storage devices.
You cannot reformat a VMFS datastore that a remote host is using. If you attempt to, a warning appears that
specifies the name of the datastore in use and the host that is using it. This warning also appears in the VMkernel
and vmkwarning log files.
Depending on whether your vSphere Client is connected to a vCenter Server system or directly to a host,
different ways to access the Datastore Properties dialog box exist.
n
vCenter Server only. To access the Datastore Properties dialog box, select the datastore form the inventory,
click the Configuration tab, and click Properties.
n
vCenter Server and ESX/ESXi host. To access the Datastore Properties dialog box, select a host from the
inventory, click the Configuration tab and click Storage. From the Datastores view, select the datastore
to modify and click Properties.
VMware, Inc.
99
ESXi Configuration Guide
Increase VMFS Datastores
When you need to create new virtual machines on a datastore, or when the virtual machines running on this
datastore require more space, you can dynamically increase the capacity of a VMFS datastore.
Use one of the following methods:
n
Add a new extent. An extent is a partition on a LUN. You can add a new extent to any existing VMFS
datastore. The datastore can stretch over multiple extents, up to 32.
NOTE You cannot add a local extent to a datastore located on a SAN LUN.
n
Grow an extent in an existing VMFS datastore. Only extents with free space immediately after them are
expandable. As a result, rather than adding the new extent, you can grow the existing extent so that it fills
the available adjacent capacity.
NOTE If a shared datastore has powered on virtual machines and becomes 100% full, you can increase the
datastore's capacity only from the host, with which the powered on virtual machines are registered.
Procedure
1
Log in to the vSphere Client and select a host from the Inventory panel.
2
Click the Configuration tab and click Storage.
3
From the Datastores view, select the datastore to increase and click Properties.
4
Click Increase.
5
Select a device from the list of storage devices and click Next.
6
n
If you want to add a new extent, select the device for which the Expandable column reads No.
n
If you want to expand an existing extent, select the device for which the Expandable column reads
Yes.
Select a configuration option from the bottom panel.
Depending on the current layout of the disk and on your previous selections, the options you see might
vary.
7
Option
Description
Use free space to add new extent
Adds the free space on this disk as a new datastore extent.
Use free space to expand existing
extent
Grows an existing extent to a required capacity.
Use free space
Deploys an extent in the remaining free space of the disk. This option is
available only when adding an extent.
Use all available partitions
Dedicates the entire disk to a single datastore extent. This option is available
only when adding an extent and when the disk you are formatting is not
blank. The disk is reformatted, and the datastores and any data that it
contains are erased.
Set the capacity for the extent.
By default, the entire free space on the storage device is available.
100
8
Click Next.
9
Review the proposed layout and the new configuration of your datastore, and click Finish.
VMware, Inc.
Chapter 9 Managing Storage
What to do next
After you grow an extent in a shared VMFS datastore, refresh the datastore on each host that can access this
datastore, so that the vSphere Client can display the correct datastore capacity for all hosts.
Upgrade Datastores
ESXi includes VMFS version 3 (VMFS-3). If your datastore was formatted with VMFS-2, you can read files
stored on VMFS-2, but you cannot write to them. To have complete access to the files, upgrade VMFS-2 to
VMFS-3.
When you upgrade VMFS-2 to VMFS-3, the ESXi file-locking mechanism ensures that no remote host or local
process is accessing the VMFS datastore being converted. Your host preserves all files on the datastore.
As a precaution, before you use the upgrade option, consider the following:
n
Commit or discard any changes to virtual disks in the VMFS-2 volume that you plan to upgrade.
n
Back up the VMFS-2 volume.
n
Be sure that no powered on virtual machines are using the VMFS-2 volume.
n
Be sure that no other ESXi host is accessing the VMFS-2 volume.
The VMFS-2 to VMFS-3 conversion is a one-way process. After you convert the VMFS-based datastore to
VMFS-3, you cannot revert it back to VMFS-2.
To upgrade the VMFS-2 file system, its file block size must not exceed 8MB.
Procedure
1
Log in to the vSphere Client and select a host from the Inventory panel.
2
Click the Configuration tab and click Storage.
3
Select the datastore that uses the VMFS-2 format.
4
Click Upgrade to VMFS-3.
5
Perform a rescan on all hosts that see the datastore.
Managing Duplicate VMFS Datastores
When a LUN contains a VMFS datastore copy, you can mount the datastore with the existing signature or
assign a new signature.
Each VMFS datastore created in a LUN has a unique UUID that is stored in the file system superblock. When
the LUN is replicated or snapshotted, the resulting LUN copy is identical, byte-for-byte, with the original LUN.
As a result, if the original LUN contains a VMFS datastore with UUID X, the LUN copy appears to contain an
identical VMFS datastore, or a VMFS datastore copy, with exactly the same UUID X.
ESXi can determine whether a LUN contains the VMFS datastore copy, and either mount the datastore copy
with its original UUID or change the UUID, thus resignaturing the datastore.
VMware, Inc.
101
ESXi Configuration Guide
Mounting VMFS Datastores with Existing Signatures
You might not have to resignature a VMFS datastore copy. You can mount a VMFS datastore copy without
changing its signature.
For example, you can maintain synchronized copies of virtual machines at a secondary site as part of a disaster
recovery plan. In the event of a disaster at the primary site, you can mount the datastore copy and power on
the virtual machines at the secondary site.
IMPORTANT You can mount a VMFS datastore only if it does not collide with an already mounted VMFS
datastore that has the same UUID.
When you mount the VMFS datastore, ESXi allows both reads and writes to the datastore residing on the LUN
copy. The LUN copy must be writable. The datastore mounts are persistent and valid across system reboots.
Because ESXi does not allow you to resignature the mounted datastore, unmount the datastore before
resignaturing.
Mount a VMFS Datastore with an Existing Signature
If you do not need to resignature a VMFS datastore copy, you can mount it without changing its signature.
Prerequisites
Before you mount a VMFS datastore, perform a storage rescan on your host so that it updates its view of LUNs
presented to it.
Procedure
1
Log in to the vSphere Client and select the server from the inventory panel.
2
Click the Configuration tab and click Storage in the Hardware panel.
3
Click Add Storage.
4
Select the Disk/LUN storage type and click Next.
5
From the list of LUNs, select the LUN that has a datastore name displayed in the VMFS Label column and
click Next.
The name present in the VMFS Label column indicates that the LUN is a copy that contains a copy of an
existing VMFS datastore.
6
Under Mount Options, select Keep Existing Signature.
7
In the Ready to Complete page, review the datastore configuration information and click Finish.
What to do next
If you later want to resignature the mounted datastore, you must unmount it first.
Resignaturing VMFS Copies
Use datastore resignaturing to retain the data stored on the VMFS datastore copy. When resignaturing a VMFS
copy, ESXi assigns a new UUID and a new label to the copy, and mounts the copy as a datastore distinct from
the original.
The default format of the new label assigned to the datastore is snap-<snapID>-<oldLabel>, where <snapID> is
an integer and <oldLabel> is the label of the original datastore.
102
VMware, Inc.
Chapter 9 Managing Storage
When you perform datastore resignaturing, consider the following points:
n
Datastore resignaturing is irreversible.
n
The LUN copy that contains the VMFS datastore that you resignature is no longer treated as a LUN copy.
n
A spanned datastore can be resignatured only if all its extents are online.
n
The resignaturing process is crash and fault tolerant. If the process is interrupted, you can resume it later.
n
You can mount the new VMFS datastore without a risk of its UUID colliding with UUIDs of any other
datastore, such as an ancestor or child in a hierarchy of LUN snapshots.
Resignature a VMFS Datastore Copy
Use datastore resignaturing if you want to retain the data stored on the VMFS datastore copy.
Prerequisites
To resignature a mounted datastore copy, first unmount it.
Before you resignature a VMFS datastore, perform a storage rescan on your host so that the host updates its
view of LUNs presented to it and discovers any LUN copies.
Procedure
1
Log in to the vSphere Client and select the server from the inventory panel.
2
Click the Configuration tab and click Storage in the Hardware panel.
3
Click Add Storage.
4
Select the Disk/LUN storage type and click Next.
5
From the list of LUNs, select the LUN that has a datastore name displayed in the VMFS Label column and
click Next.
The name present in the VMFS Label column indicates that the LUN is a copy that contains a copy of an
existing VMFS datastore.
6
Under Mount Options, select Assign a New Signature and click Next.
7
In the Ready to Complete page, review the datastore configuration information and click Finish.
What to do next
After resignaturing, you might have to do the following:
n
If the resignatured datastore contains virtual machines, update references to the original VMFS datastore
in the virtual machine files, including .vmx, .vmdk, .vmsd, and .vmsn.
n
To power on virtual machines, register them with vCenter Server.
Using Multipathing with ESXi
To maintain a constant connection between an ESXi host and its storage, ESXi supports multipathing.
Multipathing is a technique that lets you use more than one physical path for transferring data between the
ESXi host and the external storage device.
In case of a failure of an element in the SAN network, such as an HBA, switch, or cable, ESXi can fail over to
another physical path. In addition to path failover, multipathing offers load balancing, which redistributes I/O
loads between multiple paths, thus reducing or removing potential bottlenecks.
VMware, Inc.
103
ESXi Configuration Guide
Managing Multiple Paths
To manage storage multipathing, ESXi uses a special VMkernel layer, Pluggable Storage Architecture (PSA).
The PSA is an open modular framework that coordinates the simultaneous operation of multiple multipathing
plugins (MPPs).
The VMkernel multipathing plugin that ESXi provides by default is the VMware Native Multipathing Plugin
(NMP). The NMP is an extensible module that manages subplugins. There are two types of NMP subplugins,
Storage Array Type Plugins (SATPs), and Path Selection Plugins (PSPs). SATPs and PSPs can be built-in and
provided by VMware, or can be provided by a third party.
If more multipathing functionality is required, a third party can also provide an MPP to run in addition to, or
as a replacement for, the default NMP.
When coordinating the VMware NMP and any installed third-party MPPs, the PSA performs the following
tasks:
n
Loads and unloads multipathing plugins.
n
Hides virtual machine specifics from a particular plugin.
n
Routes I/O requests for a specific logical device to the MPP managing that device.
n
Handles I/O queuing to the logical devices.
n
Implements logical device bandwidth sharing between virtual machines.
n
Handles I/O queueing to the physical storage HBAs.
n
Handles physical path discovery and removal.
n
Provides logical device and physical path I/O statistics.
As Figure 9-1 illustrates, multiple third-party MPPs can run in parallel with the VMware NMP. The third-party
MPPs can replace the behavior of the NMP and take complete control of the path failover and the loadbalancing operations for specified storage devices.
Figure 9-1. Pluggable Storage Architecture
VMkernel
pluggable storage architecture
third-party
MPP
third-party
MPP
VMware NMP
VMware SATP
VMware PSP
VMware SATP
VMware PSP
VMware SATP
third-party SATP
third-party PSP
The multipathing modules perform the following operations:
104
n
Manage physical path claiming and unclaiming.
n
Manage creation, registration, and deregistration of logical devices.
n
Associate physical paths with logical devices.
VMware, Inc.
Chapter 9 Managing Storage
n
n
Process I/O requests to logical devices:
n
Select an optimal physical path for the request.
n
Depending on a storage device, perform specific actions necessary to handle path failures and I/O
command retries.
Support management tasks, such as abort or reset of logical devices.
VMware Multipathing Module
By default, ESXi provides an extensible multipathing module called the Native Multipathing Plugin (NMP).
Generally, the VMware NMP supports all storage arrays listed on the VMware storage HCL and provides a
default path selection algorithm based on the array type. The NMP associates a set of physical paths with a
specific storage device, or LUN. The specific details of handling path failover for a given storage array are
delegated to a Storage Array Type Plugin (SATP). The specific details for determining which physical path is
used to issue an I/O request to a storage device are handled by a Path Selection Plugin (PSP). SATPs and PSPs
are sub-plugins within the NMP module.
VMware SATPs
Storage Array Type Plugins (SATPs) run in conjunction with the VMware NMP and are responsible for arrayspecific operations.
ESXi offers an SATP for every type of array that VMware supports. These SATPs include an active/active SATP
and active/passive SATP for non-specified storage arrays, and the local SATP for direct-attached storage. Each
SATP accommodates special characteristics of a certain class of storage arrays and can perform the arrayspecific operations required to detect path state and to activate an inactive path. As a result, the NMP module
can work with multiple storage arrays without having to be aware of the storage device specifics.
After the NMP determines which SATP to call for a specific storage device and associates the SATP with the
physical paths for that storage device, the SATP implements the tasks that include the following:
n
Monitors health of each physical path.
n
Reports changes in the state of each physical path.
n
Performs array-specific actions necessary for storage fail-over. For example, for active/passive devices, it
can activate passive paths.
VMware PSPs
Path Selection Plugins (PSPs) run in conjunction with the VMware NMP and are responsible for choosing a
physical path for I/O requests.
The VMware NMP assigns a default PSP for every logical device based on the SATP associated with the physical
paths for that device. You can override the default PSP.
VMware, Inc.
105
ESXi Configuration Guide
By default, the VMware NMP supports the following PSPs:
Most Recently Used
(MRU)
Selects the path the ESXi host used most recently to access the given device. If
this path becomes unavailable, the host switches to an alternative path and
continues to use the new path while it is available.
Fixed
Uses the designated preferred path, if it has been configured. Otherwise, it uses
the first working path discovered at system boot time. If the host cannot use
the preferred path, it selects a random alternative available path. The host
automatically reverts back to the preferred path as soon as that path becomes
available.
NOTE With active-passive arrays that have a Fixed path policy, path thrashing
might be a problem.
Round Robin (RR)
Uses a path selection algorithm that rotates through all available paths enabling
load balancing across the paths.
VMware NMP Flow of I/O
When a virtual machine issues an I/O request to a storage device managed by the NMP, the following process
takes place.
1
The NMP calls the PSP assigned to this storage device.
2
The PSP selects an appropriate physical path on which to issue the I/O.
3
If the I/O operation is successful, the NMP reports its completion.
4
If the I/O operation reports an error, the NMP calls an appropriate SATP.
5
The SATP interprets the I/O command errors and, when appropriate, activates inactive paths.
6
The PSP is called to select a new path on which to issue the I/O.
Multipathing with Local Storage and Fibre Channel SANs
In a simple multipathing local storage topology, you can use one ESXi host, which has two HBAs. The ESXi
host connects to a dual-port local storage system through two cables. This configuration ensures fault tolerance
if one of the connection elements between the ESXi host and the local storage system fails.
To support path switching with FC SAN, the ESXi host typically has two or more HBAs available from which
the storage array can be reached using one or more switches. Alternatively, the setup can include one HBA
and two storage processors so that the HBA can use a different path to reach the disk array.
In Figure 9-2, multiple paths connect each server with the storage device. For example, if HBA1 or the link
between HBA1 and the switch fails, HBA2 takes over and provides the connection between the server and the
switch. The process of one HBA taking over for another is called HBA failover.
106
VMware, Inc.
Chapter 9 Managing Storage
Figure 9-2. Fibre Channel Multipathing
Host
1
HBA2
Host
2
HBA1
HBA3
HBA4
switch
switch
SP1
SP2
storage array
Similarly, if SP1 or the link between SP1 and the switch breaks, SP2 takes over and provides the connection
between the switch and the storage device. This process is called SP failover. ESXi supports HBA and SP failover
with its multipathing capability.
Multipathing with iSCSI SAN
With iSCSI storage, you can take advantage of the multipathing support that the IP network offers. In addition,
ESXi supports host-based multipathing for both hardware and software iSCSI initiators.
ESXi can use multipathing support built into the IP network, which allows the network to perform routing.
Through dynamic discovery, iSCSI initiators obtain a list of target addresses that the initiators can use as
multiple paths to iSCSI LUNs for failover purposes.
ESXi also supports host-based multipathing.
With the hardware iSCSI, the host can have two or more hardware iSCSI adapters and use them as different
paths to reach the storage system.
As Figure 9-3 illustrates, the host has two hardware iSCSI adapters, HBA1 and HBA2, that provide two physical
paths to the storage system. Multipathing plugins on the host, whether the VMkernel NMP or any third-party
MPPs, have access to the paths by default and can monitor the health of each physical path. If, for example,
HBA1 or the link between HBA1 and the network fails, the multipathing plugins can switch the path over to
HBA2.
VMware, Inc.
107
ESXi Configuration Guide
Figure 9-3. Hardware iSCSI and Failover
ESX/ESXi
HBA2
HBA1
IP network
SP
iSCSI storage
With the software iSCSI, as Figure 9-4 shows, you can use multiple NICs that provide failover and loadbalancing capabilities for iSCSI connections between the host and storage systems.
For this setup, because multipathing plugins do not have direct access to the physical NICs on your host, you
must first connect each physical NIC to a separate VMkernel port. You then associate all VMkernel ports with
the software iSCSI initiator using a port binding technique. As a result, each VMkernel port connected to a
separate NIC becomes a different path that the iSCSI storage stack and its storage-aware multipathing plugins
can use.
For more information on this setup, see the iSCSI SAN Configuration Guide.
108
VMware, Inc.
Chapter 9 Managing Storage
Figure 9-4. Software iSCSI and Failover
ESX/ESXi
software initiator
NIC1
NIC2
IP network
SP
iSCSI storage
Path Scanning and Claiming
When you start your ESXi host or rescan your storage adapter, the host discovers all physical paths to storage
devices available to the host. Based on a set of claim rules defined in the /etc/vmware/esx.conf file, the host
determines which multipathing plugin (MPP) should claim the paths to a particular device and become
responsible for managing the multipathing support for the device.
By default, the host performs a periodic path evaluation every 5 minutes causing any unclaimed paths to be
claimed by the appropriate MPP.
The claim rules are numbered. For each physical path, the host runs through the claim rules starting with the
lowest number first. The attributes of the physical path are compared to the path specification in the claim rule.
If there is a match, the host assigns the MPP specified in the claim rule to manage the physical path. This
continues until all physical paths are claimed by corresponding MPPs, either third-party multipathing plugins
or the native multipathing plugin (NMP).
For the paths managed by the NMP module, a second set of claim rules is applied. These rules determine which
SATP should be used to manage the paths from a specific array type, and which PSP is to be used for each
storage device. For example, for a storage device that belongs to the EMC CLARiiON CX storage family, the
default SATP is VMW_SATP_CX and the default PSP is Most Recently Used.
Use the vSphere Client to view which SATP and PSP the host is using for a specific storage device and the
status of all available paths for this storage device. If needed, you can change the default VMware PSP using
the vSphere Client. To change the default SATP, you need to modify claim rules using the vSphere CLI.
For detailed descriptions of the commands available to manage PSA, see the vSphere Command-Line Interface
Installation and Reference Guide.
VMware, Inc.
109
ESXi Configuration Guide
Viewing the Paths Information
Use the vSphere Client to determine which SATP and PSP the ESXi host uses for a specific storage device and
the status of all available paths for this storage device. You can access the path information from both, the
Datastores and Devices views. For datastores, you review the paths that connect to the device the datastore is
deployed on.
The path information includes the SATP assigned to manage the device, the path selection policy (PSP), and
a list of paths with their physical characteristics, such as an adapter and target each path uses, and the status
of each path. The following path status information can appear:
Active
Paths available for issuing I/O to a LUN. A single or multiple working paths
currently used for transferring data are marked as Active (I/O).
NOTE For hosts that run ESXi 3.5 or earlier, the term active means the only path
that the host is using to issue I/O to a LUN.
Standby
The path is operational and can be used for I/O if active paths fail.
Disabled
The path is disabled and no data can be transferred.
Broken
The software cannot connect to the disk through this path.
If you are using the Fixedpath policy, you can see which path is the preferred path. The preferred path is
marked with an asterisk (*) in the Preferred column.
View Datastore Paths
Use the vSphere Client to review the paths that connect to storage devices the datastores are deployed on.
Procedure
1
Log in to the vSphere Client and select a server from the inventory panel.
2
Click the Configuration tab and click Storage in the Hardware panel.
3
Click Datastores under View.
4
From the list of configured datastores, select the datastore whose paths you want to view or configure.
The Details panel shows the total number of paths being used to access the device and whether any of
them are broken or disabled.
5
Click Properties > Manage Paths to open the Manage Paths dialog box.
You can use the Manage Paths dialog box to enable or disable your paths, set multipathing policy, and
specify the preferred path.
View Storage Device Paths
Use the vSphere Client to view which SATP and PSP the host uses for a specific storage device and the status
of all available paths for this storage device.
Procedure
110
1
Log in to the vSphere Client and select a server from the inventory panel.
2
Click the Configuration tab and click Storage in the Hardware panel.
3
Click Devices under View.
4
Click Manage Paths to open the Manage Paths dialog box.
VMware, Inc.
Chapter 9 Managing Storage
Setting a Path Selection Policy
For each storage device, the ESXi host sets the path selection policy based on the claim rules defined in
the /etc/vmware/esx.conf file.
By default, VMware supports the following path selection policies. If you have a third-party PSP installed on
your host, its policy also appears on the list.
Fixed (VMware)
The host always uses the preferred path to the disk when that path is available.
