Use vCenter Server firewall to protect vCenter against vCenter Server critical security bug CVE-2021

An extremely underutilized featured in vCenter Server is the vCenter Server firewall. It allows easily filtering network traffic from a network IP address level. The functionality is basic. However, it can be a powerful tool, especially in flat networks that coexit both servers, vCenter, and client operating systems.

Flat networks are certainly not best practice. Segmenting your network is not something to take lightly and can involve complexity, time, and expertise to pull it off successfully. Using the vCenter Server firewall is an easy win that eliminates the need to segment the network to secure your vCenter Server from a network perspective.

With the latest security bug (CVE-2021-22005), an attacker needs network level access to port 443. As with many exploits you will find that it starts with network access. By cutting off access to vCenter from a network perspective, you effectively eliminate the ability for an attacker to compromise the affected vCenter Server, even if it still has the vulnerability.

Learn about the vCenter Server critical security bug CVE-2021-22005 here:

[andrewcadiz]

Such an amazing feature! Its simple yet still powerful.

[FirstClassPirate]

Great video! It seems like I need to go into the firewall and create a deny rule for all networks so that vCenter doesn't take traffic from them. Is that correct or will an explicit accept at the same time mean an explicit deny to any IP thats not part of the accept rule? I'm using 7.0.

[nhanguoi]

Thanks for the helpful information. Is there way to add rule with wild card network into the vCenter? Since my network have many subnets.

[infinitebizmedia]

at what version did VMware start adding the firewall menu in vcenter 5480

[szelest]

great explanation. thanks for sharing your knowledge

[jontg]

So question, if you wanted to limit access to the VCenter web gui to all but a few machines, while still allowing clients to have full access to various applications on the hosts, would this be possible?

[chaitanyachaitu]

Can we add or delete these IP’s from shell mode

[Lurkas]

Is there any implicit "deny all" created when you add the first firewall rule?