Restrict Host Management services on specific VMkernel adapter in ESXi 8.0

Products

• VMware vSphere ESXi

Issue/Introduction

In ESXi 8.0 environments, disabling the "Management" service tag on a VMkernel adapter prevents the adapter from being used for vSphere management services advertisement. However, this action does not terminate the underlying host-level service listeners (such as SSH or the vSphere Client HTTPS server) on that interface. Host management services bind to all available interfaces used by the default TCP/IP stack.

Environment

ESXi 8.0

Cause

Host-level services (SSH, HTTPS/rhttpproxy) are configured to listen on all interfaces bound to the default TCP/IP stack. Unchecking the "Management" service tag removes the service registration from the management plane but does not apply a network-level block for those services on that specific VMkernel IP.

Resolution

To workaround the behavior, implement one of the two workarounds listed below.

 

Workaround 1:

To create a new custom TCP/IP stack

1. Open an SSH session to the ESXi host.
2. Create a custom stack:
   
esxcli network ip netstack add -N="custom_stack_name"
   
   
3. When creating the new vmk adapter in the vSphere Client or Host Client, select the new custom TCP/IP stack from the dropdown menu instead of the default stack.

Note: iSCSI and NFS traffic generally require the Default TCP/IP stack unless you are strictly using static routing, so if this vmk is for storage, you may need to use Solution 2.

 

Workaround 2:

To restrict management access to a specific VMkernel interface, configure the ESXi Firewall to limit connections to the authorized management subnet.

1. Log in to the vSphere Client.
2. Select the host in the inventory.
3. Navigate to Configure > System > Firewall.
4. Click Edit.
5. Locate the SSH Server and vSphere Web Access services.
6. Uncheck Allow connections from any IP address.
7. In the Allowed IP addresses field, enter the specific CIDR range of your management subnet (e.g., ##.###.##.##.###/##).
8. Click OK to apply the changes.
9. The ESXi host now denies SSH and HTTPS connections originating from the backup VMkernel adapter IP address, provided that IP address falls outside the allowed CIDR range configured in the firewall.

Additional Information

For more information on hardening ESXi hosts, see Is HTTP Port 80 required for vSphere ESX.

If you require further assistance, visit Contact Broadcom Support to open a support case. To manage your support cases, see Creating and Managing Broadcom Support Cases.