If the host cannot access the disk through the preferred path, it tries the
alternative paths. The default policy for active-active storage devices is Fixed.
Most Recently Used
(VMware)
The host uses a path to the disk until the path becomes unavailable. When the
path becomes unavailable, the host selects one of the alternative paths. The host
does not revert back to the original path when that path becomes available
again. There is no preferred path setting with the MRU policy. MRU is the
default policy for active-passive storage devices and is required for those
devices.
Round Robin (VMware)
The host uses an automatic path selection algorithm rotating through all
available paths. This implements load balancing across all the available
physical paths.
Load balancing is the process of spreading server I/O requests across all
available host paths. The goal is to optimize performance in terms of
throughput (I/O per second, megabytes per second, or response times).
Table 9-1 summarizes how the behavior of host changes, depending on the type of array and the failover policy.
Table 9-1. Path Policy Effects
Policy/Controller
Active-Active
Active-Passive
Most Recently Used
Administrator action is required to fail back
after path failure.
Administrator action is required to fail back
after path failure.
Fixed
VMkernel resumes using the preferred path
when connectivity is restored.
VMkernel attempts to resume using the
preferred path. This can cause path thrashing
or failure when another SP now owns the
LUN.
Round Robin
No fail back.
Next path in round robin scheduling is
selected.
VMware, Inc.
111
ESXi Configuration Guide
Change the Path Selection Policy
Generally, you do not have to change the default multipathing settings your host uses for a specific storage
device. However, if you want to make any changes, you can use the Manage Paths dialog box to modify a path
selection policy and specify the preferred path for the Fixed policy.
Procedure
1
Open the Manage Paths dialog box either from the Datastores or Devices view.
2
Select a path selection policy.
By default, VMware supports the following path selection policies. If you have a third-party PSP installed
on your host, its policy also appears on the list.
n
Fixed (VMware)
n
Most Recently Used (VMware)
n
Round Robin (VMware)
3
For the fixed policy, specify the preferred path by right-clicking the path you want to assign as the
preferred path, and selecting Preferred.
4
Click OK to save your settings and exit the dialog box.
Disable Paths
You can temporarily disable paths for maintenance or other reasons. You can do so using the vSphere Client.
Procedure
1
Open the Manage Paths dialog box either from the Datastores or Devices view.
2
In the Paths panel, right-click the path to disable, and select Disable.
3
Click OK to save your settings and exit the dialog box.
You can also disable a path from the adapter’s Paths view by right-clicking the path in the list and selecting
Disable.
Thin Provisioning
When you create a virtual machine, a certain amount of storage space on a datastore is provisioned or allocated
to the virtual disk files.
By default, ESXi offers a traditional storage provisioning method during creation in which you estimate how
much storage the virtual machine will need for its entire life cycle, provision a fixed amount of storage space
to its virtual disk, and have the entire provisioned space committed to the virtual disk. A virtual disk that
immediately occupies the entire provisioned space is called a thick disk. Creating virtual disks in thick format
can lead to underutilization of datastore capacity, because large amounts of storage space, pre-allocated to
individual virtual machines, might remain unused.
To help avoid over-allocating storage space and save storage, ESXi supports thin provisioning, which lets you,
in the beginning, use just as much storage capacity as currently needed and then add the required amount of
storage space at a later time. Using the ESXi thin provisioning feature, you can create virtual disks in a thin
format. For a thin virtual disk, ESXi provisions the entire space required for the disk’s current and future
activities, but commits only as much storage space as the disk needs for its initial operations.
112
VMware, Inc.
Chapter 9 Managing Storage
About Virtual Disk Formats
When you perform certain virtual machine management operations, such as create a virtual disk, clone a virtual
machine to a template, or migrate a virtual machine, you can specify a format for the virtual disk file.
The following disk formats are supported. You cannot specify the disk format if the disk resides on an NFS
datastore. The NFS server determines the allocation policy for the disk.
Thin Provisioned Format
Use this format to save storage space. For the thin disk, you provision as much
datastore space as the disk would require based on the value you enter for the
disk size. However, the thin disk starts small and at first, uses only as much
datastore space as the disk actually needs for its initial operations.
NOTE If a virtual disk supports clustering solutions such as Fault Tolerance,
you cannot make the disk thin.
If the thin disk needs more space later, it can grow to its maximum capacity
and occupy the entire datastore space provisioned to it. Also, you can manually
convert the thin disk into thick.
Thick Format
This is the default virtual disk format. The thick virtual disk does not change
its size and from the very beginning occupies the entire datastore space
provisioned to it. Thick format does not zero out the blocks in the allocated
space. It is not possible to convert the thick disk into thin.
Create Thin Provisioned Virtual Disks
When you need to save storage space, you can create a virtual disk in thin provisioned format. The thin
provisioned virtual disk starts small and grows as more disk space is required.
This procedure assumes that you are creating a typical or custom virtual machine using the New Virtual
Machine wizard.
Prerequisites
You can create thin disks only on the datastores that support thin provisioning. If a disk resides on an NFS
datastore, you cannot specify the disk format because the NFS server determines the allocation policy for the
disk.
Procedure
u
In the Create a Disk dialog box, select Allocate and commit space on demand (Thin Provisioning).
A virtual disk in thin format is created. If you do not select the Thin Provisioning option, your virtual disk will
have the default thick format.
What to do next
If you created a virtual disk in the thin format, you can later inflate it to its full size.
VMware, Inc.
113
ESXi Configuration Guide
View Virtual Machine Storage Resources
You can view how datastore storage space is allocated for your virtual machines.
Procedure
1
Select the virtual machine in the inventory.
2
Click the Summary tab.
3
Review the space allocation information in the Resources section.
n
Provisioned Storage – Shows datastore space guaranteed to the virtual machine. The entire space
might not be used by the virtual machine if it has disks in thin provisioned format. Other virtual
machines can occupy any unused space.
n
Not-shared Storage – Shows datastore space occupied by the virtual machine and not shared with
any other virtual machines.
n
Used Storage – Shows datastore space actually occupied by virtual machine files, including
configuration and log files, snapshots, virtual disks, and so on. When the virtual machine is running,
the used storage space also includes swap files.
Determine the Disk Format of a Virtual Machine
You can determine whether your virtual disk is in thick or thin format.
Procedure
1
Select the virtual machine in the inventory.
2
Click Edit Settings to display the Virtual Machine Properties dialog box.
3
Click the Hardware tab and select the appropriate hard disk in the Hardware list.
The Disk Provisioning section on the right shows the type of your virtual disk, either Thin or Thick.
4
Click OK.
What to do next
If your virtual disk is in the thin format, you can inflate it to its full size.
Convert a Virtual Disk from Thin to Thick
If you created a virtual disk in the thin format, you can convert it to thick.
Procedure
1
Select the virtual machine in the inventory.
2
Click the Summary tab and, under Resources, double-click the datastore for the virtual machine to open
the Datastore Browser dialog box.
3
Click the virtual machine folder to find the virtual disk file you want to convert. The file has the .vmdk
extension.
4
Right-click the virtual disk file and select Inflate.
The virtual disk in thick format occupies the entire datastore space originally provisioned to it.
114
VMware, Inc.
Chapter 9 Managing Storage
Handling Datastore Over-Subscription
Because the provisioned space for thin disks can be greater than the committed space, a datastore oversubscription can occur, which results in the total provisioned space for the virtual machine disks on the
datastore being greater than the actual capacity.
Over-subscription can be possible because usually not all virtual machines with thin disks need the entire
provisioned datastore space simultaneously. However, if you want to avoid over-subscribing the datastore,
you can set up an alarm that notifies you when the provisioned space reaches a certain threshold.
For information on setting alarms, see Basic System Administration.
If your virtual machines require more space, the datastore space is allocated on a first come first served basis.
When the datastore runs our of space, you can add more physical storage and increase the datastore.
See “Increase VMFS Datastores,” on page 100.
Turn Off vCenter Server Storage Filters
When you perform VMFS datastore management operations, for example create a VMFS datastore or an RDM,
add an extent, or increase a VMFS datastore, the vCenter Server uses default storage filters. The filters retrieve
only those storage devices, or LUNs, that can be used for a particular operation. Unsuitable LUNs are filtered
out and are not displayed for your selection. Using the vSphere Client, you can turn off the filters.
To turn off the filters, you use the Advanced Settings page to modify the vCenter Server configuration file,
vpxd.cfg. This page can be used to add entries to the file, but not to edit or delete them.
As with any advanced configuration settings, consult with the VMware support team before making any
changes to the LUN filters. Do not turn the filters off unless you have other methods to prevent LUN corruption.
Procedure
1
Select Administration > vCenter Server Settings to display the vCenter Server Settings dialog box.
2
In the settings list, select Advanced Settings.
3
In the Key field, type a key.
Key
Description
config.vpxd.filter.vmfsFilter
VMFS Filter
config.vpxd.filter.rdmFilter
RDM Filter
config.vpxd.filter.SameHostAndTra
nsportsFilter
Same Host and Transports Filter
config.vpxd.filter.hostRescanFilter
Host Rescan Filter
4
In the Value field, type False for the specified key.
5
Click Add.
6
Click OK.
What to do next
You are not required to restart the vCenter Server system.
VMware, Inc.
115
ESXi Configuration Guide
vCenter Server Storage Filtering
The storage filters that the vCenter Server provides help you avoid storage device corruption and performance
degradation that can be caused by an unsupported use of LUNs. These filters are available by default.
Table 9-2. Storage Filters
116
Filter
Description
Key
VMFS Filter
Filters out any storage devices, or LUNs, that are
already used by another VMFS datastore on any
host managed by the vCenter Server. Prevents
LUN sharing by multiple datastores or a datastore
and RDM combination.
config.vpxd.filter.vmfsFilter
RDM Filter
Filters out any LUNs that are already referenced
by another RDM on any host managed by the
vCenter Server. Prevents LUN sharing by a
datastore and RDM combination. In addition, the
filter prevents virtual machines from accessing
the same LUN through different RDM mapping
files.
If you need virtual machines to access the same
raw LUN, they must share the same RDM
mapping file. For details on this type of
configuration, see Setup for Failover Clustering and
Microsoft Cluster Service.
config.vpxd.filter.rdmFilter
Same Host and
Transports Filter
Filters out LUNs ineligible for use as VMFS
datastore extents due a host or storage type
incompatibility. Prevents you from adding the
following LUNs as extents:
n LUNs not exposed to all hosts that share the
original VMFS datastore.
n LUNs that use a storage type different from
the one the original VMFS datastore uses. For
example, you cannot add a Fibre Channel
extent to a VMFS datastore on a local storage
device.
config.vpxd.filter.SameHostAndTransportsFi
lter
Host Rescan Filter
Automatically rescans and updates storage
devices after you perform datastore management
operations. The filter helps provide a consistent
view of all storage devices and VMFS datastores
on all hosts managed by the vCenter Server.
config.vpxd.filter.hostRescanFilter
VMware, Inc.
Raw Device Mapping
10
Raw device mapping (RDM) provides a mechanism for a virtual machine to have direct access to a LUN on
the physical storage subsystem (Fibre Channel or iSCSI only).
The following topics contain information about RDMs and provide instructions on how to create and manage
RDMs.
This chapter includes the following topics:
n
“About Raw Device Mapping,” on page 117
n
“Raw Device Mapping Characteristics,” on page 120
n
“Managing Mapped LUNs,” on page 124
About Raw Device Mapping
RDM is a mapping file in a separate VMFS volume that acts as a proxy for a raw physical device, a SCSI device
used directly by a virtual machine. The RDM contains metadata for managing and redirecting disk access to
the physical device.
The file gives you some of the advantages of direct access to a physical device while keeping some advantages
of a virtual disk in VMFS. As a result, it merges VMFS manageability with raw device access.
RDMs can be described in terms such as mapping a raw device into a datastore, mapping a system LUN, or
mapping a disk file to a physical disk volume. All these terms refer to RDMs.
Figure 10-1. Raw Device Mapping
Virtual
machine
reads,
writes
opens
VMFS volume
mapping file
address
resolution
mapped device
Although VMware recommends that you use VMFS datastores for most virtual disk storage, on certain
occasions, you might need to use raw LUNs or logical disks located in a SAN.
VMware, Inc.
117
ESXi Configuration Guide
For example, you need to use raw LUNs with RDMs in the following situations:
n
When SAN snapshot or other layered applications are run in the virtual machine. The RDM better enables
scalable backup offloading systems by using features inherent to the SAN.
n
In any MSCS clustering scenario that spans physical hosts — virtual-to-virtual clusters as well as physicalto-virtual clusters. In this case, cluster data and quorum disks should be configured as RDMs rather than
as files on a shared VMFS.
Think of an RDM as a symbolic link from a VMFS volume to a raw LUN. The mapping makes LUNs appear
as files in a VMFS volume. The RDM, not the raw LUN, is referenced in the virtual machine configuration. The
RDM contains a reference to the raw LUN.
Using RDMs, you can:
n
Use vMotion to migrate virtual machines using raw LUNs.
n
Add raw LUNs to virtual machines using the vSphere Client.
n
Use file system features such as distributed file locking, permissions, and naming.
Two compatibility modes are available for RDMs:
n
Virtual compatibility mode allows an RDM to act exactly like a virtual disk file, including the use of
snapshots.
n
Physical compatibility mode allows direct access of the SCSI device for those applications that need lower
level control.
Benefits of Raw Device Mapping
An RDM provides a number of benefits, but it should not be used in every situation. In general, virtual disk
files are preferable to RDMs for manageability. However, when you need raw devices, you must use the RDM.
RDM offers several benefits.
User-Friendly Persistent
Names
Provides a user-friendly name for a mapped device. When you use an RDM,
you do not need to refer to the device by its device name. You refer to it by the
name of the mapping file, for example:
/vmfs/volumes/myVolume/myVMDirectory/myRawDisk.vmdk
118
Dynamic Name
Resolution
Stores unique identification information for each mapped device. VMFS
associates each RDM with its current SCSI device, regardless of changes in the
physical configuration of the server because of adapter hardware changes, path
changes, device relocation, and so on.
Distributed File Locking
Makes it possible to use VMFS distributed locking for raw SCSI devices.
Distributed locking on an RDM makes it safe to use a shared raw LUN without
losing data when two virtual machines on different servers try to access the
same LUN.
File Permissions
Makes file permissions possible. The permissions of the mapping file are
enforced at file-open time to protect the mapped volume.
File System Operations
Makes it possible to use file system utilities to work with a mapped volume,
using the mapping file as a proxy. Most operations that are valid for an ordinary
file can be applied to the mapping file and are redirected to operate on the
mapped device.
Snapshots
Makes it possible to use virtual machine snapshots on a mapped volume.
Snapshots are not available when the RDM is used in physical compatibility
mode.
VMware, Inc.
Chapter 10 Raw Device Mapping
vMotion
Lets you migrate a virtual machine with vMotion. The mapping file acts as a
proxy to allow vCenter Server to migrate the virtual machine by using the same
mechanism that exists for migrating virtual disk files.
Figure 10-2. vMotion of a Virtual Machine Using Raw Device Mapping
Host 1
Host 2
VMotion
VM1
VM2
VMFS volume
mapping file
address
resolution
mapped device
SAN Management
Agents
Makes it possible to run some SAN management agents inside a virtual
machine. Similarly, any software that needs to access a device by using
hardware-specific SCSI commands can be run in a virtual machine. This kind
of software is called SCSI target-based software. When you use SAN
management agents, select a physical compatibility mode for the RDM.
N-Port ID Virtualization
(NPIV)
Makes it possible to use the NPIV technology that allows a single Fibre Channel
HBA port to register with the Fibre Channel fabric using several worldwide
port names (WWPNs). This ability makes the HBA port appear as multiple
virtual ports, each having its own ID and virtual port name. Virtual machines
can then claim each of these virtual ports and use them for all RDM traffic.
NOTE You can use NPIV only for virtual machines with RDM disks.
VMware works with vendors of storage management software to ensure that their software functions correctly
in environments that include ESXi. Some applications of this kind are:
n
SAN management software
n
Storage resource management (SRM) software
n
Snapshot software
n
Replication software
Such software uses a physical compatibility mode for RDMs so that the software can access SCSI devices
directly.
VMware, Inc.
119
ESXi Configuration Guide
Various management products are best run centrally (not on the ESXi machine), while others run well on the
service console or on the virtual machines. VMware does not certify these applications or provide a
compatibility matrix. To find out whether a SAN management application is supported in an ESXi
environment, contact the SAN management software provider.
Limitations of Raw Device Mapping
Certain limitations exist when you use RDMs.
n
Not available for block devices or certain RAID devices – RDM uses a SCSI serial number to identify the
mapped device. Because block devices and some direct-attach RAID devices do not export serial numbers,
they cannot be used with RDMs.
n
Available with VMFS-2 and VMFS-3 volumes only – RDM requires the VMFS-2 or VMFS-3 format. In
ESXi, the VMFS-2 file system is read only. Upgrade it to VMFS-3 to use the files that VMFS-2 stores.
n
No snapshots in physical compatibility mode – If you are using an RDM in physical compatibility mode,
you cannot use a snapshot with the disk. Physical compatibility mode allows the virtual machine to
manage its own snapshot or mirroring operations.
Snapshots are available in virtual mode.
n
No partition mapping – RDM requires the mapped device to be a whole LUN. Mapping to a partition is
not supported.
Raw Device Mapping Characteristics
An RDM is a special mapping file in a VMFS volume that manages metadata for its mapped device. The
mapping file is presented to the management software as an ordinary disk file, available for the usual filesystem operations. To the virtual machine, the storage virtualization layer presents the mapped device as a
virtual SCSI device.
Key contents of the metadata in the mapping file include the location of the mapped device (name resolution),
the locking state of the mapped device, permissions, and so on.
RDM Virtual and Physical Compatibility Modes
You can use RDMs in virtual compatibility or physical compatibility modes. Virtual mode specifies full
virtualization of the mapped device. Physical mode specifies minimal SCSI virtualization of the mapped
device, allowing the greatest flexibility for SAN management software.
In virtual mode, the mapped device appears to the guest operating system exactly the same as a virtual disk
file in a VMFS volume. The real hardware characteristics are hidden. If you are using a raw disk in virtual
mode, you can realize the benefits of VMFS such as advanced file locking for data protection and snapshots
for streamlining development processes. Virtual mode is also more portable across storage hardware than
physical mode, presenting the same behavior as a virtual disk file.
In physical mode, the VMkernel passes all SCSI commands to the device, with one exception: the REPORT
LUNs command is virtualized so that the VMkernel can isolate the LUN for the owning virtual machine.
Otherwise, all physical characteristics of the underlying hardware are exposed. Physical mode is useful to run
SAN management agents or other SCSI target-based software in the virtual machine. Physical mode also allows
virtual-to-physical clustering for cost-effective high availability.
120
VMware, Inc.
Chapter 10 Raw Device Mapping
Figure 10-3. Virtual And Physical Compatibility Modes
virtual machine 1
virtualization
virtual mode
VMFS
mapping file
mapped
device
VMFS volume
virtual machine 1
virtualization
physical mode
VMFS
mapping file
mapped
device
VMFS volume
Dynamic Name Resolution
RDM lets you give a permanent name to a device by referring to the name of the mapping file in the /vmfs
subtree.
The example in Figure 10-4 shows three LUNs. LUN 1 is accessed by its device name, which is relative to the
first visible LUN. LUN 2 is a mapped device, managed by an RDM on LUN 3. The RDM is accessed by its path
name in the /vmfs subtree, which is fixed.
VMware, Inc.
121
ESXi Configuration Guide
Figure 10-4. Example of Name Resolution
host
virtual machine 1
scsi0:0.name =
vmhba0:0:1:0:mydiskdir
/mydiskname.vmdk
HBA 1
LUN 3
m
hb
a1
:0
:1
:0
)
(/vmfs/volumes/myVolume
/myVMDirectory/mymapfile)
(v
(vmhba0:0:1:0)
HBA 0
virtual machine 2
scsi0:0.name=
mymapfile
mapping file
LUN 1
VMFS
vmhba0:0:3:0
LUN 2
vmhba0:0:1:0
mapped device
vmhba0:0:2:0
VMFS uniquely identifies all mapped LUNs, and the identification is stored in its internal data structures. Any
change in the SCSI path, such as a Fibre Channel switch failure or the addition of a new host bus adapter, can
change the device name. Dynamic name resolution compensates for these changes by adjusting the data
structures to retarget LUNs to their new device names.
122
VMware, Inc.
Chapter 10 Raw Device Mapping
Raw Device Mapping with Virtual Machine Clusters
Use an RDM with virtual machine clusters that need to access the same raw LUN for failover scenarios. The
setup is similar to that of a virtual machine cluster that accesses the same virtual disk file, but an RDM replaces
the virtual disk file.
Figure 10-5. Access from Clustered Virtual Machines
Host 3
Host 4
VM3
VM4
“shared” access
mapping file
address
resolutiion
mapped
device
VMFS volume
Comparing Available SCSI Device Access Modes
The ways of accessing a SCSI-based storage device include a virtual disk file on a VMFS datastore, virtual mode
RDM, and physical mode RDM.
To help you choose among the available access modes for SCSI devices, Table 10-1 provides a quick comparison
of features available with the different modes.
