How to Disable IPv6 ports in VMware Aria Suite Lifecycle

Products

• VMware Aria Suite

Issue/Introduction

This article describes how to Disable IPv6 ports in VMware Aria Suite Lifecycle.

Environment

VMware vRealize Suite Lifecycle Manager 8.10.x

Resolution

Before proceeding take a snapshot the VMware Aria Suite Lifecycle appliance.

VMware Aria Suite Lifecycle 8.14 or later

1. Edit the file /boot/photon.cfg by adding  ipv6.disable=1 at the end of the line for variable photon_cmdline
2. Reboot VMware Aria Suite Lifecycle
3. Validate the resutls by running the command netstat -tulpn | grep 'tcp6|udp6' (any service should be listed).

NOTE:  This change directly disables Ipv6 in Kernel, applications will not be able to detect Ipv6 availability in the system.

VMware Aria Suite Lifecycle 8.12

1. Run the commands:

sudo sysctl -w net.ipv6.conf.all.autoconf=0
sudo sysctl -w net.ipv6.conf.all.accept_ra=0
systemctl restart systemd-networkd

2.  In the configuration file: /etc/sysctl.d/99-sysctl.conf add the line:

net.ipv6.conf.lo.disable_ipv6=1

3. Disable ipv6 for vami-lighttpd service:

• In the configuration file: /opt/vmware/etc/lighttpd/lighttpd.conf change the line server.use-ipv6 = "enable" to server.use-ipv6 = "disable"
• Restart the vami-lightpd service service vami-lighttp restart

4. Disable ipv6 for vami-sfcb service:

•  In the configuration file: /opt/vmware/etc/sfcb/sfcb.cfg Add the line: ip4AddrList: 0.0.0.0
• Restart the vami-sfcb service service vami-sfcb restart

5. Disable ipv6 for sshd service:

• In the configuration file: /etc/ssh/sshd_config Add the line: AddressFamily inet
• Restart the sshd service service sshd restart

6. Disable ipv6 for ntp service:

• In the configuration file: /etc/ntp.conf Add the line: interface ignore wildcard
• Comment out the line restrict -6 ::1, once edited the line should read: #restrict -6 ::1

7. You can validate that the service are no longer listening on ipv6 using the command, if any services persist in leveraging ipv6 its recommended to reboot the appliance:

netstat -tulpn | grep 'tcp6\|udp6'