2.2 Ensure the ESXi host firewall is configured to restrict access to services running on the host

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The ESXi firewall is enabled by default and allows ping (ICMP) and communication with DHCP/DNS clients. Access to services should only be allowed by authorized IP addresses/networks.

Rationale:

Unrestricted access to services running on an ESXi host can expose a host to outside attacks and unauthorized access. Reduce the risk by configuring the ESXi firewall to only allow access from authorized IP addresses and networks.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To properly restrict access to services running on an ESXi host, perform the following from the vSphere web client:

Select the host.

Go to 'Configure' -> 'System' -> 'Security Profile'.

In the 'Firewall' section, select 'Edit...'.

For each enabled service, (e.g., ssh, vSphere Web Access, http client) provide the range of allowed IP addresses.

Click 'OK'.

See Also

https://workbench.cisecurity.org/files/3511