Table 10-1. Features Available with Virtual Disks and Raw Device Mappings
ESXi Features
Virtual Disk File
Virtual Mode RDM
Physical Mode RDM
SCSI Commands Passed
Through
No
No
Yes
REPORT LUNs is not passed
through
vCenter Server Support
Yes
Yes
Yes
Snapshots
Yes
Yes
No
Distributed Locking
Yes
Yes
Yes
Clustering
Cluster-in-a-box only
Cluster-in-a-box and
cluster-across-boxes
Physical to Virtual Clustering
SCSI Target-Based Software
No
No
Yes
VMware recommends that you use virtual disk files for the cluster-in-a-box type of clustering. If you plan to
reconfigure your cluster-in-a-box clusters as cluster-across-boxes clusters, use virtual mode RDMs for the
cluster-in-a-box clusters.
VMware, Inc.
123
ESXi Configuration Guide
Managing Mapped LUNs
You can use the vSphere Client to map a SAN LUN to a datastore and manage paths to your mapped LUN.
Additional tools available to manage mapped LUNs and their RDMs include the vmkfstools utility and other
commands used with the vSphere CLI. You can use the vmkfstools utility to perform many of the same
operations available through the vSphere Client.
Create Virtual Machines with RDMs
When you give your virtual machine direct access to a raw SAN LUN, you create a mapping file (RDM) that
resides on a VMFS datastore and points to the LUN. Although the mapping file has the same.vmdk extension
as a regular virtual disk file, the RDM file contains only mapping information. The actual virtual disk data is
stored directly on the LUN.
You can create the RDM as an initial disk for a new virtual machine or add it to an existing virtual machine.
When creating the RDM, you specify the LUN to be mapped and the datastore on which to put the RDM.
Procedure
1
Follow all steps required to create a custom virtual machine.
2
In the Select a Disk page, select Raw Device Mapping, and click Next.
3
From the list of SAN disks or LUNs, select a raw LUN for your virtual machine to access directly.
4
Select a datastore for the RDM mapping file.
You can place the RDM file on the same datastore where your virtual machine configuration file resides,
or select a different datastore.
NOTE To use vMotion for virtual machines with enabled NPIV, make sure that the RDM files of the virtual
machines are located on the same datastore. You cannot perform Storage vMotion or VMotion between
datastores when NPIV is enabled.
5
124
Select a compatibility mode.
Option
Description
Physical
Allows the guest operating system to access the hardware directly. Physical
compatibility is useful if you are using SAN-aware applications on the virtual
machine. However, a virtual machine with a physical compatibility RDM
cannot be cloned, made into a template, or migrated if the migration involves
copying the disk.
Virtual
Allows the RDM to behave as if it were a virtual disk, so you can use such
features as snapshotting, cloning, and so on.
6
Select a virtual device node.
7
If you select Independent mode, choose one of the following.
Option
Description
Persistent
Changes are immediately and permanently written to the disk.
Nonpersistent
Changes to the disk are discarded when you power off or revert to the
snapshot.
8
Click Next.
9
In the Ready to Complete New Virtual Machine page, review your selections.
10
Click Finish to complete your virtual machine.
VMware, Inc.
Chapter 10 Raw Device Mapping
Manage Paths for a Mapped Raw LUN
You can manage paths for mapped raw LUNs.
Procedure
1
Log in as administrator or as the owner of the virtual machine to which the mapped disk belongs.
2
Select the virtual machine from the Inventory panel.
3
On the Summary tab, click Edit Settings.
4
On the Hardware tab, select Hard Disk, then click Manage Paths.
5
Use the Manage Paths dialog box to enable or disable your paths, set multipathing policy, and specify the
preferred path.
For information on managing paths, see “Using Multipathing with ESXi,” on page 103.
VMware, Inc.
125
ESXi Configuration Guide
126
VMware, Inc.
Security
VMware, Inc.
127
ESXi Configuration Guide
128
VMware, Inc.
Security for ESXi Systems
11
ESXi is developed with a focus on strong security. VMware ensures security in the ESXi environment and
addresses system architecture from a security standpoint.
This chapter includes the following topics:
n
“ESXi Architecture and Security Features,” on page 129
n
“Security Resources and Information,” on page 135
ESXi Architecture and Security Features
The components and the overall architecture of ESXi are designed to ensure security of the ESXi system as a
whole.
From a security perspective, ESXi consists of three major components: the virtualization layer, the virtual
machines, and the virtual networking layer.
Figure 11-1 provides an overview of these components.
Figure 11-1. ESXi Architecture
ESXi
virtual
machine
VMware
Virtualization
Layer (VMkernel)
CPU
VMware, Inc.
memory
virtual
machine
virtual
machine
virtual
machine
Virtual
Networking
Layer
hardware network
adapter
storage
129
ESXi Configuration Guide
Security and the Virtualization Layer
The virtualization layer, or VMkernel, is a kernel designed by VMware to run virtual machines. It controls the
hardware that hosts use and schedules the allocation of hardware resources among the virtual machines.
Because the VMkernel is fully dedicated to supporting virtual machines and is not used for other purposes,
the interface to the VMkernel is strictly limited to the API required to manage virtual machines.
ESXi provides additional VMkernel protection with the following features:
Memory Hardening
The ESXi kernel, user-mode applications, and executable components such as
drivers and libraries are located at random, non-predictable memory
addresses. Combined with the non-executable memory protections made
available by microprocessors, this provides protection that makes it difficult
for malicious code to use memory exploits to take advantage of vulnerabilities.
Kernel Module Integrity
Digital signing ensures the integrity and authenticity of modules, drivers and
applications as they are loaded by the VMkernel. Module signing allows
ESXi to identify the providers of modules, drivers, or applications and whether
they are VMware-certified.
Trusted Platform Module
(TPM)
This module is a hardware element that represents the core of trust for a
platform and enables attestation of the boot process, as well as cryptographic
key storage and protection. As part of the boot process, ESXi measures the
VMkernel by the TPM, and changes to the VMkernel are logged from one boot
to the next. Measurement values are propagated to vCenter Server, and can be
retrieved by third-party agents using the vSphere API.
NOTE If TPM is present on a system, but disabled in the BIOS, the following
error message might appear: Error loading TPM. This is the expected behavior
and the error message can be safely ignored.
Security and Virtual Machines
Virtual machines are the containers in which applications and guest operating systems run. By design, all
VMware virtual machines are isolated from one another. This isolation enables multiple virtual machines to
run securely while sharing hardware and ensures both their ability to access hardware and their uninterrupted
performance.
Even a user with system administrator privileges on a virtual machine’s guest operating system cannot breach
this layer of isolation to access another virtual machine without privileges explicitly granted by the ESXi system
administrator. As a result of virtual machine isolation, if a guest operating system running in a virtual machine
fails, other virtual machines on the same host continue to run. The guest operating system failure has no effect
on:
n
The ability of users to access the other virtual machines
n
The ability of the operational virtual machines to access the resources they need
n
The performance of the other virtual machines
Each virtual machine is isolated from other virtual machines running on the same hardware. Although virtual
machines share physical resources such as CPU, memory, and I/O devices, a guest operating system on an
individual virtual machine cannot detect any device other than the virtual devices made available to it, as
shown in Figure 11-2.
130
VMware, Inc.
Chapter 11 Security for ESXi Systems
Figure 11-2. Virtual Machine Isolation
Virtual Machine
app
app
app
app
app
Operating System
Virtual Machine Resources
CPU
memory
disk
network and
video cards
SCSI
controller
mouse
CD/DVD
keyboard
Because the VMkernel mediates the physical resources and all physical hardware access takes place through
the VMkernel, virtual machines cannot circumvent this level of isolation.
Just as a physical machine communicates with other machines in a network through a network card, a virtual
machine communicates with other virtual machines running in the same host through a virtual switch. Further,
a virtual machine communicates with the physical network, including virtual machines on other ESXi hosts,
through a physical network adapter, as shown in Figure 11-3.
Figure 11-3. Virtual Networking Through Virtual Switches
ESXi
Virtual Machine
virtual
network
adapter
Virtual Machine
virtual
network
adapter
VMkernel
Virtual
Networking
Layer
Virtual Switch
links virtual
machines together
Hardware Network Adapter
links virtual machines to
the physical network
Physical Network
These characteristics apply to virtual machine isolation in a network context:
n
If a virtual machine does not share a virtual switch with any other virtual machine, it is completely isolated
from virtual networks within the host.
n
If no physical network adapter is configured for a virtual machine, the virtual machine is completely
isolated from any physical networks.
n
If you use the same safeguards (firewalls, antivirus software, and so forth) to protect a virtual machine
from the network as you would for a physical machine, the virtual machine is as secure as the physical
machine.
You can further protect virtual machines by setting up resource reservations and limits on the host. For
example, through the detailed resource controls available in ESXi, you can configure a virtual machine so that
it always receives at least 10 percent of the host’s CPU resources, but never more than 20 percent.
VMware, Inc.
131
ESXi Configuration Guide
Resource reservations and limits protect virtual machines from performance degradation that would result if
another virtual machine consumed excessive shared hardware resources. For example, if one of the virtual
machines on a host is incapacitated by a denial-of-service (DoS) attack, a resource limit on that machine
prevents the attack from taking up so much of the hardware resources that the other virtual machines are also
affected. Similarly, a resource reservation on each of the virtual machines ensures that, in the event of high
resource demands by the virtual machine targeted by the DoS attack, all the other virtual machines still have
enough resources to operate.
By default, ESXi imposes a form of resource reservation by applying a distribution algorithm that divides the
available host resources equally among the virtual machines while keeping a certain percentage of resources
for use by other system components. This default behavior provides a degree of natural protection from DoS
and distributed denial-of-service (DDoS) attacks. You set specific resource reservations and limits on an
individual basis to customize the default behavior so that the distribution is not equal across the virtual machine
configuration.
Security and the Virtual Networking Layer
The virtual networking layer includes virtual network adapters and virtual switches. ESXi relies on the virtual
networking layer to support communications between virtual machines and their users. In addition, hosts use
the virtual networking layer to communicate with iSCSI SANs, NAS storage, and so forth.
The methods you use to secure a virtual machine network depend on which guest operating system is installed,
whether the virtual machines operate in a trusted environment, and a variety of other factors. Virtual switches
provide a substantial degree of protection when used with other common security practices, such as installing
firewalls.
ESXi also supports IEEE 802.1q VLANs, which you can use to further protect the virtual machine network or
storage configuration. VLANs let you segment a physical network so that two machines on the same physical
network cannot send packets to or receive packets from each other unless they are on the same VLAN.
Creating a Network DMZ on a Single ESXi Host
One example of how to use ESXi isolation and virtual networking features to configure a secure environment
is the creation of a network demilitarized zone (DMZ) on a single host.
Figure 11-4 shows the configuration.
Figure 11-4. DMZ Configured on a Single ESXi Host
ESXi
Virtual Machine 1
Virtual Machine 2
Virtual Machine 3
Virtual Machine 4
firewall server
web server
application server
firewall server
virtual switch 1
hardware network
adapter 1
External Network
virtual switch 2
virtual switch 3
hardware network
adapter 2
Internal Network
In this example, four virtual machines are configured to create a virtual DMZ on Virtual Switch 2:
132
n
Virtual Machine 1 and Virtual Machine 4 run firewalls and are connected to virtual adapters through
virtual switches. Both of these virtual machines are multi homed.
n
Virtual Machine 2 runs a Web server, and Virtual Machine 3 runs as an application server. Both of these
virtual machines are single-homed.
VMware, Inc.
Chapter 11 Security for ESXi Systems
The Web server and application server occupy the DMZ between the two firewalls. The conduit between these
elements is Virtual Switch 2, which connects the firewalls with the servers. This switch has no direct connection
with any elements outside the DMZ and is isolated from external traffic by the two firewalls.
From an operational viewpoint, external traffic from the Internet enters Virtual Machine 1 through Hardware
Network Adapter 1 (routed by Virtual Switch 1) and is verified by the firewall installed on this machine. If the
firewall authorizes the traffic, it is routed to the virtual switch in the DMZ, Virtual Switch 2. Because the Web
server and application server are also connected to this switch, they can serve external requests.
Virtual Switch 2 is also connected to Virtual Machine 4. This virtual machine provides a firewall between the
DMZ and the internal corporate network. This firewall filters packets from the Web server and application
server. If a packet is verified, it is routed to Hardware Network Adapter 2 through Virtual Switch 3. Hardware
Network Adapter 2 is connected to the internal corporate network.
When creating a DMZ on a single host, you can use fairly lightweight firewalls. Although a virtual machine
in this configuration cannot exert direct control over another virtual machine or access its memory, all the
virtual machines are still connected through a virtual network. This network could be used for virus
propagation or targeted for other types of attacks. The security of the virtual machines in the DMZ is equivalent
to separate physical machines connected to the same network.
Creating Multiple Networks Within a Single ESXi Host
The ESXi system is designed so that you can connect some groups of virtual machines to the internal network,
others to the external network, and still others to both—all on the same host. This capability is an outgrowth
of basic virtual machine isolation coupled with a well-planned use of virtual networking features.
Figure 11-5. External Networks, Internal Networks, and a DMZ Configured on a Single ESXi Host
ESXi
External Network
Internal Network
DMZ
VM 2
internal
user
VM 3
VM 6
internal
user
firewall
server
VM 4
VM 7
internal
user
Web
server
VM 1
VM 5
VM 8
FTP
server
internal
user
firewall
server
physical network
adapters
External
Network 1
Internal
Network 2
External
Network 2
Internal
Network 1
In Figure 11-5 the system administrator configured a host into three distinct virtual machine zones: FTP server,
internal virtual machines, and DMZ. Each zone serves a unique function.
FTP server
VMware, Inc.
Virtual Machine 1 is configured with FTP software and acts as a holding area
for data sent to and from outside resources such as forms and collateral
localized by a vendor.
133
ESXi Configuration Guide
This virtual machine is associated with an external network only. It has its own
virtual switch and physical network adapter that connect it to External
Network 1. This network is dedicated to servers that the company uses to
receive data from outside sources. For example, the company uses External
Network 1 to receive FTP traffic from vendors and allow vendors access to data
stored on externally available servers though FTP. In addition to servicing
Virtual Machine 1, External Network 1 services FTP servers configured on
different ESXi hosts throughout the site.
Because Virtual Machine 1 does not share a virtual switch or physical network
adapter with any virtual machines in the host, the other resident virtual
machines cannot transmit packets to or receive packets from the Virtual
Machine 1 network. This restriction prevents sniffing attacks, which require
sending network traffic to the victim. More importantly, an attacker cannot use
the natural vulnerability of FTP to access any of the host’s other virtual
machines.
Internal virtual machines
Virtual Machines 2 through 5 are reserved for internal use. These virtual
machines process and store company-private data such as medical records,
legal settlements, and fraud investigations. As a result, the system
administrators must ensure the highest level of protection for these virtual
machines.
These virtual machines connect to Internal Network 2 through their own virtual
switch and network adapter. Internal Network 2 is reserved for internal use by
personnel such as claims processors, in-house lawyers, or adjustors.
Virtual Machines 2 through 5 can communicate with one another through the
virtual switch and with internal virtual machines elsewhere on Internal
Network 2 through the physical network adapter. They cannot communicate
with externally facing machines. As with the FTP server, these virtual machines
cannot send packets to or receive packets from the other virtual machines’
networks. Similarly, the host’s other virtual machines cannot send packets to
or receive packets from Virtual Machines 2 through 5.
DMZ
Virtual Machines 6 through 8 are configured as a DMZ that the marketing
group uses to publish the company’s external Web site.
This group of virtual machines is associated with External Network 2 and
Internal Network 1. The company uses External Network 2 to support the Web
servers that use the marketing and financial department to host the corporate
Web site and other Web facilities that it hosts to outside users. Internal Network
1 is the conduit that the marketing department uses to publish content to the
corporate Web site, post downloads, and maintain services like user forums.
Because these networks are separate from External Network 1 and Internal
Network 2, and the virtual machines have no shared points of contact (switches
or adapters), there is no risk of attack to or from the FTP server or the internal
virtual machine group.
By capitalizing on virtual machine isolation, correctly configuring virtual switches, and maintaining network
separation, the system administrator can house all three virtual machine zones in the same ESXi host and be
confident that there will be no data or resource breaches.
The company enforces isolation among the virtual machine groups by using multiple internal and external
networks and making sure that the virtual switches and physical network adapters for each group are
completely separate from those of other groups.
134
VMware, Inc.
Chapter 11 Security for ESXi Systems
Because none of the virtual switches straddle virtual machine zones, the system administrator succeeds in
eliminating the risk of packet leakage from one zone to another. A virtual switch, by design, cannot leak packets
directly to another virtual switch. The only way for packets to travel from one virtual switch to another is under
the following circumstances:
n
The virtual switches are connected to the same physical LAN.
n
The virtual switches connect to a common virtual machine, which could be used to transmit packets.
Neither of these conditions occur in the sample configuration. If system administrators want to verify that no
common virtual switch paths exist, they can check for possible shared points of contact by reviewing the
network switch layout in the vSphere Client.
To safeguard the virtual machines’ resources, the system administrator lowers the risk of DoS and DDoS attacks
by configuring a resource reservation and a limit for each virtual machine. The system administrator further
protects the ESXi host and virtual machines by installing software firewalls at the front and back ends of the
DMZ, ensuring that the host is behind a physical firewall, and configuring the networked storage resources
so that each has its own virtual switch.
Security Resources and Information
You can find additional information about security on the VMware Web site.
Table 11-1 lists security topics and the location of additional information about these topics.
Table 11-1. VMware Security Resources on the Web
Topic
Resource
VMware security policy, up-to-date security
alerts, security downloads, and focus
discussions of security topics
http://www.vmware.com/security/
Corporate security response policy
http://www.vmware.com/support/policies/security_response.html
VMware is committed to helping you maintain a secure environment.
Security issues are corrected in a timely manner. The VMware Security
Response Policy states our commitment to resolve possible
vulnerabilities in our products.
Third-party software support policy
http://www.vmware.com/support/policies/
VMware supports a variety of storage systems, software agents such as
backup agents, system management agents, and so forth. You can find
lists of agents, tools, and other software that supports ESXi by searching
http://www.vmware.com/vmtn/resources/ for ESXi compatibility
guides.
The industry offers more products and configurations than VMware can
test. If VMware does not list a product or configuration in a compatibility
guide, Technical Support will attempt to help you with any problems,
but cannot guarantee that the product or configuration can be used.
Always evaluate security risks for unsupported products or
configurations carefully.
Certification of VMware products
http://www.vmware.com/security/certifications/
VMware, Inc.
135
ESXi Configuration Guide
136
VMware, Inc.
Securing an ESXi Configuration
12
You can take measures to promote a secure environment for your ESXi hosts, virtual machines, and iSCSI
SANs. Consider network configuration planning from a security perspective and the steps that you can take
to protect the components in your configuration from attack.
This chapter includes the following topics:
n
“Securing the Network with Firewalls,” on page 137
n
“Securing Virtual Machines with VLANs,” on page 143
n
“Securing Virtual Switch Ports,” on page 148
n
“Securing iSCSI Storage,” on page 149
Securing the Network with Firewalls
Security administrators use firewalls to safeguard the network or selected components in the network from
intrusion.
Firewalls control access to devices within their perimeter by closing all communication pathways, except for
those that the administrator explicitly or implicitly designates as authorized. The pathways, or ports, that
administrators open in the firewall allow traffic between devices on different sides of the firewall.
ESXi does not include a firewall because it runs a limited set of well-known services and prevents the addition
of further services. With such restrictions, the factors that necessitate a firewall are significantly reduced.
No firewall is integrated in to ESXi. You must deploy a set of security technologies that is appropriate to your
needs. For example, you might elect to install a firewall to filter traffic entering and leaving the network segment
on which you have installed ESXi.
In a virtual machine environment, you can plan your layout for firewalls between components.
n
Physical machines such as vCenter Server hosts and ESXi hosts.
n
One virtual machine and another—for example, between a virtual machine acting as an external Web
server and a virtual machine connected to your company’s internal network.
n
A physical machine and a virtual machine, such as when you place a firewall between a physical network
adapter card and a virtual machine.
How you use firewalls in an ESXi configuration is based on how you plan to use the network and how secure
any given component needs to be. For example, if you create a virtual network where each virtual machine is
dedicated to running a different benchmark test suite for the same department, the risk of unwanted access
from one virtual machine to the next is minimal. Therefore, a configuration where firewalls are present between
the virtual machines is not necessary. However, to prevent interruption of a test run from an outside host, you
might set up the configuration so that a firewall is present at the entry point of the virtual network to protect
the entire set of virtual machines.
VMware, Inc.
137
ESXi Configuration Guide
Firewalls for Configurations with vCenter Server
If you access ESXi hosts through vCenter Server, you typically protect vCenter Server using a firewall. This
firewall provides basic protection for your network.
A firewall might lie between the clients and vCenter Server. Alternatively, vCenter Server and the clients can
be behind the firewall, depending on your deployment. The main point is to ensure that a firewall is present
at what you consider to be an entry point for the system.
