NSX Manager to vCenter Server Communication Over TCP/80: Purpose, Security, and Removal Roadmap
search cancel

NSX Manager to vCenter Server Communication Over TCP/80: Purpose, Security, and Removal Roadmap

book

Article ID: 446323

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

Security audits and compliance scans (PCI-DSS, STIG, CIS, and internal BFSI controls) at customer sites frequently flag the firewall rule that permits TCP/80 from NSX Manager to vCenter Server, because the rule appears to allow unencrypted HTTP traffic. Customers — especially in regulated industries (Banking, Financial Services, and Insurance) — receive justification requests from auditors and need an authoritative answer to the following questions: -

  • What traffic actually traverses TCP/80 between NSX Manager and vCenter Server?
  • Does any sensitive information (credentials, configuration data, inventory data, certificates) traverse this port in cleartext? -
  • Is the open port still required in current and future product releases?

This article documents the precise role of TCP/80, confirms that no sensitive data is transmitted in cleartext, and explains the release in which the dependency is eliminated.

Environment

  • VMware NSX 4.x, 9.0, 9.1.0 (TCP/80 required).
  • VMware NSX 9.1.1 and later (TCP/80 no longer required).
  • VMware vCenter Server 7.x, 8.x, 9.0, 9.1.0 (accepts the request on TCP/80).
  • VMware vCenter Server 9.1.1 and later (TCP/80 closure supported).
  • VCF 9.1.1 and later. Both NSX and vCenter must be at 9.1.1 or later for TCP/80 to be safely closed.

Cause

NSX Manager uses the vCenter VMOMI API method SessionManager.loginExtensionByCertificate() to authenticate as the NSX-registered vCenter extension. This authentication path is required for the following operations: -

  • Discovering and synchronizing vCenter objects (applicable prior to NSX 9.0).
  • Performing operations on vCenter managed objects (applicable prior to NSX 9.0).
  • Elevating service-account privileges and remediating privilege drift (applicable to NSX 9.0.x and above).

In NSX releases prior to 9.1.1, this method is invoked through vCenter's internal sdkTunnel:8089 endpoint, which is accessible only via an HTTP CONNECT proxy hosted by the vCenter reverse proxy on TCP/80. TCP/80 serves solely as the transport-layer tunnel setup mechanism — no application data flows in cleartext over this port. All sensitive content, including credentials, VMOMI payloads, and inventory data, is encrypted end-to-end using TLS inside the tunnel before any data is transmitted over the wire. The negotiated TLS version (1.2 or 1.3) is determined by the NSX and vCenter release combination, with TLS 1.3 becoming available from NSX 4.1.2 and vCenter 8.0 Update 3 onward.

For TLS version configuration details, refer to:

  1. vSphere TLS Configuration — Managing TLS Protocol Configuration with the TLS Reconfiguration Utility: vSphere TLS Configuration
  2. KB 319144 — Disable/Enable VMware NSX Manager/Global Manager Ciphers or TLS Settings: Disable/Enable VMware NSX Manager/Global manager Ciphers or TLS Settings 
  3. KB 437968 — Mandatory Cipher Suites in NSX 4.2.3.1 for TLS 1.3 Compliance: Mandatory cipher suites in NSX 4.2.3.1 for TLS 1.3 compliance.

Note: TCP/443 Traffic: NSX also establishes direct TLS connections to vCenter on TCP/443 (no HTTP CONNECT tunnel) solely for the vCenter version probe (GET /sdk/vimServiceVersions.xml). loginExtensionByCertificate() and all inventory synchronization traffic are not carried over this port.

Resolution

The recommended resolution depends on the NSX and vCenter versions currently deployed.

  1. Scenario 1 — VCF 9.1.1 or later (NSX and vCenter are both at 9.1.1 or later):

    1. Step 1: No NSX-side action is required. NSX automatically detects the vCenter version at runtime and switches the proxy transport from HTTP/80 to HTTPS/443 (TLS-over-TLS).
    2. Step 2: The transition is zero-downtime; existing Compute Manager connections continue to function during and after the switch.
    3. Step 3: Safely close the firewall rule permitting TCP/80 from NSX Manager to vCenter Server.
    4. Step 4: Stale HTTP/80 iptables rules and the deprecated reverseProxyHttpPort value on the NSX side are cleaned up automatically during the NSX upgrade-finalize step. No manual cleanup is required.

  2. Scenario 2 — VCF below 9.1.1 (NSX or vCenter is below 9.1.1):

    1. Step 1: TCP/80 must remain open between NSX Manager and vCenter Server. Do NOT block this port. Blocking TCP/80 in a pre-9.1.1 deployment will immediately break the vCenter connection, set the Compute Manager Connection Status to DOWN, prevent service-account privilege elevation, and leave privilege-drift unremediated with no automatic recovery.
    2. Step 2: For the audit response, cite this KB article and the data-flow classification table in the Additional Information section as evidence that no sensitive data is exposed over TCP/80.
    3. Step 3: Plan an upgrade to VCF 9.1.1 to eliminate the dependency.
Powered by Wolken Software