If you use vCenter Server, you can install firewalls at any of the locations shown in Figure 12-1. Depending on
your configuration, you might not need all the firewalls in the illustration, or you might need firewalls in other
locations. In addition, your configuration might include optional modules, such as VMware vCenter Update
Manager, that are not shown. Refer to the documentation for information about firewall setups specific to
products like Update Manager.
For a comprehensive list of TCP and UDP ports, including those for VMware VMotion™ and VMware Fault
Tolerance, see “TCP and UDP Ports for Management Access,” on page 142.
Figure 12-1. Sample vSphere Network Configuration and Traffic Flow
22
427
443
902
902 (UDP)
903
2050 - 2250
5989
8042 - 8045
SSH
SLPv2
HTTPS
xinetd/vmware-authd
ESX/ESXi status update
xinetd/vmware-authd-mks
HA
CIM transactions
HA
third-party network
management tool
vSphere
Web Access
vSphere
Client
Port 443
firewall
vCenter Server
Ports 427, 443,
902, 903
Ports 22, 427,
443, 902,
903
Ports 443,
902, 5989
Port 443
firewall
902
UDP
902
UDP
Ports 443, 902,
2050-2250,
and 8042-8045
firewall
ESXi
ESX
storage
Networks configured with vCenter Server can receive communications through the vSphere Client or thirdparty network management clients that use the SDK to interface with the host. During normal operation,
vCenter Server listens for data from its managed hosts and clients on designated ports. vCenter Server also
assumes that its managed hosts listen for data from vCenter Server on designated ports. If a firewall is present
between any of these elements, you must ensure that the firewall has open ports to support data transfer.
138
VMware, Inc.
Chapter 12 Securing an ESXi Configuration
You might also include firewalls at a variety of other access points in the network, depending on how you plan
to use the network and the level of security various devices require. Select the locations for your firewalls based
on the security risks that you have identified for your network configuration. The following is a list of firewall
locations common to ESXi implementations. Many of the firewall locations in the list and shown in
Figure 12-1 are optional.
n
Between the vSphere Client or a third-party network management client and vCenter Server.
n
If your users access virtual machines through the vSphere Client, between the vSphere Client and the ESXi
host. This connection is in addition to the connection between the vSphere Client and vCenter Server, and
it requires a different port.
n
Between vCenter Server and the ESXi hosts.
n
Between the ESXi hosts in your network. Although traffic between hosts is usually considered trusted,
you can add firewalls between them if you are concerned about security breaches from machine to
machine.
If you add firewalls between ESXi hosts and plan to migrate virtual machines between the servers, perform
cloning, or use VMotion, you must also open ports in any firewall that divides the source host from the
target hosts so that the source and targets can communicate.
Between the ESXi hosts and network storage such as NFS or iSCSI storage. These ports are not specific to
VMware, and you configure them according to the specifications for your network.
n
Firewalls for Configurations Without vCenter Server
If you connect clients directly to your ESXi network instead of using vCenter Server, your firewall configuration
is somewhat simpler.
You might install firewalls at any of the locations shown in Figure 12-2.
NOTE Depending on your configuration, you might not need all the firewalls in the illustration, or you might
need firewalls in locations not shown.
Figure 12-2. Firewall Configuration for ESXi Networks that a Client Manages Directly
third-party network
management tool
vSphere Client
Port 902
Port 903
Port 443
firewall
Ports 902, 2050-2250,
8000, 8042-8045,
8100, 8200
firewall
ESX
ESXi
storage
VMware, Inc.
139
ESXi Configuration Guide
Networks configured without vCenter Server receive communications through the same types of clients as
they do if vCenter Server were present: vSphere Clients or third-party network management clients. For the
most part, the firewall needs are the same, but there are several key differences.
n
As you would for configurations that include vCenter Server, be sure a firewall is present to protect your
ESXi layer or, depending on your configuration, your clients and ESXi layer. This firewall provides basic
protection for your network. The firewall ports you use are the same as those you use if vCenter Server is
in place.
n
Licensing in this type of configuration is part of the ESXi package that you install on each of the hosts.
Because licensing is resident to the server, a separate license server is not required. This eliminates the
need for a firewall between the license server and the ESXi network.
Connecting to vCenter Server Through a Firewall
The port that vCenter Server uses to listen for data transfer from its clients is 443. If you have a firewall between
vCenter Server and its clients, you must configure a connection through which vCenter Server can receive data
from the clients.
To enable vCenter Server to receive data from the vSphere Client, open port 443 in the firewall to allow data
transfer from the vSphere Client to vCenter Server. Contact the firewall system administrator for additional
information on configuring ports in a firewall.
If you are using the vSphere Client and do not want to use port 443 as the port for vSphere Client-to-vCenter
Server communication, you can switch to another port by changing the vCenter Server settings in the vSphere
Client. To learn how to change these settings, see the Basic System Administration Guide.
Connecting to the Virtual Machine Console Through a Firewall
Whether you connect your client to ESXi hosts through vCenter Server or use a direct connection to the host,
certain ports are required for user and administrator communication with virtual machine consoles. These
ports support different client functions, interface with different layers on ESXi, and use different authentication
protocols.
Port 902
This is the port that vCenter Server assumes is available for receiving data from
the ESXi host. The vSphere Client uses this port to provide a connection for
guest operating system mouse, keyboard, screen (MKS) activities on virtual
machines. It is through this port that users interact with the virtual machine
guest operating systems and applications. Port 902 is the port that the vSphere
Client assumes is available when interacting with virtual machines.
Port 902 connects vCenter Server to the host through the VMware
Authorization Daemon (vmware-authd). This daemon multiplexes port 902 data
to the appropriate recipient for processing. VMware does not support
configuring a different port for this connection.
Port 443
The vSphere Client and SDK use this port to send data to vCenter Server
managed hosts. Also, the vSphere Client and SDK, when connected directly to
an ESXi host, use this port to support any management functions related to the
server and its virtual machines. Port 443 is the port that clients assume is
available when sending data to the ESXi host. VMware does not support
configuring a different port for these connections.
Port 443 connects clients to the ESXi host through the SDK. The vmware-hostd
multiplexes port 443 data to the appropriate recipient for processing.
Figure 12-3 shows the relationships between vSphere Client functions, ports, and ESXi processes.
140
VMware, Inc.
Chapter 12 Securing an ESXi Configuration
Figure 12-3. Port Use for vSphere Client Communications with ESXi
vSphere Client
virtual machine
management functions
virtual machine
console
Port 443
firewall
Port 903
ESXi
vmware-hostd
vmware-authd
If you have a firewall between your vCenter Server system and vCenter Server managed host, open ports 443
and 902 in the firewall to allow data transfer to ESXi hosts from vCenter Server and ESXi hosts directly from
the vSphere Client.
For additional information on configuring the ports, see the firewall system administrator.
Connecting ESXi Hosts Through Firewalls
If you have a firewall between two ESXi hosts and you want to allow transactions between the hosts or use
vCenter Server to perform any source or target activities, such as VMware High Availability (HA) traffic,
migration, cloning, or VMotion, you must configure a connection through which the managed hosts can receive
data.
To configure a connection for receiving data, open ports in the following ranges:
n
902 (server-to-server migration and provisioning traffic)
n
2050–2250 (for HA traffic)
n
8000 (for VMotion)
n
8042–8045 (for HA traffic)
Refer to the firewall system administrator for additional information on configuring the ports.
Configuring Firewall Ports for Supported Services and Management Agents
You must configure firewalls in your environment to accept commonly supported services and installed
management agents.
Although ESXi has no firewall itself, you must configure any other firewalls in your environment to accept
services and management agents.
The following services and agents are commonly present in a vSphere environment:
n
NFS client (insecure service)
n
NTP client
n
iSCSI software client
n
CIM HTTP server (insecure service)
VMware, Inc.
141
ESXi Configuration Guide
n
CIM HTTPS server
n
Syslog client
NOTE This list can change so you might find that some services and agents are not mentioned in the list. You
might be required to perform additional activities to configure and enable these services.
TCP and UDP Ports for Management Access
vCenter Server, ESXi hosts, and other network components are accessed using predetermined TCP and UDP
ports. If you manage network components from outside a firewall, you might be required to reconfigure the
firewall to allow access on the appropriate ports.
Table 12-1 lists TCP and UDP ports, and the purpose and the type of each.
Table 12-1. TCP and UDP Ports
142
Port
Purpose
Traffic Type
80
HTTP access
The default non-secure TCP Web port typically used in conjunction with port 443
as a front end for access to ESXi networks from the Web. Port 80 redirects traffic
to an HTTPS landing page (port 443).
WS-Management
Incoming TCP
123
NTP Client
Outgoing UDP
427
The CIM client uses the Service Location Protocol, version 2 (SLPv2) to find CIM
servers.
Incoming and
outgoing UDP
443
HTTPS access
vCenter Server access to ESXi hosts
Default SSL Web port
vSphere Client access to vCenter Server
vSphere Client access to ESXi hosts
WS-Management
vSphere Client access to vSphere Update Manager
vSphere Converter access to vCenter Server
Incoming TCP
902
Host access to other hosts for migration and provisioning
Authentication traffic for ESXi and remote console traffic (xinetd/vmware-authd)
vSphere Client access to virtual machine consoles
(UDP) Status update (heartbeat) connection from ESXi to vCenter Server
Incoming TCP,
outgoing UDP
2049
Transactions from NFS storage devices
This port is used on the VMkernel interface.
Incoming and
outgoing TCP
2050–2250
Traffic between ESXi hosts for VMware High Availability (HA) and EMC
Autostart Manager
Outgoing TCP,
incoming and
outgoing UDP
3260
Transactions to iSCSI storage devices
This port is used on the VMkernel interface.
Outgoing TCP
5900-5964
RFB protocol, which is used by management tools such as VNC
Incoming and
outgoing TCP
5989
CIM XML transactions over HTTPS
Incoming and
outgoing TCP
8000
Requests from VMotion
Incoming and
outgoing TCP
VMware, Inc.
Chapter 12 Securing an ESXi Configuration
Table 12-1. TCP and UDP Ports (Continued)
Port
Purpose
Traffic Type
8042–8045
Traffic between ESXi hosts for HA and EMC Autostart Manager
Outgoing TCP,
incoming and
outgoing UDP
8100, 8200
Traffic between ESXi hosts for VMware Fault Tolerance
Outgoing TCP,
incoming and
outgoing UDP
In addition to the TCP and UDP ports, you can configure other ports depending on your needs. You can use
vSphere Client to open ports for installed management agents and supported services such as NFS.
Securing Virtual Machines with VLANs
The network can be one of the most vulnerable parts of any system. Your virtual machine network requires as
much protection as your physical network. You can add security to your virtual machine network in several
ways.
If your virtual machine network is connected to a physical network, it can be subject to breaches to the same
degree that a network made up of physical machines is. Even if the virtual machine network is isolated from
any physical network, virtual machines in the network can be subject to attacks from other virtual machines
in the network. The requirements for securing virtual machines are often the same as those for physical
machines.
Virtual machines are isolated from each other. One virtual machine cannot read or write another virtual
machine’s memory, access its data, use its applications, and so forth. However, within the network, any virtual
machine or group of virtual machines can still be the target of unauthorized access from other virtual machines
and might require further protection by external means.
VMware, Inc.
143
ESXi Configuration Guide
You can add this level of security in different ways.
n
Adding firewall protection to your virtual network by installing and configuring software firewalls on
some or all of its virtual machines.
For efficiency, you can set up private virtual machine Ethernet networks or virtual networks. With virtual
networks, you install a software firewall on a virtual machine at the head of the virtual network. This
serves as a protective buffer between the physical network adapter and the remaining virtual machines
in the virtual network.
Installing a software firewall on virtual machines at the head of virtual networks is a good security practice.
However, because software firewalls can slow performance, balance your security needs against
performance before you decide to install software firewalls on virtual machines elsewhere in the virtual
network.
n
Keeping different virtual machine zones within a host on different network segments. If you isolate virtual
machine zones on their own network segments, you minimize the risks of data leakage from one virtual
machine zone to the next. Segmentation prevents various threats, including Address Resolution Protocol
(ARP) spoofing, in which an attacker manipulates the ARP table to remap MAC and IP addresses, thereby
gaining access to network traffic to and from a host. Attackers use ARP spoofing to generate denials of
service, hijack the target system, and otherwise disrupt the virtual network.
Planning segmentation carefully lowers the chances of packet transmissions between virtual machine
zones, which prevents sniffing attacks that require sending network traffic to the victim. Also, an attacker
cannot use an insecure service in one virtual machine zone to access other virtual machine zones in the
host. You can implement segmentation by using either of two approaches, each of which has different
benefits.
n
Use separate physical network adapters for virtual machine zones to ensure that the zones are isolated.
Maintaining separate physical network adapters for virtual machine zones is probably the most secure
method and is less prone to misconfiguration after the initial segment creation.
n
Set up virtual local area networks (VLANs) to help safeguard your network. Because VLANs provide
almost all of the security benefits inherent in implementing physically separate networks without the
hardware overhead, they offer a viable solution that can save you the cost of deploying and
maintaining additional devices, cabling, and so forth.
VLANs are an IEEE standard networking scheme with specific tagging methods that allow routing of packets
to only those ports that are part of the VLAN. When properly configured, VLANs provide a dependable means
for you to protect a set of virtual machines from accidental or malicious intrusions.
VLANs let you segment a physical network so that two machines in the network are unable to transmit packets
back and forth unless they are part of the same VLAN. For example, accounting records and transactions are
among a company’s most sensitive internal information. In a company whose sales, shipping, and accounting
employees all use virtual machines in the same physical network, you might protect the virtual machines for
the accounting department by setting up VLANs as shown in Figure 12-4.
144
VMware, Inc.
Chapter 12 Securing an ESXi Configuration
Figure 12-4. Sample VLAN Layout
Host 1
vSwitch
Router
Host 2
VM0
VM1
VM2
VM3
VM4
VM5
Broadcast
Domain A
VM8
VLAN B
VLAN A
vSwitch
vSwitch
Switch 1
VM6
Host 3
Broadcast
Domain B
vSwitch
VM9
Switch 2
VM7
VM10
VM11
Host 4
vSwitch
VM12
VLAN
B
VM13
VLAN
A
VM14
VLAN
B
Multiple VLANs
on the same
virtual switch
Broadcast
Domains A and B
In this configuration, all employees in the accounting department use virtual machines in VLAN A and the
employees in sales use virtual machines in VLAN B.
The router forwards packets containing accounting data to the switches. These packets are tagged for
distribution to VLAN A only. Therefore, the data is confined to Broadcast Domain A and cannot be routed to
Broadcast Domain B unless the router is configured to do so.
This VLAN configuration prevents the sales force from intercepting packets destined for the accounting
department. It also prevents the accounting department from receiving packets intended for the sales group.
The virtual machines serviced by a single virtual switch can be in different VLANs.
Security Considerations for VLANs
The way you set up VLANs to secure parts of a network depends on factors such as the guest operating system
and the way your network equipment is configured.
ESXi features a complete IEEE 802.1q-compliant VLAN implementation. VMware cannot make specific
recommendations on how to set up VLANs, but there are factors to consider when using a VLAN deployment
as part of your security enforcement policy.
VMware, Inc.
145
ESXi Configuration Guide
VLANs as Part of a Broader Security Implementation
VLANs are an effective means of controlling where and how widely data is transmitted within the network.
If an attacker gains access to the network, the attack is likely to be limited to the VLAN that served as the entry
point, lessening the risk to the network as a whole.
VLANs provide protection only in that they control how data is routed and contained after it passes through
the switches and enters the network. You can use VLANs to help secure Layer 2 of your network architecture
—the data link layer. However, configuring VLANs does not protect the physical layer of your network model
or any of the other layers. Even if you create VLANs, provide additional protection by securing your hardware
(routers, hubs, and so forth) and encrypting data transmissions.
VLANs are not a substitute for firewalls in your virtual machine configurations. Most network configurations
that include VLANs also include software firewalls. If you include VLANs in your virtual network, be sure
that the firewalls that you install are VLAN-aware.
Properly Configure VLANs
Equipment misconfiguration and network hardware, firmware, or software defects can make a VLAN
susceptible to VLAN-hopping attacks.
VLAN hopping occurs when an attacker with authorized access to one VLAN creates packets that trick physical
switches into transmitting the packets to another VLAN that the attacker is not authorized to access.
Vulnerability to this type of attack usually results from a switch being misconfigured for native VLAN
operation, in which the switch can receive and transmit untagged packets.
To help prevent VLAN hopping, keep your equipment up to date by installing hardware and firmware updates
as they become available. Also, follow your vendor’s best practice guidelines when you configure your
equipment.
VMware virtual switches do not support the concept of a native VLAN. All data passed on these switches is
appropriately tagged. However, because other switches in the network might be configured for native VLAN
operation, VLANs configured with virtual switches can still be vulnerable to VLAN hopping.
If you plan to use VLANs to enforce network security, disable the native VLAN feature for all switches unless
you have a compelling reason to operate some of your VLANs in native mode. If you must use native VLAN,
see your switch vendor’s configuration guidelines for this feature.
Virtual Switch Protection and VLANs
VMware virtual switches provide safeguards against certain threats to VLAN security. Because of the way that
virtual switches are designed, they protect VLANs against a variety of attacks, many of which involve VLAN
hopping.
Having this protection does not guarantee that your virtual machine configuration is invulnerable to other
types of attacks. For example, virtual switches do not protect the physical network against these attacks; they
protect only the virtual network.
146
VMware, Inc.
Chapter 12 Securing an ESXi Configuration
Virtual switches and VLANs can protect against the following types of attacks.
MAC flooding
Floods a switch with packets that contain MAC addresses tagged as having
come from different sources. Many switches use a content-addressable
memory (CAM) table to learn and store the source address for each packet.
When the table is full, the switch can enter a fully open state in which every
incoming packet is broadcast on all ports, letting the attacker see all of the
switch’s traffic. This state might result in packet leakage across VLANs.
Although VMware virtual switches store a MAC address table, they do not get
the MAC addresses from observable traffic and are not vulnerable to this type
of attack.
802.1q and ISL tagging
attacks
Force a switch to redirect frames from one VLAN to another by tricking the
switch into acting as a trunk and broadcasting the traffic to other VLANs.
VMware virtual switches do not perform the dynamic trunking required for
this type of attack and, therefore, are not vulnerable.
Double-encapsulation
attacks
Occur when an attacker creates a double-encapsulated packet in which the
VLAN identifier in the inner tag is different from the VLAN identifier in the
outer tag. For backward compatibility, native VLANs strip the outer tag from
transmitted packets unless configured to do otherwise. When a native VLAN
switch strips the outer tag, only the inner tag is left, and that inner tag routes
the packet to a different VLAN than the one identified in the now-missing outer
tag.
VMware virtual switches drop any double-encapsulated frames that a virtual
machine attempts to send on a port configured for a specific VLAN. Therefore,
they are not vulnerable to this type of attack.
Multicast brute-force
attacks
Involve sending large numbers of multicast frames to a known VLAN almost
simultaneously to overload the switch so that it mistakenly allows some of the
frames to broadcast to other VLANs.
VMware virtual switches do not allow frames to leave their correct broadcast
domain (VLAN) and are not vulnerable to this type of attack.
Spanning-tree attacks
Target Spanning-Tree Protocol (STP), which is used to control bridging
between parts of the LAN. The attacker sends Bridge Protocol Data Unit
(BPDU) packets that attempt to change the network topology, establishing
themselves as the root bridge. As the root bridge, the attacker can sniff the
contents of transmitted frames.
VMware virtual switches do not support STP and are not vulnerable to this
type of attack.
Random frame attacks
Involve sending large numbers of packets in which the source and destination
addresses stay the same, but in which fields are randomly changed in length,
type, or content. The goal of this attack is to force packets to be mistakenly
rerouted to a different VLAN.
VMware virtual switches are not vulnerable to this type of attack.
Because new security threats develop over time, do not consider this an exhaustive list of attacks. Regularly
check VMware security resources on the Web to learn about security, recent security alerts, and VMware
security tactics.
VMware, Inc.
147
ESXi Configuration Guide
Securing Virtual Switch Ports
As with physical network adapters, a virtual network adapter can send frames that appear to be from a different
machine or impersonate another machine so that it can receive network frames intended for that machine.
Also, like physical network adapters, a virtual network adapter can be configured so that it receives frames
targeted for other machines.
When you create a virtual switch for your network, you add port groups to impose a policy configuration for
the virtual machines and storage systems attached to the switch. You create virtual ports through the vSphere
Client.
As part of adding a port or port group to a virtual switch, the vSphere Client configures a security profile for
the port. You can use this security profile to ensure that ESXi prevents the guest operating systems for its virtual
machines from impersonating other machines on the network. This security feature is implemented so that the
guest operating system responsible for the impersonation does not detect that the impersonation was
prevented.
The security profile determines how strongly you enforce protection against impersonation and interception
attacks on virtual machines. To correctly use the settings in the security profile, you must understand the basics
of how virtual network adapters control transmissions and how attacks are staged at this level.
Each virtual network adapter has its own MAC address assigned when the adapter is created. This address is
called the initial MAC address. Although the initial MAC address can be reconfigured from outside the guest
operating system, it cannot be changed by the guest operating system. In addition, each adapter has an effective
MAC address that filters out incoming network traffic with a destination MAC address different from the
effective MAC address. The guest operating system is responsible for setting the effective MAC address and
typically matches the effective MAC address to the initial MAC address.
When sending packets, an operating system typically places its own network adapter’s effective MAC address
in the source MAC address field of the Ethernet frame. It also places the MAC address for the receiving network
adapter in the destination MAC address field. The receiving adapter accepts packets only when the destination
MAC address in the packet matches its own effective MAC address.
Upon creation, a network adapter’s effective MAC address and initial MAC address are the same. The virtual
machine’s operating system can alter the effective MAC address to another value at any time. If an operating
system changes the effective MAC address, its network adapter receives network traffic destined for the new
MAC address. The operating system can send frames with an impersonated source MAC address at any time.
This means an operating system can stage malicious attacks on the devices in a network by impersonating a
network adapter that the receiving network authorizes.
You can use virtual switch security profiles on ESXi hosts to protect against this type of attack by setting three
options. If you change any default settings for a port, you must modify the security profile by editing virtual
switch settings in the vSphere Client.
MAC Address Changes
The setting for the MAC Address Changes option affects traffic that a virtual machine receives.
When the option is set to Accept, ESXi accepts requests to change the effective MAC address to other than the
initial MAC address.
When the option is set to Reject, ESXi does not honor requests to change the effective MAC address to anything
other than the initial MAC address, which protects the host against MAC impersonation. The port that the
virtual adapter used to send the request is disabled and the virtual adapter does not receive any more frames
until it changes the effective MAC address to match the initial MAC address. The guest operating system does
not detect that the MAC address change was not honored.
NOTE The iSCSI initiator relies on being able to get MAC address changes from certain types of storage. If you
are using ESXi iSCSI and have iSCSI storage, set the MAC Address Changes option to Accept.
148
VMware, Inc.
Chapter 12 Securing an ESXi Configuration
In some situations, you might have a legitimate need for more than one adapter to have the same MAC address
on a network—for example, if you are using Microsoft Network Load Balancing in unicast mode. When
Microsoft Network Load Balancing is used in the standard multicast mode, adapters do not share MAC
addresses.
MAC address changes settings affect traffic leaving a virtual machine. MAC address changes will occur if the
sender is permitted to make them, even if vSwitches or a receiving virtual machine does not permit MAC
address changes.
Forged Transmissions
The setting for the Forged Transmits option affects traffic that is transmitted from a virtual machine.
When the option is set to Accept, ESXi does not compare source and effective MAC addresses.
To protect against MAC impersonation, you can set this option to Reject. If you do, the host compares the
source MAC address being transmitted by the operating system with the effective MAC address for its adapter
to see if they match. If the addresses do not match, ESXi drops the packet.
The guest operating system does not detect that its virtual network adapter cannot send packets by using the
impersonated MAC address. The ESXi host intercepts any packets with impersonated addresses before they
are delivered, and the guest operating system might assume that the packets are dropped.
Promiscuous Mode Operation
Promiscuous mode eliminates any reception filtering that the virtual network adapter would perform so that
the guest operating system receives all traffic observed on the wire. By default, the virtual network adapter
cannot operate in promiscuous mode.
Although promiscuous mode can be useful for tracking network activity, it is an insecure mode of operation,
because any adapter in promiscuous mode has access to the packets regardless of whether some of the packets
are received only by a particular network adapter. This means that an administrator or root user within a
virtual machine can potentially view traffic destined for other guest or host operating systems.
NOTE In some situations, you might have a legitimate reason to configure a virtual switch to operate in
promiscuous mode—for example, if you are running network intrusion detection software or a packet sniffer.
Securing iSCSI Storage
The storage you configure for an ESXi host might include one or more storage area networks (SANs) that use
iSCSI. When you configure iSCSI on an ESXi host, you can take several measures to minimize security risks.
iSCSI is a means of accessing SCSI devices and exchanging data records by using TCP/IP over a network port
rather than through a direct connection to a SCSI device. In iSCSI transactions, blocks of raw SCSI data are
encapsulated in iSCSI records and transmitted to the requesting device or user.
iSCSI SANs let you make efficient use of existing Ethernet infrastructures to provide ESXi hosts access to storage
resources that they can dynamically share. iSCSI SANs provide an economical storage solution for
environments that rely on a common storage pool to serve numerous users. As with any networked system,
your iSCSI SANs can be subject to security breaches.
NOTE The requirements and procedures for securing an iSCSI SAN are similar for the hardware iSCSI adapters
you can use with ESXi hosts and for iSCSI configured directly through the ESXi host.
VMware, Inc.
149
ESXi Configuration Guide
Securing iSCSI Devices Through Authentication
One means of securing iSCSI devices from unwanted intrusion is to require that the ESXi host, or initiator, be
authenticated by the iSCSI device, or target, whenever the host attempts to access data on the target LUN.
The goal of authentication is to prove that the initiator has the right to access a target, a right granted when
you configure authentication.
ESXi does not support Kerberos, Secure Remote Protocol (SRP), or public-key authentication methods for iSCSI.
Additionally, it does not support IPsec authentication and encryption.
Use the vSphere Client to determine whether authentication is being performed and to configure the
authentication method.
Enabling Challenge Handshake Authentication Protocol (CHAP) for iSCSI SANs
You can configure the iSCSI SAN to use CHAP authentication.
In CHAP authentication, when the initiator contacts an iSCSI target, the target sends a predefined ID value
and a random value, or key, to the initiator. The initiator creates a one-way hash value that it sends to the
target. The hash contains three elements: a predefined ID value, the random value that the target sends, and
a private value, or CHAP secret, that the initiator and target share. When the target receives the hash from the
initiator, it creates its own hash value by using the same elements and compares it to the initiator’s hash. If the
results match, the target authenticates the initiator.
ESXi supports unidirectional and bidirectional CHAP authentication for iSCSI. In unidirectional CHAP
authentication, the target authenticates the initiator, but the initiator does not authenticate the target. In
bidirectional CHAP authentication, an additional level of security enables the initiator to authenticate the
target.
ESXi supports CHAP authentication at the adapter level, when only one set of authentication credentials can
be sent from the host to all targets. It also supports per-target CHAP authentication, which enables you to
configure different credentials for each target to achieve greater target refinement.
See “Configuring CHAP Parameters for iSCSI Initiators,” on page 85 for information about how to work with
CHAP.
Disabling iSCSI SAN Authentication
You can configure the iSCSI SAN to use no authentication. Communications between the initiator and target
are still authenticated in a rudimentary way because the iSCSI target devices are typically set up to
communicate with specific initiators only.
Choosing not to enforce more stringent authentication can make sense if your iSCSI storage is housed in one
location and you create a dedicated network or VLAN to service all your iSCSI devices. The iSCSI configuration
is secure because it is isolated from any unwanted access, much as a Fibre Channel SAN is.
As a basic rule, disable authentication only if you are willing to risk an attack to the iSCSI SAN or cope with
problems that result from human error.
ESXi does not support Kerberos, Secure Remote Protocol (SRP), or public-key authentication methods for iSCSI.
Additionally, it does not support IPsec authentication and encryption.
Use the vSphere Client to determine whether authentication is being performed and to configure the
authentication method.
See “Configuring CHAP Parameters for iSCSI Initiators,” on page 85 for information about how to work with
CHAP.
150
VMware, Inc.
Chapter 12 Securing an ESXi Configuration
Protecting an iSCSI SAN
When you plan your iSCSI configuration, take measures to improve the overall security of the iSCSI SAN. Your
iSCSI configuration is only as secure as your IP network, so by enforcing good security standards when you
set up your network, you help safeguard your iSCSI storage.
The following are some specific suggestions for enforcing good security standards.
Protect Transmitted Data
A primary security risk in iSCSI SANs is that an attacker might sniff transmitted storage data.
Take additional measures to prevent attackers from easily seeing iSCSI data. Neither the hardware iSCSI
adapter nor the ESXi host iSCSI initiator encrypts the data that they transmit to and from the targets, making
the data more vulnerable to sniffing attacks.
Allowing your virtual machines to share virtual switches and VLANs with your iSCSI configuration potentially
exposes iSCSI traffic to misuse by a virtual machine attacker. To help ensure that intruders cannot listen to
iSCSI transmissions, make sure that none of your virtual machines can see the iSCSI storage network.
If you use a hardware iSCSI adapter, you can accomplish this by making sure that the iSCSI adapter and
ESXi physical network adapter are not inadvertently connected outside the host by virtue of sharing a switch
or some other means. If you configure iSCSI directly through the ESXi host, you can accomplish this by
configuring iSCSI storage through a different virtual switch than the one used by your virtual machines, as
shown in Figure 12-5.
Figure 12-5. iSCSI Storage on a Separate Virtual Switch
In addition to protecting the iSCSI SAN by giving it a dedicated virtual switch, you can configure your iSCSI
SAN on its own VLAN to improve performance and security. Placing your iSCSI configuration on a separate
VLAN ensures that no devices other than the iSCSI adapter have visibility into transmissions within the iSCSI
SAN. Also, network congestion from other sources cannot interfere with iSCSI traffic.
Secure iSCSI Ports
When you run iSCSI devices, the ESXi host does not open any ports that listen for network connections. This
measure reduces the chances that an intruder can break into the ESXi host through spare ports and gain control
over the host. Therefore, running iSCSI does not present any additional security risks at the ESXi host end of
the connection.
VMware, Inc.
151
ESXi Configuration Guide
Any iSCSI target device that you run must have one or more open TCP ports to listen for iSCSI connections.
If any security vulnerabilities exist in the iSCSI device software, your data can be at risk through no fault of
ESXi. To lower this risk, install all security patches that your storage equipment manufacturer provides and
limit the devices connected to the iSCSI network.
152
VMware, Inc.
Authentication and User Management
13
ESXi handles user authentication and supports user and group permissions. In addition, you can encrypt
connections to the vSphere Client and SDK.
This chapter includes the following topics:
n
“Securing ESXi Through Authentication and Permissions,” on page 153
n
“Encryption and Security Certificates for ESXi,” on page 159
Securing ESXi Through Authentication and Permissions
When a vSphere Client or vCenter Server user connects to a ESXi host, a connection is established with the
VMware Host Agent process. The process uses the user names and passwords for authentication.
ESXi authenticates users accessing ESXi hosts using the vSphere Client or SDK. The default installation of ESXi
uses a local password database for authentication.
Figure 13-1 shows a basic example of how ESXi authenticates transactions from the vSphere Client.
NOTE CIM transactions also use ticket-based authentication in connecting with the vmware-hostd process.
Figure 13-1. Authentication for vSphere Client Communications with ESXi
vSphere Client
management functions
console
user name/password
authentication
ESXi
vmware-hostd
ESXi authentication transactions with third-party network management clients are also direct interactions with
the vmware-hostd process.
To make sure that authentication works efficiently for your site, perform basic tasks such as setting up users,
groups, permissions, and roles, configuring user attributes, adding your own certificates, and determining
whether you want to use SSL.
VMware, Inc.
153
ESXi Configuration Guide
About Users, Groups, Permissions, and Roles
vCenter Server and ESXi hosts use a combination of user name, password, and permissions to authenticate a
user for access and authorize activities. You can control access to hosts, clusters, datastores, resource pools,
networking port groups, and virtual machines by assigning permissions.
Access to an ESXi host and its resources is granted when a known user with appropriate permissions logs in
to the host with a correct password. vCenter Server uses a similar approach when determining whether to
grant access to a user.
vCenter Server and ESXi hosts deny access under the following circumstances:
n
A user not in the user list attempts to log in.
n
A user enters the wrong password.
n
A user is in the list but was not assigned permissions.
n
A user who successfully logged in attempts operations that they do not have permission to perform.
As part of managing ESXi hosts and vCenter Server, you must plan how to handle particular types of users
and permissions. ESXi and vCenter Server use sets of privileges, or roles, to control which operations individual
users or groups can perform. Predefined roles are provided, but you can also create new ones. You can manage
users more easily by assigning them to groups. When you apply a role to the group, all users in the group
inherit the role.
Understanding Users
A user is an individual authorized to log in to either an ESXi host or vCenter Server.
ESXi users fall into two categories: those who can access the host through vCenter Server and those who can
access by directly logging in to the host from the vSphere Client, a third-party client, or a command shell.
Authorized vCenter
Server users
Authorized users for vCenter Server are those included in the Windows
domain list that vCenter Server references or are local Windows users on the
vCenter Server host.
You cannot use vCenter Server to manually create, remove, or otherwise
change users. You must use the tools for managing your Windows domain.
Any changes you make are reflected in vCenter Server. However, the user
interface does not provide a user list for you to review.
Direct-access users
Users authorized to work directly on an ESXi host are those added to the
internal user list by a system administrator.
An administrator can perform a variety of management activities for these
users, such as changing passwords, group memberships, and permissions as
well as adding and removing users.
The user list that vCenter Server maintains is separate from the user list that the host maintains. Even if the
lists appear to have common users (for instance, a user called devuser), treat these users separately. If you log
in to vCenter Server as devuser, you might have permission to view and delete files from a datastore, whereas
if you log in to an ESXi host as devuser, you might not.
Because of the confusion that duplicate naming can cause, check the vCenter Server user list before you create
ESXi host users to avoid duplicating names. To check for vCenter Server users, review the Windows domain
list.
154
VMware, Inc.
Chapter 13 Authentication and User Management
Understanding Groups
A group is a set of users that share a common set of rules and permissions. When you assign permissions to a
group, all users in the group inherit them, and you do not have to work with the user profiles individually.
As an administrator, decide how to structure groups to achieve your security and usage goals. For example,
three part-time sales team members work different days, and you want them to share a single virtual machine
but not use the virtual machines belonging to sales managers. In this case, you might create a group called
SalesShare that includes the three sales people and give the group permission to interact with only one object,
the shared virtual machine. They cannot perform any actions on the sales managers’ virtual machines.
The group lists in vCenter Server and an ESXi host are drawn from the same sources as their respective user
lists. If you are working through vCenter Server, the group list is called from the Windows domain. If you are
logged in to an ESXi host directly, the group list is called from a table that the host maintains.
Understanding Permissions
For ESXi and vCenter Server, permissions are defined as access roles that consist of a user and the user’s
assigned role for an object such as a virtual machine or ESXi host.
Most vCenter Server and ESXi users have limited ability to manipulate the objects associated with the host.
Users with the Administrator role have full access rights and permissions on all virtual objects such as
datastores, hosts, virtual machines, and resource pools. By default, the Administrator role is granted to the
root user. If vCenter Server manages the host, vpxuser is also an Administrator user.
The list of privileges is the same for both ESXi and vCenter Server, and you use the same method to configure
permissions.
You can create roles and set permissions through a direct connection to the ESXi host. Because these tasks are
widely performed in vCenter Server, see Basic System Administration for information on working with
permissions and roles.
Assigning root User Permissions
Root users can only perform activities on the specific ESXi host that they are logged in to.
For security reasons, you might not want to use the root user in the Administrator role. In this case, you can
change permissions after installation so that the root user no longer has administrative privileges or you can
delete the root user’s access permissions altogether through the vSphere Client as described in the “Managing
Users, Groups, Permissions, and Roles” chapter of Basic System Administration. If you do so, you must first
create another permission at the root level that has a different user assigned to the Administrator role.
Assigning the Administrator role to a different user helps you maintain security through traceability. The
vSphere Client logs all actions that the Administrator role user initiates as events, providing you with an audit
trail. If all administrators log in as the root user, you cannot tell which administrator performed an action. If
you create multiple permissions at the root level—each associated with a different user or user group—you
can track the actions of each administrator or administrative group.
After you create an alternative Administrator user, you can delete the root user’s permissions or change the
role to limit its privileges. You must then use the new user you created as the host authentication point when
you bring the host under vCenter Server management.
NOTE vicfg commands do not perform an access check. Therefore, even if you limit the root user’s privileges,
it does not affect what that user can do using the command-line interface commands.
VMware, Inc.
155
ESXi Configuration Guide
Understanding vpxuser Permissions
The vpxuser permission is used for vCenter Server when managing activities for the host. The vpxuser is
created when an ESXi host is attached to vCenter Server.
vCenter Server has Administrator privileges on the host that it manages. For example, vCenter Server can
move virtual machines to and from hosts and perform configuration changes needed to support virtual
machines.
The vCenter Server administrator can perform most of the same tasks on the host as the root user and also
schedule tasks, work with templates, and so forth. However, the vCenter Server administrator cannot directly
create, delete, or edit users and groups for ESXi hosts. These tasks can only be performed by a user with
Administrator permissions directly on each ESXi host.
CAUTION Do not change vpxuser in any way and do not change its permissions. If you do so, you might
experience problems in working with ESXi hosts through vCenter Server.
Assigning dcui User Permissions
The dcui user runs on hosts and acts with Administrator rights. This user’s primary purpose is to configure
hosts for lockdown mode from the direct console.
This user acts as an agent for the direct console and must not be modified or used by interactive users.
CAUTION Do not change the dcui user in any way and do not change its permissions. If you do so, you might
experience problems in working with the ESXi host through the local user interface.
Understanding Roles
vCenter Server and ESXi grant access to objects only to users who are assigned permissions for the object.
When you assign a user or group permissions for the object, you do so by pairing the user or group with a role.
A role is a predefined set of privileges.
ESXi hosts provide three default roles, and you cannot change the privileges associated with these roles. Each
subsequent default role includes the privileges of the previous role. For example, the Administrator role
inherits the privileges of the Read Only role. Roles you create yourself do not inherit privileges from any of
the default roles.
You can create roles and set permissions through a direct connection to the ESXi host. Because most users
create roles and set permissions in vCenter Server, see Basic System Administration for information on working
with permissions and roles.
Assigning the No Access Role
Users assigned the No Access role for an object cannot view or change the object in any way. New users and
groups are assigned this role by default. You can change the role on an object-by-object basis.
A user with a No Access role for a particular object can select the vSphere Client tabs associated with the object,
but the tab displays no content.
The root user and vpxuser permissions are the only users not assigned the No Access role by default. Instead,
they are assigned the Administrator role. You can delete the root user’s permissions altogether or change its
role to No Access as long as you first create a replacement permission at the root level with the Administrator
role and associate this role with a different user.
Assigning the Read Only Role
Users assigned the Read Only role for an object are allowed to view the state of the object and details about
the object.
With this role, a user can view virtual machine, host, and resource pool attributes. The user cannot view the
remote console for a host. All actions through the menus and toolbars are disallowed.
156
VMware, Inc.
Chapter 13 Authentication and User Management
Assigning the Administrator Role
Users assigned the Administrator role for an object are allowed to view and perform all actions on the object.
This role also includes all permissions inherent in the Read Only role.
If you are acting in the Administrator role on an ESXi host, you can grant permissions to individual users and
groups on that host. If you are acting in the Administrator role in vCenter Server, you can grant permissions
to any user or group included in the Windows domain list that vCenter Server references.
vCenter Server registers any selected Windows domain user or group through the process of assigning
permissions. By default, all users who are members of the local Windows Administrators group on vCenter
Server are granted the same access rights as any user assigned to the Administrator role. Users who are
members of the Administrators group can log in as individuals and have full access.
For security reasons, consider removing the Windows Administrators group from the Administrator role. You
can change permissions after installation. Alternately, you can use the vSphere Client to delete the Windows
Administrators group access permissions, but you must first create another permission at the root level that
has a different user assigned to the Administrator role.
Direct Console User Interface Access
Only users that are assigned the Administrator role can log in to the direct console. To allow access to the direct
console, add the user to the local administrators group.
Procedure
1
Log in to the host using the vSphere Client.
2
Click the Users & Groups tab and click Users.
3
Right-click the user and click Edit to open the Edit User dialog box.
4
From the Group drop-down menu, select localadmin and click Add.
5
Click OK.
Working with Users and Groups on ESXi Hosts
If you are directly connected to an ESXi host through the vSphere Client, you can create, edit, and delete users
and groups. These users and groups are visible in the vSphere Client whenever you log in to the ESXi host,
but are not available if you log in to vCenter Server.
View, Sort, and Export a List of Users and Groups
You can view, sort, and export lists of ESXi users and groups to a file that is in HTML, XML, Microsoft Excel,
or CSV format.
Procedure
1
Log in to the host using the vSphere Client.
2
Click the Users & Groups tab and click Users or Groups.
3
Determine how to sort the table, and hide or show columns according to the information you want to see
in the exported file.
4
VMware, Inc.
n
To sort the table by any of the columns, click the column heading.
n
To show or hide columns, right-click any of the column headings and select or deselect the name of
the column to hide.
n
To show or hide columns, right-click any of the column headings and select or deselect the name of
the column to hide.
Right-click anywhere in the table and click Export List to open the Save As dialog box.
157
ESXi Configuration Guide
5
Select a path and enter a filename.
6
Select the file type and click OK.
Add a User to the Users Table
Adding a user to the users table updates the internal user list that ESXi maintains.
Procedure
1
Log in to the host using the vSphere Client.
2
Click the Users & Groups tab and click Users.
3
Right-click anywhere in the Users table and click Add to open the Add New User dialog box.
4
Enter a login, a user name, a numeric user ID (UID), and a password.
Specifying the user name and UID are optional. If you do not specify the UID, the vSphere Client assigns
the next available UID.
5
To add the user to a group, select the group name from the Group drop-down menu and click Add.
6
Click OK.
Modify the Settings for a User
You can change the user ID, user name, password, and group settings for a user. You can also grant a user
shell access.
Procedure
1
Log in to the host using the vSphere Client.
2
Click the Users & Groups tab and click Users.
3
Right-click the user and click Edit to open the Edit User dialog box.
4
To change the user ID, enter a numeric user UID in the UID text box.
The vSphere Client assigns the UID when you first create the user. In most cases, you do not have to change
this assignment.
5
Enter a new user name.
6
To change the user’s password, select Change Password and enter the new password.
Create a password that is long and complex enough to protect against common brute-force attacks. The
host checks for password compliance only if you switched to the pam_passwdqc.so plug-in for
authentication. The password settings in the default authentication plug-in, pam_cracklib.so, are not
enforced.
7
To add the user to a group, select the group name from the Group drop-down menu and click Add.
8
To remove the user from a group, select the group name from the Group membership box and click
Remove.
9
Click OK.
Remove a User or Group
You can remove a user or group from the ESXi host.
CAUTION Do not remove the root user.
158
VMware, Inc.
Chapter 13 Authentication and User Management
Procedure
1
Log in to the host using the vSphere Client.
2
Click the Users & Groups tab and click Users or Groups.
3
Right-click the user or group to remove and select Remove.
Add a Group to the Groups Table
Adding a group to the ESXi groups table updates the internal group list maintained by the host.
Procedure
1
Log in to the host using the vSphere Client.
2
Click the Users & Groups tab and click Groups.
3
Right-click anywhere in the Groups table and click Add to open the Create New Group dialog box.
4
Enter a group name and numeric group ID (GID) in the Group ID text box.
Specifying the GID is optional. If you do not specify a GID, the vSphere Client assigns the next available
group ID.
5
For each user that you want to add as a group member, select the user name from the list and click Add.
6
Click OK.
Add or Remove Users from a Group
You can add or remove a user from a group in the groups table.
Procedure
1
Log in to the host using the vSphere Client.
2
Click the Users & Groups tab and click Groups.
3
Right-click the group to modify and select Properties to open the Edit Group dialog box.
4
To add the user to a group, select the group name from the Group drop-down menu and click Add.
5
To remove the user from a group, select the group name from the Group membership box and click
Remove.
6
Click OK.
Encryption and Security Certificates for ESXi
ESXi supports SSL v3 and TLS v1, generally referred to here as SSL. If SSL is enabled, data is private, protected,
and cannot be modified in transit without detection.
All network traffic is encrypted as long as you did not change the Web proxy service to allow unencrypted
traffic for the port.
Host certificate checking is enabled by default and SSL certificates are used to encrypt network traffic.
However, ESXi uses automatically generated certificates that are created as part of the installation process and
stored on the host. These certificates are unique and make it possible to begin using the server, but they are
not verifiable and are not signed by a trusted-well-known certificate authority (CA). These default certificates
are vulnerable to possible man-in-the-middle attacks.
VMware, Inc.
159
ESXi Configuration Guide
To receive the full benefit of certificate checking, particularly if you intend to use encrypted remote connections
externally, install new certificates that are signed by a valid internal certificate authority or purchase a certificate
from a trusted security authority.
NOTE If the self-signed certificate is used, clients receive a warning about the certificate. To address this issue,
install a certificate that is signed by a recognized certificate authority. If CA-signed certificates are not installed,
all communication between vCenter Server and vSphere Clients is encrypted using a self-signed certificate.
These certificates do not provide the authentication security you might need in a production environment.
Enable Certificate Checking and Verify Host Thumbprints
To prevent man-in-the-middle attacks and to fully use the security that certificates provide, certificate checking
is enabled by default. You can verify that certificate checking is enabled in the vSphere Client.
NOTE vCenter Server certificates are preserved across upgrades.
Procedure
1
Log in to a vCenter Server system using the vSphere Client.
2
Select Administration > vCenter Server Settings.
3
Click SSL Settings in the left pane and verify that Check host certificates is selected.
4
If there are hosts that require manual validation, compare the thumbprints listed for the hosts to the
thumbprints in the host console.
To obtain the host thumbprint for ESXi, use the direct console.
a
Log in to the direct console and press F2 to access the System Customization menu.
b
Select View Support Information.
The host thumbprint is displayed in the column on the right.
5
If the thumbprint matches, select the Verify check box next to the host.
Hosts that are not selected will be disconnected after you click OK.
6
Click OK.
Generate New Certificates for the ESXi Host
The ESXi host generates certificates the first time the system is started. Under certain circumstances, you might
be required to force the host to generate new certificates. You typically generate new certificates only if you
change the host name or accidentally delete the certificate.
Procedure
160
1
Select Reset Customized Settings in the direct console.
2
Reboot the system to regenerate the certificates.
VMware, Inc.
Chapter 13 Authentication and User Management
Replace a Default Certificate with a CA-Signed Certificate
The ESXi host uses automatically generated certificates that are created as part of the installation process. These
certificates are unique and make it possible to begin using the server, but they are not verifiable and they are
not signed by a trusted, well-known certificate authority (CA). Using default certificates might not comply
with the security policy of your organization. If you require a certificate from a trusted certificate authority,
you can replace the default certificate.
NOTE ESXi supports only X.509 certificates to encrypt session information sent over SSL connections between
server and client components.
Prerequisites
All file transfers and other communications occur over a secure HTTPS session. The user used to authenticate
the session must have the privilege Host.Config.AdvancedConfig on the host. For more information on ESXi
privileges, see “About Users, Groups, Permissions, and Roles,” on page 154.
Procedure
1
Use the vifs command to put a copy of the certificate and key files on the ESXi host.
The form this command takes for the certificate and key respectively is:
vifs --server <hostname> --username <username> --put rui.crt /host/ssl_cert
vifs --server <hostname> --username <username> --put rui.key /host/ssl_key
2
Use the Restart Management Agents operation through the direct console to have the settings take effect.
Upload a Certificate and Key Using a HTTPS PUT
In addition to the vifs command, you can use third-party applications to upload certificates. Applications that
support HTTPS PUT operations work with the HTTPS interface that is included with ESXi. For example, you
can use SeaMonkey Composer to upload a certificate and key.
Procedure
1
In your upload application, open the file.
2
Publish the file to one of these locations.
3
n
For certificates, https://hostname/host/ssl_crt.
n
For keys, https://hostname/host/sslkey.
In the direct console, use the Restart Management Agents operation to have the settings take effect.
Configure SSL Timeouts
You can configure SSL timeouts for ESXi.
Timeout periods can be set for two types of idle connections:
n
The Read Timeout setting applies to connections that have completed the SSL handshake process with
port 443 of ESXi.
n
The Handshake Timeout setting applies to connections that have not completed the SSL handshake
process with port 443 of ESXi.
Both connection timeouts are set in milliseconds.
Idle connections are disconnected after the timeout period. By default, fully established SSL connections have
a timeout of infinity.
VMware, Inc.
161
ESXi Configuration Guide
Procedure
1
Use the vifs command to get a copy of the config.xml file to edit.
For Linux systems, use this command.
vifs --server <hostname> --username <username> --get /host/config.xml <directory>/config.xml
For Windows systems, use this command.
vifs --server <hostname> --username <username> --get /host/config.xml <directory>\config.xml
2
Use a text editor to open the config.xml file.
3
Enter the <readTimeoutMs> value in milliseconds.
For example, to set the Read Timeout to 20 seconds, enter the following command.
<readTimeoutMs>20000</readTimeoutMs>
4
Enter the <handshakeTimeoutMs> value in milliseconds.
For example, to set the Handshake Timeout to 20 seconds, enter the following command.
<handshakeTimeoutMs>20000</handshakeTimeoutMs>
5
Save your changes and close the file.
6
Use the vifs command to put a copy of the config.xml file on the ESXi host.
For Linux systems, use this command.
vifs --server <hostname> --username <username> --put <directory>/config.xml /host/config.xml
For Windows systems, use this command.
vifs --server <hostname> --username <username> --put <directory>\config.xml /host/config.xml
7
Use the Restart Management Agents operation through the direct console to have the settings take effect.
Example: Configuration File
The following section from the file /etc/vmware/hostd/config.xml shows where to enter the SSL timeout
settings.
<vmacore>
...
<http>
<readTimeoutMs>20000</readTimeoutMs>
</http>
...
<ssl>
...
<handshakeTimeoutMs>20000</handshakeTimeoutMs>
...
</ssl>
</vmacore>
162
VMware, Inc.
Chapter 13 Authentication and User Management
Modifying ESXi Web Proxy Settings
When you modify Web proxy settings, you have several encryption and user security guidelines to consider.
NOTE Use the Restart Management Agents operation through the direct console to restart the vmware-hostd
process after making any changes to host directories or authentication mechanisms.
n
Do not set up certificates using pass phrases. ESXi does not support pass phrases, also known as encrypted
keys. If you set up a pass phrase, ESXi processes cannot start correctly.
n
You can configure the Web proxy so that it searches for certificates in a location other than the default
location. This capability proves useful for companies that prefer to centralize their certificates on a single
machine so that multiple hosts can use the certificates.
CAUTION If certificates are not stored locally on the host—for example, if they are stored on an NFS share
—the host cannot access those certificates if ESXi loses network connectivity. As a result, a client connecting
to the host cannot successfully participate in a secure SSL handshake with the host.
n
To support encryption for user names, passwords, and packets, SSL is enabled by default for vSphere Web
services SDK connections. If you want to configure the these connections so that they do not encrypt
transmissions, disable SSL for your vSphere Web Services SDK connection by switching the connection
from HTTPS to HTTP.
Consider disabling SSL only if you created a fully trusted environment for these clients, where firewalls
are in place and transmissions to and from the host are fully isolated. Disabling SSL can improve
performance, because you avoid the overhead required to perform encryption.
n
To protect against misuse of ESXi services, most internal ESXi services are accessible only through port
443, the port used for HTTPS transmission. Port 443 acts as a reverse proxy for ESXi. You can see a list of
services on ESXi through an HTTP welcome page, but you cannot directly access the Storage Adapters
services without proper authorization.
You can change this configuration so that individual services are directly accessible through HTTP
connections. Do not make this change unless you are using ESXi in a fully trusted environment.
n
VMware, Inc.
When you upgrade vCenter Server, the certificate remains in place.
163
ESXi Configuration Guide
Change Security Settings for a Web Proxy Service
You can change the security configuration so that individual services are directly accessible through HTTP
connections.
Procedure
1
Use the vifs command to get a copy of the proxy.xml file to edit.
For Linux systems, use this command.
vifs --server <hostname> --username <username> --get /host/proxy.xml <directory>/proxy.xml
For Windows systems, use this command.
vifs --server <hostname> --username <username> --get /host/proxy.xml <directory>\proxy.xml
CAUTION If this file is changed to an incorrect configuration, the system might enter an unmanageable
state. You might be required to perform a factory reset using the direct console.
164
VMware, Inc.
Chapter 13 Authentication and User Management
2
Use a text editor to open the proxy.xml file.
The contents of the file typically appears as follows.
<ConfigRoot>
<EndpointList>
<_length>6</_length>
<_type>vim.ProxyService.EndpointSpec[]</_type>
<e id="0">
<_type>vim.ProxyService.NamedPipeServiceSpec</_type>
<accessMode>httpsWithRedirect</accessMode>
<pipeName>/var/run/vmware/proxy-webserver</pipeName>
<serverNamespace>/</serverNamespace>
</e>
<e id="1">
<_type>vim.ProxyService.NamedPipeServiceSpec</_type>
<accessMode>httpsWithRedirect</accessMode>
<pipeName>/var/run/vmware/proxy-sdk</pipeName>
<serverNamespace>/sdk</serverNamespace>
</e>
<e id="2">
<_type>vim.ProxyService.LocalServiceSpec</_type>
<accessMode>httpsWithRedirect</accessMode>
<port>8080</port>
<serverNamespace>/ui</serverNamespace>
</e>
<e id="3">
<_type>vim.ProxyService.NamedPipeServiceSpec</_type>
<accessMode>httpsOnly</accessMode>
<pipeName>/var/run/vmware/proxy-vpxa</pipeName>
<serverNamespace>/vpxa</serverNamespace>
</e>
<e id="4">
<_type>vim.ProxyService.NamedPipeServiceSpec</_type>
<accessMode>httpsWithRedirect</accessMode>
<pipeName>/var/run/vmware/proxy-mob</pipeName>
<serverNamespace>/mob</serverNamespace>
</e>
<e id="5">
<_type>vim.ProxyService.LocalServiceSpec</_type>
<!-- Use this mode for "secure" deployment -->
<!-- <accessMode>httpsWithRedirect</accessMode> -->
<!-- Use this mode for "insecure" deployment -->
<accessMode>httpAndHttps</accessMode>
<port>8889</port>
<serverNamespace>/wsman</serverNamespace>
</e>
</EndpointList>
</ConfigRoot>
VMware, Inc.
165
ESXi Configuration Guide
3
Change the security settings as required.
For example, you might want to modify entries for services that use HTTPS to add the option of HTTP
access.
n
<e id> is an ID number for the server ID XML tag. ID numbers must be unique within the HTTP area.
n
<_type> is the name of the service you are moving.
n
<accessmode> is the forms of communication the service permits. Acceptable values include:
n
httpOnly – The service is accessible only over plain-text HTTP connections.
n
httpsOnly – The service is accessible only over HTTPS connections.
n
httpsWithRedirect – The service is accessible only over HTTPS connections. Requests over HTTP
are redirected to the appropriate HTTPS URL.
n
httpAndHttps – The service is accessible both over HTTP and HTTPS connections.
n
<port> is the port number assigned to the service. You can assign a different port number to the service.
n
<serverNamespace> is the namespace for the server that provides this service, for example /sdk
or /mob.
4
Save your changes and close the file.
5
Use the vifs command to put a copy of the proxy.xml file on the ESXi host.
For Linux, use this command.
vifs --server <hostname> --username <username> --put <directory>/proxy.xml /host/proxy.xml
For Windows, use this command.
vifs --server <hostname> --username <username> --put <directory>\proxy.xml /host/proxy.xml
6
166
Use the Restart Management Agents operation through the direct console to have the settings take effect.
VMware, Inc.
Security Deployments and
Recommendations
14
ESXi deployment scenarios can help you understand how best to employ the security features in your own
deployment. Scenarios also illustrate some basic security recommendations that you can consider when
creating and configuring virtual machines.
This chapter includes the following topics:
n
“Security Approaches for Common ESXi Deployments,” on page 167
n
“ESXi Lockdown Mode,” on page 170
n
“Virtual Machine Recommendations,” on page 171
Security Approaches for Common ESXi Deployments
You can compare security approaches for different types of deployments to help plan security for your own
ESXi deployment.
The complexity of ESXi deployments can vary significantly depending on the size of your company, the way
that data and resources are shared with the outside world, whether there are multiple datacenters or only one,
and so forth. Inherent in the following deployments are policies for user access, resource sharing, and security
level.
Single-Customer Deployment
In a single-customer deployment, ESXi hosts are owned and maintained within a single corporation and single
datacenter. Host resources are not shared with outside users. One site administrator maintains the hosts, which
are run on a number of virtual machines.
The single-customer deployment does not allow customer administrators, and the site administrator is solely
responsible for maintaining the various virtual machines. The corporation staffs a set of system administrators
who do not have accounts on the host and cannot access any of the ESXi tools such as vCenter Server or
command line shells for the host. These system administrators have access to virtual machines through the
virtual machine console so that they can load software and perform other maintenance tasks inside the virtual
machines.
Table 14-1 shows how you might handle sharing for the components that you use and configure for the host.
VMware, Inc.
167
ESXi Configuration Guide
Table 14-1. Sharing for Components in a Single-Customer Deployment
Function
Configuration
Comments
Virtual machines share the same
physical network?
Yes
Configure your virtual machines on the same physical
network.
VMFS sharing?
Yes
All .vmdk files reside in the same VMFS partition.
Virtual machine memory
overcommitment?
Yes
Configure the total memory for the virtual machines as
greater than the total physical memory.
Table 14-2 shows how you might set up user accounts for the host.
Table 14-2. User Account Setup in a Single-Customer Deployment
User Category
Total Number of Accounts
Site administrators
1
Customer administrators
0
System administrators
0
Business users
0
Table 14-3 shows the level of access for each user.
Table 14-3. User Access in a Single-Customer Deployment
Access Level
Site Administrator
System Administrator
Root access?
Yes
No
Virtual machine creation and modification?
Yes
No
Virtual machine access through the console?
Yes
Yes
Multiple-Customer Restricted Deployment
In a multiple-customer restricted deployment, ESXi hosts are in the same datacenter and are used to serve
applications for multiple customers. The site administrator maintains the hosts, and these hosts run a number
of virtual machines dedicated to the customers. Virtual machines that belong to the various customers can be
on the same host, but the site administrator restricts resource sharing to prevent rogue interaction.
Although there is only one site administrator, several customer administrators maintain the virtual machines
assigned to their customers. This deployment also includes customer system administrators who do not have
ESXi accounts but have access to the virtual machines through the virtual machine console so that they can
load software and perform other maintenance tasks inside the virtual machines.
Table 14-4 shows how you might handle sharing for the components you use and configure for the host.
Table 14-4. Sharing for Components in a Multiple-Customer Restricted Deployment
Function
Configuration
Comments
Virtual machines share the same
physical network?
Partial
Put the virtual machines for each customer on a different
physical network. All physical networks are independent of
each other.
VMFS sharing?
No
Each customer has its own VMFS partition, and the virtual
machine .vmdk files reside exclusively on that partition. The
partition can span multiple LUNs.
Virtual machine memory
overcommitment?
Yes
Configure the total memory for the virtual machines as greater
than the total physical memory.
Table 14-5 shows how you might set up user accounts for the ESXi host.
168
VMware, Inc.
Chapter 14 Security Deployments and Recommendations
Table 14-5. User Account Setup in a Multiple-Customer Restricted Deployment
User Category
Total Number of Accounts
Site administrators
1
Customer administrators
10
System administrators
0
Business users
0
Table 14-6 shows the level of access for each user.
Table 14-6. User Access in a Multiple-Customer Restricted Deployment
Access Level
Site Administrator
Customer
Administrator
System
Administrator
Root access?
Yes
No
No
Virtual machine creation and modification?
Yes
Yes
No
Virtual machine access through the console?
Yes
Yes
Yes
Multiple-Customer Open Deployment
In a multiple-customer open deployment, ESXi hosts are in the same datacenter and are used to serve
applications for multiple customers. The site administrator maintains the hosts, and these hosts run a number
of virtual machines dedicated to the customers. Virtual machines that belong to the various customers can be
on the same host, but there are fewer restrictions on resource sharing.
Although there is only one site administrator in a multiple-customer open deployment, several customer
administrators maintain the virtual machines assigned to their customers. The deployment also includes
customer system administrators who do not have ESXi accounts but have access to the virtual machines
through the virtual machine console so that they can load software and perform other maintenance tasks inside
the virtual machines. Lastly, a group of business users who do not have accounts can use virtual machines to
run their applications.
Table 14-7 shows how you might handle sharing for the components that you use and configure for the host.
Table 14-7. Sharing for Components in a Multiple-Customer Open Deployment
Function
Configuration
Comments
Virtual machines share the same
physical network?
Yes
Configure your virtual machines on the same physical
network.
VMFS sharing?
Yes
Virtual machines can share VMFS partitions, and their
virtual machine .vmdk files can reside on shared partitions.
Virtual machines do not share .vmdk files.
Virtual machine memory
overcommitment?
Yes
Configure the total memory for the virtual machines as
greater than the total physical memory.
Table 14-8 shows how you might set up user accounts for the host.
Table 14-8. User Account Setup in a Multiple-Customer Open Deployment
User Category
Total Number of Accounts
Site administrators
1
Customer administrators
10
System administrators
0
Business users
0
VMware, Inc.
169
ESXi Configuration Guide
Table 14-9 shows the level of access for each user.
Table 14-9. User Access in a Multiple-Customer Open Deployment
Access Level
Site Administrator
Customer
Administrator
System
Administrator
Business User
Root access?
Yes
No
No
No
Virtual machine creation and
modification?
Yes
Yes
No
No
ESXi Lockdown Mode
To increase the security of your ESXi hosts, you can put them in lockdown mode. Lockdown mode is only
available on ESXi hosts that have been added to vCenter Server.
Enabling lockdown mode disables all direct root access to ESXi machines. Any subsequent local changes to
the host must be made in a vSphere Client session or vSphere CLI command to vCenter Server using a fully
editable Active Directory account. You can also use a local user account defined by the host. By default, no
local user accounts exist on the ESXi system. Such accounts can only be created prior to enabling lockdown
mode in a vSphere Client session directly on the ESXi system. The changes to the host are limited to the
privileges granted to that user locally on that host.
You can enable lockdown mode using the Add Host wizard to add an ESXi host to vCenter Server, using the
vSphere Client to manage a host, or using the direct console.
Enable Lockdown Mode Using the vSphere Client
Lockdown mode disables all direct root access to ESXi hosts. You can also enable or disable lockdown mode
through the direct console.
Procedure
1
Log in to a vCenter Server system using the vSphere Client.
2
Select the host in the inventory panel.
3
Click the Configuration tab and click Security Profile.
The vSphere Client displays a list of active incoming and outgoing connections with the corresponding
firewall ports.
4
Click the Edit link next to lockdown mode.
The Lockdown Mode dialog box appears.
5
Select Enable Lockdown Mode.
6
Click OK.
Enable Lockdown Mode from the Direct Console
You can enable lockdown mode from the direct console and from the vSphere Client.
Procedure
u
170
Toggle the Configure Lockdown Mode setting.
VMware, Inc.
Chapter 14 Security Deployments and Recommendations
Virtual Machine Recommendations
There are several safety precautions to consider when evaluating virtual machine security and administering
virtual machines.
Installing Antivirus Software
Because each virtual machine hosts a standard operating system, consider protecting it from viruses by
installing antivirus software. Depending on how you are using the virtual machine, you might also want to
install a software firewall.
Stagger the schedule for virus scans, particularly in deployments with a large number of virtual machines.
Performance of systems in your environment will degrade significantly if you scan all virtual machines
simultaneously.
Because software firewalls and antivirus software can be virtualization-intensive, you can balance the need
for these two security measures against virtual machine performance, especially if you are confident that your
virtual machines are in a fully trusted environment.
Disable Copy and Paste Operations Between the Guest Operating System and
Remote Console
You can disable copy and paste operations to prevent exposing sensitive data that has been copied to the
clipboard.
When VMware Tools runs on a virtual machine, you can copy and paste between the guest operating system
and remote console. As soon as the console window gains focus, non-privileged users and processes running
in the virtual machine can access the clipboard for the virtual machine console. If a user copies sensitive
information to the clipboard before using the console, the user—perhaps unknowingly—exposes sensitive data
to the virtual machine. To prevent this problem, consider disabling copy and paste operations for the guest
operating system.
Procedure
1
Log in to a vCenter Server system using the vSphere Client.
2
On the Summary tab, click Edit Settings.
3
Select Options > Advanced > General and click Configuration Parameters.
VMware, Inc.
171
ESXi Configuration Guide
4
Click Add Row and type the following values in the Name and Value columns.
Name
Value
isolation.tools.copy.disable
true
isolation.tools.paste.disable
true
isolation.tools.setGUIOptions.e
nable
false
NOTE These options override any settings made in the guest operating system’s VMware Tools control
panel.
These selections create the following field values.
5
Name
Field Value
sched.mem.max
unlimited
sched.swap.derivedName
/vmfs/volumes/e5f9f3d1-ed4d8ba/New Virtual Machine
scsi0:0.redo
true
vmware.tools.installstate
none
vmware.tools.lastInstallStatus.resul
t
unknown
isolation.tools.copy.disable
true
isolation.tools.paste.disable
true
isolation.tools.setGUIOptions.enabl
e
false
Click OK to close the Configuration Parameters dialog box, and click OK again to close the Virtual Machine
Properties dialog box.
Removing Unnecessary Hardware Devices
Users and processes without privileges on a virtual machine can connect or disconnect hardware devices, such
as network adapters and CD-ROM drives. Therefore, removing unnecessary hardware devices can help
prevent attacks.
Attackers can use this capability to breach virtual machine security in several ways. For example, an attacker
with access to a virtual machine can connect a disconnected CD-ROM drive and access sensitive information
on the media left in the drive, or disconnect a network adapter to isolate the virtual machine from its network,
resulting in a denial of service.
As a general security precaution, use commands on the vSphere Client Configuration tab to remove any
unneeded or unused hardware devices. Although this measure tightens virtual machine security, it is not a
good solution in situations where you might bring an unused device back into service at a later time.
Prevent a Virtual Machine User or Process from Disconnecting Devices
If you do not want to permanently remove a device, you can prevent a virtual machine user or process from
connecting or disconnecting the device from within the guest operating system.
Procedure
172
1
Log in to a vCenter Server system using the vSphere Client.
2
Select the virtual machine in the inventory panel.
3
On the Summary tab, click Edit Settings.
VMware, Inc.
Chapter 14 Security Deployments and Recommendations
4
Select Options > General Options and make a record of the path displayed in the Virtual Machine
Configuration File text box.
5
Use the vifs command to get a copy of the virtual machine configuration files from the location you noted
in Step 4.
Virtual machine configuration files are located in the /vmfs/volumes/<datastore> directory, where
<datastore> is the name of the storage device on which the virtual machine files reside. For example, if the
virtual machine configuration file you obtained from the Virtual Machine Properties dialog box is
[vol1]vm-finance/vm-finance.vmx, use this command.
vifs --server <hostname> --username <username> --get /vmfs/volumes/vol1/vm-finance/vmfinance.vmx <directory>/vm-finance.vmx
6
Use a text editor to add the following line to the .vmx file, where <device_name> is the name of the device
you want to protect (for example, ethernet1).
<device_name>.allowGuestConnectionControl = "false"
NOTE By default, Ethernet 0 is configured to disallow device disconnection. The only reason you might
change this is if a prior administrator set <device_name>.allowGuestConnectionControl to true.
7
Save your changes and close the file.
8
Use vifs to put your modified copy of the file at the location you noted in Step 4.
vifs --server <hostname> --username <username> --put <directory>/vmfinance.vmx /vmfs/volumes/vol1/vm-finance/vm-finance.vmx
9
In the vSphere Client, right-click the virtual machine and select Power Off.
10
Right-click the virtual machine and select Power On.
Limiting Guest Operating System Writes to Host Memory
The guest operating system processes send informational messages to the ESXi host through VMware Tools.
If the amount of data the host stored as a result of these messages was unlimited, an unrestricted data flow
would provide an opportunity for an attacker to stage a denial-of-service (DoS) attack.
The informational messages sent by guest operating processes are known as setinfo messages and typically
contain name-value pairs that define virtual machine characteristics or identifiers that the host stores—for
example, ipaddress=10.17.87.224. The configuration file containing these name-value pairs is limited to a size
of 1MB, which prevents attackers from staging a DoS attack by writing software that mimics VMware Tools
and filling the host's memory with arbitrary configuration data, which consumes space needed by the virtual
machines.
If you require more than 1MB of storage for name-value pairs, you can change the value as required. You can
also prevent the guest operating system processes from writing any name-value pairs to the configuration file.
Modify Guest Operating System Variable Memory Limit
You can increase the guest operating system variable memory limit if large amounts of custom information
are being stored in the configuration file.
Procedure
1
Log in to a vCenter Server system using the vSphere Client.
2
Select the virtual machine in the inventory panel.
3
On the Summary tab, click Edit Settings.
4
Select Options > Advanced > General and click Configuration Parameters.
VMware, Inc.
173
ESXi Configuration Guide
5
If the size limit attribute is not present, you must add it.
a
Click Add Row.
b
In the Name column, type tools.setInfo.sizeLimit.
c
In the Value column, type Number of Bytes.
If the size limit attribute exists, modify it to reflect the appropriate limits.
6
Click OK to close the Configuration Parameters dialog box, and click OK again to close the Virtual Machine
Properties dialog box.
Prevent the Guest Operating System Processes from Sending Configuration
Messages to the Host
You can prevent guests from writing any name-value pairs to the configuration file. This is appropriate when
guest operating systems must be prevented from modifying configuration settings.
Procedure
1
Log in to a vCenter Server system using the vSphere Client.
2
Select the virtual machine in the inventory panel.
3
On the Summary tab, click Edit Settings.
4
Select Options > Advanced > General and click Configuration Parameters.
5
Click Add Row and type the following values in the Name and Value columns.
6
n
In the Name column: isolation.tools.setinfo.disable
n
In the Value column: true
Click OK to close the Configuration Parameters dialog box, and click OK again to close the Virtual Machine
Properties dialog box.
Configuring Logging Levels for the Guest Operating System
Virtual machines can write troubleshooting information into a virtual machine log file stored on the VMFS
volume. Virtual machine users and processes can abuse logging either on purpose or inadvertently so that
large amounts of data flood the log file. Over time, the log file can consume enough file system space to cause
a denial of service.
To prevent this problem, consider modifying logging settings for virtual machine guest operating systems.
These settings can limit the total size and number of log files. Normally, a new log file is created each time you
reboot a host, so the file can grow to be quite large. You can ensure new log file creation happens more
frequently by limiting the maximum size of the log files. VMware recommends saving 10 log files, each one
limited to 100KB. These values are large enough to capture sufficient information to debug most problems that
might occur.
Each time an entry is written to the log, the size of the log is checked. If it is over the limit, the next entry is
written to a new log. If the maximum number of log files exists, the oldest log file is deleted. A DoS attack that
avoids these limits could be attempted by writing an enormous log entry, but each log entry is limited in size
to 4KB, so no log files are ever more than 4KB larger than the configured limit.
174
VMware, Inc.
Chapter 14 Security Deployments and Recommendations
Limit Log File Numbers and Sizes
To prevent virtual machine users and processes from flooding the log file, which can lead to denial of service,
you can limit the number and size of the log files ESXi generates.
Procedure
1
Log in to a vCenter Server system using the vSphere Client.
2
On the Summary tab, click Edit Settings.
3
Select Options > General Options and make a record of the path displayed in the Virtual Machine
Configuration File text box.
4
Use the vifs command to get a copy of the virtual machine configuration files from the location you noted
in Step 3.
Virtual machine configuration files are located in the /vmfs/volumes/<datastore> directory, where
<datastore> is the name of the storage device on which the virtual machine files reside. For example, if the
virtual machine configuration file you obtained from the Virtual Machine Properties dialog box is
[vol1]vm-finance/vm-finance.vmx, use this command.
vifs --server <hostname> --username <username> --get /vmfs/volumes/vol1/vm-finance/vmfinance.vmx <directory>/vm-finance.vmx
5
To limit the log size, use a text editor to add or edit the following line to the .vmx file, where
<maximum_size> is the maximum file size in bytes.
log.rotateSize=<maximum_size>
For example, to limit the size to around 100KB, enter 100000.
6
To keep a limited number of log files, use a text editor to add or edit the following line to the .vmx file,
where <number_of_files_to_keep> is the number of files the server keeps.
log.keepOld=<number_of_files_to_keep>
For example, to keep 10 log files and begin deleting the oldest ones as new ones are created, enter 10.
7
Save your changes and close the file.
8
Use vifs to put your modified copy of the file at the location you noted in Step 3.
vifs --server <hostname> --username <username> --put <directory>/vmfinance.vmx /vmfs/volumes/vol1/vm-finance/vm-finance.vmx
Disable Logging for the Guest Operating System
If you choose not to write troubleshooting information into a virtual machine log file stored on the VMFS
volume, you can stop logging altogether.
If you disable logging for the guest operating system, be aware that you might not be able to gather adequate
logs to allow troubleshooting. Further, VMware does not offer technical support for virtual machine problems
if logging has been disabled.
Procedure
1
Log in to a vCenter Server system using the vSphere Client and select the virtual machine in the inventory.
2
On the Summary tab, click Edit Settings.
3
Click the Options tab and in the options list under Advanced, select General.
4
In Settings, deselect Enable logging.
5
Click OK to close the Virtual Machine Properties dialog box.
VMware, Inc.
175
ESXi Configuration Guide
176
VMware, Inc.
Host Profiles
VMware, Inc.
177
ESXi Configuration Guide
178
VMware, Inc.
Managing Host Profiles
15
The host profiles feature creates a profile that encapsulates the host configuration and helps to manage the
host configuration, especially in environments where an administrator manages more than one host or cluster
in vCenter Server.
Host profiles eliminates per-host, manual, or UI-based host configuration and maintain configuration
consistency and correctness across the datacenter by using host profile policies. These policies capture the
blueprint of a known, validated reference host configuration and use this to configure networking, storage,
security, and other settings on multiple hosts or clusters. You can then check a host or cluster against a profile’s
configuration for any deviations.
This chapter includes the following topics:
n
“Host Profiles Usage Model,” on page 179
n
“Access Host Profiles View,” on page 180
n
“Creating a Host Profile,” on page 180
n
“Export a Host Profile,” on page 181
n
“Import a Host Profile,” on page 181
n
“Edit a Host Profile,” on page 182
n
“Manage Profiles,” on page 183
n
“Checking Compliance,” on page 186
Host Profiles Usage Model
This topic describes the workflow of using Host Profiles.
You must have an existing vSphere installation with at least one properly configured host.
1
Set up and configure the host that will be used as the reference host.
A reference host is the host from which the profile is created.
2
Create a profile using the designated reference host.
3
Attach a host or cluster with the profile.
VMware, Inc.
179
ESXi Configuration Guide
4
Check the host's compliance against a profile. This ensures that the host continues to be correctly
configured.
5
Apply the host profile of the reference host to other hosts or clusters of hosts.
NOTE Host profiles is only supported for VMware vSphere 4.0 hosts. This feature is not supported for VI 3.5
or earlier hosts. If you have VI 3.5 or earlier hosts managed by your vCenter Server 4.0, the following can occur
if you try to use host profiles for those hosts:
n
You cannot create a host profile that uses a VMware Infrastructure 3.5 or earlier host as a reference host.
n
You cannot apply a host profile to any VI 3.5 or earlier hosts. The compliance check fails.
n
While you can attach a host profile to a mixed cluster that contains VI 3.5 or earlier hosts, the compliance
check for those hosts fails.
As a licensed feature of vSphere, Host Profiles are only available when the appropriate licensing is in place. If
you see errors, please ensure that you have the appropriate vSphere licensing for your hosts.
Access Host Profiles View
The Host Profiles main view lists all available profiles. Administrators can also use the Host Profiles main view
to perform operations on host profiles and configure profiles.
The Host Profiles main view should be used by experienced administrators who wish to perform host profile
operations and configure advanced options and policies. Most operations such as creating new profiles,
attaching entities, and applying profiles can be performed from the Hosts and Clusters view.
Procedure
u
Select View > Management > Host Profiles.
Any existing profiles are listed on the left side in the profiles list. When a profile is selected from the profile
list, the details of that profile are displayed on the right side.
Creating a Host Profile
You create a new host profile by using the designated reference host's configuration.
A host profile can be created from the Host Profiles main view or the host's context menu in the Hosts and
Clusters.
Create a Host Profile from Host Profiles View
You can create a host profile from the Host Profiles main view by using the configuration of an existing host.
Prerequisites
You must have a vSphere installation and at least one properly configured host in the inventory.
Procedure
1
In the Host Profiles main view, click Create Profile.
The Create Profile wizard appears.
2
Select the option to create a new profile and click Next.
3
Select the host to use to create the profile and click Next.
4
Type the name and enter a description for the new profile and click Next.
5
Review the summary information for the new profile and click Finish to complete creating the profile.
The new profile appears in the profile list.
180
VMware, Inc.
Chapter 15 Managing Host Profiles
Create a Host Profile from Host
You can create a new host profile from the host's context menu in the Hosts and Clusters inventory view.
Prerequisites
You must have a vSphere installation and at least one properly configured host in the inventory.
Procedure
1
In the Hosts and Clusters view, select the host that you want to designate as the reference host for the new
host profile.
2
Right-click the host and select Host Profile > Create Profile from Host.
The Create Profile from Host wizard opens.
3
Type the name and enter a description for the new profile and click Next.
4
Review the summary information for the new profile and click Finish to complete creating the profile.
The new profile appears in the host's Summary tab.
Export a Host Profile
You can export a profile to a file that is in the VMware profile format (.vpf).
Procedure
1
In the Host Profiles main page, select the profile to export from the profile list.
2
Select the location and type the name of the file to export the profile.
3
Click Save.
Import a Host Profile
You can import a profile from a file in the VMware profile format (.vpf).
Procedure
1
In the Host Profiles main page, click the Create Profile icon.
The Create Profile wizard appears.
2
Select the option to import a profile and click Next.
3
Enter or browse for the VMware Profile Format file to import and click Next.
4
Type the name and enter a description for the imported profile and click Next.
5
Review the summary information for the imported profile and click Finish to complete importing the
profile.
The imported profile appears in the profile list.
VMware, Inc.
181
ESXi Configuration Guide
Edit a Host Profile
You can view and edit host profile policies, select a policy to be checked for compliance, and change the policy
name or description.
Procedure
1
In the Host Profiles main view, select the profile to edit from the profile list.
2
Click Edit Host Profile.
3
Change the profile name or description in the fields at the top of the Profile Editor.
4
Edit or disable the policy.
5
Enable the policy compliance check.
6
Click OK to close the Profile Editor.
Edit a Policy
A policy describes how a specific configuration setting should be applied. The Profile Editor allows you to edit
policies belonging to a specific host profile.
On the left side of the Profile Editor, you can expand the host profile. Each host profile is composed of several
sub-profiles that are designated by functional group to represent configuration instances. Each sub-profile
contains many policies that describe the configuration that is relevant to the profile.
The sub-profiles (and example policies and compliance checks) that may be configured are:
Table 15-1. Host Profile Sub-Profile Configurations
Sub-Profile Configuration
Example Policies and Compliance Checks
Memory reservation
Set memory reservation to a fixed value.
Storage
Configure NFS storage.
Networking
Configure virtual switch, port groups, physical NIC speed,
security and NIC teaming policies.
Date and Time
Configure time settings, timezone of server.
Firewall
Enable or disable a ruleset.
Security
Add a user or usergroup.
Service
Configure settings for a service.
Advanced
Modify advanced options.
Procedure
1
Open the Profile Editor for the profile you wish to edit.
2
On the left side of the Profile Editor, expand a sub-profile until you reach the policy you want to edit.
3
Select the policy.
On the right side of the Profile Editor, the policy options and parameters are displayed within the
Configuration Details tab.
182
4
Select a policy option from the drop-down menu and set its parameter.
5
(Optional) If you make a change to a policy, but wish to revert back to the default option, click Revert and
the option is reset.
VMware, Inc.
Chapter 15 Managing Host Profiles
Enable Compliance Check
You can decide whether a host profile policy is checked for compliance.
Procedure
1
Open the Profile Editor for a profile and navigate to the policy you wish to enable for compliance check.
2
On the right-hand side of the Profile Editor, select the Compliance Details tab.
3
Enable the check box for the policy.
NOTE If you disable the check box so this policy is not checked for compliance, the other policies that are
enabled for compliance check will still be checked.
Manage Profiles
After you create a host profile, you can manage the profile by attaching a profile to a particular host or cluster
and then applying that profile to the host or cluster.
Attaching Entities
Hosts that need to be configured are attached to a profile. Profiles can also be attached to a cluster. In order to
be compliant, all hosts within an attached cluster must be configured according to the profile.
You can attach a host or cluster to a profile from:
n
Host Profiles main view
n
Host's context menu
n
Cluster's context menu
n
Cluster's Profile Compliance tab
Attach Entities from the Host Profiles View
Before you can apply the profile to an entity (host or cluster of hosts), you must attach the entity to the profile.
You can attach a host or cluster to a profile from the Host Profiles main view.
Procedure
1
In the Host Profiles main view, select the profile to which you want to add the attachment from the profile
list.
2
Click the Attach Host/Cluster icon.
3
Select the host or cluster from the expanded list and click Attach.
The host or cluster is added to the Attached Entities list.
4
(Optional) Click Detach to remove an attachment from a host or cluster.
5
Click OK to close the dialog.
Attach Entities from the Host
Before you can apply the profile to host you must attach the entity to the profile.
You can attach a profile to a host from the host's context menu in the Hosts and Clusters inventory view.
VMware, Inc.
183
ESXi Configuration Guide
Procedure
1
In the Hosts and Clusters view, select the host to which you want to attach a profile.
2
Right-click the host and select Host Profile > Manage Profile.
NOTE If no host profiles exist in your inventory, a dialog appears asking if you want to create and attach
the host to this profile.
3
In the Change Attached Profile dialog, select the profile to attach to the host and click OK.
The host profile is updated in the Summary tab of the host.
Applying Profiles
To bring a host to the desired state as specified in the profile, apply the profile to the host.
You can apply a profile to a host from:
n
Host Profiles main view
n
Host's context menu
n
Cluster's Profile Compliance tab
Apply a Profile from the Host Profiles View
You can apply a profile to a host from the Host Profiles main view.
Prerequisites
The host must be in maintenance mode before a profile is applied to it.
Procedure
1
In the Host Profiles main view, select the profile you want to apply to the host .
2
Select the Hosts and Clusters tab.
The list of attached hosts are shown under Entity Name.
3
Click Apply Profile.
In the Profile Editor, you might be prompted to enter the required parameters needed to apply the profile.
4
Enter the parameters and click Next.
5
Continue until all the required parameters are entered.
6
Click Finish.
Compliance Status is updated.
Apply a Profile from the Host
You can apply a profile to a host from the host's context menu.
Prerequisites
The host must be in maintenance mode before applying it to a profile.
Procedure
184
1
In the Hosts and Clusters view, select the host to which you want to apply a profile.
2
Right-click the host and select Host Profile > Apply Profile.
3
In the Profile Editor, enter the parameters and click Next.
VMware, Inc.
Chapter 15 Managing Host Profiles
4
Continue until all the required parameters are entered.
5
Click Finish.
Compliance Status is updated.
Change Reference Host
You can change the reference host in the host profile.
Procedure
1
2
You can perform this task either from the Host Profiles main view or from the host.
u
In the Host Profiles main view, right-click the profile you want to change and select Change Reference
Host.
u
In the Hosts and Clusters view, right-click the host you want to change and select Manage Profiles.
In the Detach or Change Host Profile dialog box, select whether to detatch the profile from the host or
cluster or change the profile’s reference host.
u
Click Detach to remove the association between the host and the profile.
u
Click Change to continue with updating the profile’s reference host.
If you selected Change, the Change Reference Host dialog box opens. The current host that the profile
references is displayed as the reference host.
3
Expand the inventory list and select the host to which to attach the profile.
4
Click Update.
The reference host is updated.
5
Click OK.
The Summary tab for the host profile lists the updated reference host.
Manage Profiles from a Cluster
You can create a profile, attach a profile, or update reference hosts from the cluster's context menu.
Procedure
u
In the Hosts and Clusters view, right-click a cluster and select Host Profile > Manage Profile.
Depending on your host profile setup, perform one of the following actions.
VMware, Inc.
Profile Status
Result
The cluster is not attached to a host
profile and no profile exists in your
inventory.
You are asked whether you want to create a profile. If you select Yes, the
Create Profile wizard opens.
The cluster is not attached to a host
profile and one or more profiles exist
in your inventory.
The Attach Profile dialog box opens. Select the profile that you want to attach
and click OK.
The cluster is already attached to a
host profile.
Click Detach or click Change to attach a different profile to the cluster.
185
ESXi Configuration Guide
Checking Compliance
Checking compliance ensures that the host or cluster continues to be correctly configured.
After a host or cluster is configured with the reference host profile, a manual change, for example, can occur,
making the configuration incorrect. Checking compliance on a regular basis ensures that the host or cluster
continues to be correctly configured.
Check Compliance from the Host Profiles View
You can check the compliance of a host or cluster to a profile from the Host Profiles main view.
Procedure
1
From the Host Profiles list, select the profile that you want to check.
2
In the Hosts and Clusters tab, select the host or cluster from the list under Entity Name.
3
Click Check Compliance Now.
The compliance status is updated as Compliant, Unknown, or Non-compliant.
If the compliance status is Non-compliant, you can apply the host to the profile.
Check Compliance from Host
After a profile has been attached to a host, run a compliance check to verify the configuration.
Procedure
1
In the Hosts and Clusters view, select the host on which you want to run the compliance check.
2
Right-click the host and select Host Profile > Check Compliance.
The host's compliance status is displayed in the host's Summary tab.
If the host is not compliant, you must apply the profile to the host.
Check Cluster Compliance
A cluster may be checked for compliance against a host profile or for specific cluster requirements and settings.
Procedure
186
1
In the Hosts and Clusters view, select the cluster on which you want to run the compliance check.
2
In the Profile Compliance tab, click Check Compliance Now to check the cluster's compliance with both
the host profile that is attached to this cluster and the cluster requirements, if any.
n
The cluster is checked for compliance with specific settings for hosts in the cluster, such as DRS, HA,
and DPM. For example, it may check if VMotion is enabled. The compliance status for the cluster
requirements is updated. This check is performed even if a host profile is not attached to the cluster.
n
If a host profile is attached to the cluster, the cluster is checked for compliance with the host profile.
The compliance status for the host profile is updated.
3
(Optional) Click Description next to the Cluster Requirements for a list of the specific cluster requirements.
4
(Optional) Click Description next to Host Profiles for a list of the specific host profile compliance checks.
VMware, Inc.
Chapter 15 Managing Host Profiles
5
(Optional) Click Change to change the host profile that is attached to the cluster.
6
(Optional) Click Remove to detach the host profile that is attached to the cluster.
If the cluster is not compliant, the profile must be applied separately to each host within the cluster.
VMware, Inc.
187
ESXi Configuration Guide
188
VMware, Inc.
Index
Symbols
C
* next to path 110
CA-signed certificates 161
CDP 25
certificates
certificate file 159
checking 160
default 159
disabling SSL for vSphere SDK 163
generating new 160
key file 159
location 159
SSL 159
uploading 161
vCenter Server 159
certification, security 135
changing host proxy services 164
CHAP
disabling 89
for discovery targets 87
for iSCSI initiators 86
for static targets 87
mutual 86
one-way 86
CHAP authentication 85, 150
CHAP authentication methods 86
CIM and firewall ports 141
Cisco Discovery Protocol 25, 29
Cisco switches 25
claim rules 109
clusters, managing profiles 185
compatibility modes
physical 120
virtual 120
config reset at disconnect, dvPort groups 31
configuring
dynamic discovery 84
RDM 124
SCSI storage 91
static discovery 85
creating host profile 180, 181
creating host profiles 180
current multipathing state 110
cut and paste, disabling for guest operating
systems 171
Numerics
802.1Q and ISL tagging attacks 146
A
accessing storage 72
active adapters 24
active uplinks 40, 44, 46
active-active disk arrays 111
active-passive disk arrays 111
adapter, virtual 35
adding
dvPort groups 30
NFS storage 94
adding a VMkernel network adapter 22
adding users to groups 159
admin contact info 29
Administrator role 156, 157
antivirus software, installing 171
asterisk next to path 110
attacks
802.1Q and ISL tagging 146
double-encapsulated 146
MAC flooding 146
multicast brute-force 146
random frame 146
spanning tree 146
authentication
groups 155
iSCSI storage 150
users 153, 154
vSphere Client to ESXi 153
authentication daemon 153
average bandwidth 53, 54
B
bandwidth
average 52, 53
peak 52, 53
binding on host, dvPort groups 31
block devices 120
blocked ports, dvPorts 55
burst size 52–54
VMware, Inc.
189
ESXi Configuration Guide
D
datastore copies, mounting 102
datastores
adding extents 100
configuring on NFS volumes 94
creating on SCSI disk 91
displaying 76
grouping 98
increasing capacity 100
managing 97
managing duplicate 101
mounting 102
NFS 70
paths 110
refresh 90
renaming 98
review properties 77
storage over-subscription 115
unmounting 99
viewing in vSphere Client 74
VMFS 70
dcui 156
default certificates, replacing with CA-signed
certificates 161
delegate user 92
deployments for security
multiple customer open 167, 169
multiple customer restricted 168
device disconnection, preventing 172
diagnostic partition, configuring 94
direct access 154
direct console, accessing 157
disabling
cut and paste for virtual machines 171
iSCSI SAN authentication 150
logging for guest operating systems 174, 175
SSL for vSphere SDK 163
variable information size 173
disabling paths 112
discovery
address 84
dynamic 84
static 85
disk arrays
active-active 111
active-passive 111
disk formats
NFS 92
thick provisioned 113
thin provisioned 113
disks, format 114
DMZ 133
DNS 55
190
double-encapsulated attacks 146
dvPort group, load balancing 44
dvPort groups
binding on host 31
config reset at disconnect 31
description 30
failback 44
failover order 44
live port moving 31
name 30
network failover detection 44
notify switches 44
number of ports 30
override settings 31
port blocking 54
port group type 30
port name format 31
teaming and failover policies 44
traffic shaping policies 53
virtual machines 37
dvPort Groups, adding 30
dvPorts
blocked ports 55
failback 46
failover order 46
load balancing 46
network failover detection 46
notify switches 46
port policies 55
properties 31
teaming and failover policies 46
traffic shaping policies 54
VLAN policies 48
DVS
adding a VMkernel network adapter 34
admin contact info 29
Cisco Discovery Protocol 29
IP address 29
maximum MTU 29
maximum number of ports 29
dvUplink 28
dynamic discovery, configuring 84
dynamic discovery addresses 84
E
early binding port groups 30
educational support 9
encryption
certificates 159
enabling and disabling SSL 159
for user name, passwords, packets 159
enhanced vmxnet 57, 58
VMware, Inc.
Index
exporting
host groups 157
host users 157
extents
adding to datastore 100
growing 100
F
failback 40, 44, 46
failover 40, 103
failover order 40, 44, 46
failover paths, status 110
failover policies
dvPort groups 44
dvPorts 46
port groups 42
vSwitch 40
Fibre Channel 66
Fibre Channel SANs, WWNs 68
Fibre Channel storage, overview 80
file systems, upgrading 101
firewall ports
configuring with vCenter Server 138
configuring without vCenter Server 139
connecting to vCenter Server 140
connecting virtual machine console 140
encryption 159
host to host 141
management 141
opening with vSphere Client 141
overview 137
SDK and virtual machine console 140
supported services 141
vSphere Client and vCenter Server 138
vSphere Client and virtual machine
console 140
vSphere Client direct connection 139
Fixed path policy 105, 111
forged transmissions 148, 149
forged transmits 50, 51
FTP and firewall ports 141
G
generating certificates 160
groups
about 157
adding to hosts 159
adding users 159
authentication 155
exporting a group list 157
modifying on hosts 159
permissions and roles 154
VMware, Inc.
removing from hosts 158
viewing group lists 157
guest operating systems
disabling cut and paste 171
disabling logging 174, 175
limiting variable information size 173
logging levels 174
security recommendations 171
H
hardware devices, removing 172
hardware iSCSI, and failover 107
hardware iSCSI initiator, changing iSCSI
name 82
hardware iSCSI initiators
configuring 81
installing 81
setting up discovery addresses 84
setting up naming parameters 82
viewing 81
host networking, viewing 16
host profile, attaching entities 183
host profiles
accessing 180
applying profiles 184
attaching entities from host 183
attaching entities from Host Profile view 183
changing the reference host 185
checking compliance 186
create new profile 180
create new profile from host 181
create new profile from host profile view 180
editing 182
editing policies 182
enabling policy compliance check 183
exporting 181
importing 181
managing profiles 183
usage model 179
host-to-host firewall ports 141
hosts
adding groups 159
adding to a vNetwork Distributed Switch 28
adding users 158
deployments and security 167
memory 173
thumbprints 160
HTTPS PUT, uploading certificates and
keys 161
I
IDE 66
inbound traffic shaping 53, 54
Intel Nehalem platforms 60
191
ESXi Configuration Guide
Internet Protocol 39
IP address 29
IP addresses 69
IP storage port groups, creating 22, 34
IPv4 39
IPv6 39
iSCSI
authentication 150
protecting transmitted data 151
QLogic iSCSI adapters 149
securing ports 151
security 149
software client and firewall ports 141
iSCSI aliases 69
iSCSI HBA, alias 82
iSCSI initiators
advanced parameters 89
configuring advanced parameters 90
configuring CHAP 86
hardware 81
setting up CHAP parameters 85
iSCSI names 69
iSCSI networking, creating a VMkernel port 83
iSCSI SAN authentication, disabling 150
iSCSI storage
hardware-initiated 80
initiators 80
software-initiated 80
isolation
virtual machines 130
virtual networking layer 132
virtual switches 132
VLANs 132
J
jumbo frames
enabling 58
virtual machines 57, 58
K
keys, uploading 161
L
late binding port groups 30
Layer 2 security 48
live port moving, dvPort groups 31
load balancing 40, 42, 44, 46
local SCSI storage, overview 79
localadmin 157
lockdown mode, enabling 170
log files
limiting number 175
limiting size 175
192
logging, disabling for guest operating
systems 174, 175
logging levels, guest operating systems 174
LUNs
creating, and rescan 90, 91
making changes and rescan 90
managing paths 125
masking changes and rescan 91
multipathing policy 111
setting multipathing policy 111
M
MAC address
configuring 55
generating 56
MAC address changes 148
MAC addresses, adding 56
MAC flooding 146
management access, TCP and UDP ports 142
managing paths, LUNs 125
mapped raw LUNs 125
maximum MTU 29
maximum number of ports 29
metadata, RDMs 120
modifying groups on hosts 159
Most Recently Used path policy 105, 111
mounting VMFS datastores 102
MPPs, See multipathing plugins
MRU path policy 111
MTU 58
multicast brute-force attacks 146
multipathing
active paths 110
broken paths 110
disabled paths 110
standby paths 110
viewing the current state of 110
multipathing plugins, path claiming 109
multipathing policy 111
multipathing state 110
mutual CHAP 86
N
NAS, mounting 62
NAT 39
Native Multipathing Plugin 104, 105
NetQueue
disabling 59
enabling 59
network adapters, viewing 17, 30
network address translation 39
network failover detection 40, 42, 44, 46
networking, security policies 50, 51
VMware, Inc.
Index
networking best practices 61
networking performance, NetQueue 59
networking policies 40
networking stack 21
networks, security 143
NFS, firewall ports 141
NFS datastores
as repositories 93
unmounting 99
NFS storage
adding 94
overview 92
NIC, adding 33
NIC teaming, definition 15
NIS and firewall ports 141
NMP, path claiming 109
no access role 156
No Access role 156
notify switches 40, 44, 46
O
one-way CHAP 86
outbound traffic shaping 53, 54
override settings, dvPort groups 31
P
partition mappings 120
passive disk arrays 111
passthrough device, add to a virtual machine 60
passthrough devices, configuring 60
path claiming 109
path failover, host-based 107
path failure 106
path failure rescan 90, 91
path management 103
path policies
changing defaults 112
Fixed 105, 111
Most Recently Used 105, 111
MRU 111
Round Robin 105, 111
Path Selection Plugins 105
paths
disabling 112
preferred 110
peak bandwidth 52–54
permissions
and privileges 155
overview 155
root user 155
user 155, 156
vCenter Server administrator 155
vpxuser 155
VMware, Inc.
physical adapters, removing 34
physical switches, troubleshooting 62
Pluggable Storage Architecture 104
port binding 83, 107
port blocking, dvPort groups 54
port configuration 23
port group
definition 15
using 20
port groups
failback 42
failover order 42
Layer 2 Security 49
load balancing 42
network failover detection 42
renaming 62
teaming and failover policies 42
traffic shaping 53
troubleshooting 62
port name format, dvPort groups 31
preferred path 110
private VLAN
create 32
primary 32
removing 32, 33
secondary 33
private VLANs 32
privileges and permissions 155
profiles, managing from a cluster 185
promiscuous mode 50, 51, 148, 149
properties, dvPorts 31
proxy services
changing 164
encryption 159
PSA, See Pluggable Storage Architecture
PSPs, See Path Selection Plugins
R
RAID devices 120
random frame attacks 146
raw device mapping, see RDM 117
RDM
advantages 118
and virtual disk files 123
creating 124
dynamic name resolution 121
overview 117
physical compatibility mode 120
virtual compatibility mode 120
with clustering 123
RDMs
and snapshots 120
and VMFS formats 120
193
ESXi Configuration Guide
Read Only role 156
reference hosts, changing 185
refresh 90
removing users from groups 159
replacing, default certificates 161
repositories, NFS datastores 93
rescan
LUN creation 90, 91
path masking 90, 91
when path is down 90, 91
resource limits and guarantees, security 130
roles
Administrator 156
and permissions 156
default 156
No Access 156
Read Only 156
security 156
root login, permissions 155
Round Robin path policy 105, 111
routing 55
S
SAS 66
SATA 66
SDK, firewall ports and virtual machine
console 140
security
architecture 129
certification 135
DMZ in single host 132, 133
features 129
iSCSI storage 149
overview 129
permissions 155
recommendations for virtual machines 171
resource guarantees and limits 130
virtual machines 130
virtual machines with VLANs 143
virtual networking layer 132
virtual switch ports 148
virtualization layer 130
VLAN hopping 145
VMkernel 130
VMware policy 135
vmware-hostd 153
security policies, dvPorts 50, 51
security recommendations 170
setinfo 173
single point of failure 79
SMB and firewall ports 141
SNMP and firewall ports 141
194
software iSCSI
and failover 107
diagnostic partition 94
networking 83
software iSCSI initiators
configuring 82
enabling 84
setting up discovery addresses 84
spanning tree attacks 146
SPOF 79
SSH, firewall ports 141
SSL
enabling and disabling 159
encryption and certificates 159
timeouts 161
standby adapters 24
standby uplinks 40, 44, 46
static discovery, configuring 85
static discovery addresses 84
storage
access for virtual machines 72
adapters 67
Fibre Channel 80
iSCSI 80
local 66
local SCSI 79
networked 66
NFS 92
not-shared 114
overview 65
provisioned 114
provisioning 112
SAN 80
securing with VLANs and virtual switches 145
types 66
used by virtual machines 114
viewing in vSphere Client 74
storage adapters
copying names 74
Fibre Channel 80
viewing 74
viewing in vSphere Client 74
SATPs 105
Storage Array Type Plugins 105
storage device identifiers, copying 76
storage devices
displaying for a host 75
displaying for an adapter 76
identifiers 70
names 70
paths 110
VMware, Inc.
Index
runtime names 70
viewing 75
storage filters, turning off 115
storage space 112
storage types, comparing 73
switch, vNetwork 35
from Windows domain 154
modifying on hosts 158
permissions and roles 154
removing from groups 159
removing from hosts 158
security 154
vCenter Server 154
viewing user list 157
T
targets 67
TCP ports 142
TCP/IP stack 21
teaming policies
dvPort groups 44
dvPorts 46
vSwitch 40
technical support 9
thin disks, creating 113
third-party software support policy 135
third-party switch 27
thumbprints, hosts 160
timeouts, SSL 161
traffic shaping
port groups 53
vSwitch 52
traffic shaping policies
dvPort groups 53
dvPorts 54
TSO 57
U
UDP ports 142
updated information 7
uplink adapters
adding 24
duplex 24
speed 24
uplink assignments 30
uplinks, removing 34
USB 66
user permissions
dcui 156
vpxuser 156
user roles
Administrator 157
no access 156
Read Only 156
users
about 157
adding to groups 159
adding to hosts 158
authentication 154
direct access 154
exporting a user list 157
VMware, Inc.
V
variable information size for guest operating
systems
disabling 173
limiting 173
vCenter Server
connecting through firewall 140
firewall ports 138
permissions 155
vCenter Server users 154
virtual adapter, VMkernel 36
virtual adapters, migrating 35
virtual disks, formats 113
virtual machine networking 16, 20
virtual machines
creating with RDMs 124
disabling cut and paste 171
disabling logging 174, 175
isolation 132, 133
limiting variable information size 173
migrating to or from a vNetwork Distributed
Switch 37
networking 37
preventing device disconnection 172
resource reservations and limits 130
security 130
security recommendations 171
virtual network, security 143
virtual network adapters, removing 36
virtual networking layer and security 132
virtual switch ports, security 148
virtual switch security 145
virtual switches
802.1Q and ISL tagging attacks 146
and iSCSI 151
double-encapsulated attacks 146
forged transmissions 148
MAC address changes 148
MAC flooding 146
multicast brute-force attacks 146
promiscuous mode 148
random frame attacks 146
scenarios for deployment 167
195
ESXi Configuration Guide
security 146
spanning tree attacks 146
virtualization layer, security 130
VLAN
definition 15
private 32
VLAN ID 30
VLAN policies
dvPort group 48
dvPorts 48
VLAN security 145
VLAN trunking 48
VLAN Trunking 30, 48
VLAN Type 48
VLANs
and iSCSI 151
Layer 2 security 145
scenarios for deployment 167
security 143, 146
VLAN hopping 145
VLANS, configuring for security 146
VMDirectPatch 60
VMFS
sharing 167
volume resignaturing 101
VMFS datastores
adding extents 100
changing properties 99
changing signatures 103
configuring 91
creating 71
deleting 98
increasing capacity 100
resignaturing copies 102
sharing 71
unmounting 99
VMFS volume resignaturing 101
VMkernal, TCP/IP stack 21
VMkernel
configuring 21
definition 15
security 130
VMkernel adapter 36
VMkernel network adapters, adding 22, 34
VMkernel networking 16
VMotion
definition 15
networking configuration 21
securing with VLANs and virtual switches 145
VMotion interfaces, creating 22, 34
VMware NMP
I/O flow 106
See also Native Multipathing Plugin
196
vmware-hostd 153
vNetwork Distributed Switch
adding a host to 28
adding a NIC to 33
new 28
third-party 27
VMkernel adapter 36
vNetwork Distributed Switches
adding a VMkernel network adapter 34
adding hosts to 28
admin contact info 29
Cisco Discovery Protocol 29
connecting virtual machines 37
general settings, editing 29
IP address 29
maximum MTU 29
maximum number of ports 29
migrating virtual adapters 35
migrating virtual machines to or from 37
miscellaneous policies 55
physical adapters 33
vNetwork Standard Switch
Layer 2 security 49
port configuration 23
traffic shaping 52
viewing 16
vNetwork Standard Switches, migrating virtual
adapters 35
volume resignaturing 101, 102
vpxuser 156
vSphere Client
firewall ports connecting to virtual machine
console 140
firewall ports for direct connection 139
firewall ports with vCenter Server 138
vSwitch
definition 15
failback 40
failover order 40
Layer 2 security 49
load balancing 40
network failover detection 40
notify switches 40
port configuration 23
teaming and failover policies 40
traffic shaping 52
using 19
viewing 16
W
WWNs 68
VMware, Inc.
Download PDF
Similar pages