Objective 2.3 – Configure vSS and vDS Policies

See also those similar posts: Objective 2.3 – Configure vSS and VDS Policies and Objective 2.3 – Configure vSS and vDS Policies

Identify common vSS and vDS policies (similar as vSphere 4.x)

See the vSphere Networking Guide (page 43). Policies set at the standard switch or distributed port group level apply to all of the port groups on the standard switch or to ports in the distributed port group. The exceptions are the configuration options that are overridden at the standard port group or distributed port level.

The blueprint does not cover the NIOC and Monitor policies, but I suggest to study them as well.

Configure dvPort group blocking policies (similar as vSphere 4.x)

For network security policy see: http://vinfrastructure.it/2011/08/vcp5-exam-prep-part-1-4/.

For port blocking policies see the vSphere Networking Guide (page 59).

Configure load balancing and failover policies (similar as vSphere 4.1)

See the vSphere Networking Guide (page 43). Load balancing and failover policies allow you to determine how network traffic is distributed between adapters and how to re-route traffic in the event of adapter failure. The Failover and Load Balancing policies include the following parameters:

• Load Balancing policy: Route based on the originating port or Route based on IP hash (require etherchannel at switch level)or Route based on source MAC hash or Use explicit failover order or Route based on physical NIC load (only for vDS) .
• Failover Detection: Link Status or Beacon Probing (this make sense with at least 3 NICs).
• Failback: Yes or No.
• Network Adapter Order: Active or Standby or Unused.

Configure VLAN settings (same as vSphere 4.x)

See the vSphere Networking Guide (page 50). In the VLAN ID field of a port group (or distribuited port group) set a value between 1 and 4094 (0 disable the VLAN and 4095 is the same as trunk all the VLANs).

For vDS other two options are available: VLAN Trunking (to specify a range) and Private VLAN (for more info see http://kb.vmware.com/kb/1010691)

Configure traffic shaping policies (same as vSphere 4.x)

See the vSphere Networking Guide (page 54). A traffic shaping policy is defined by average bandwidth, peak bandwidth, and burst size. You can establish a traffic shaping policy for each port group and each distributed port or distributed port group.

ESXi shapes outbound network traffic on standard switches and inbound and outbound traffic on distributed switches. Traffic shaping restricts the network bandwidth available on a port, but can also be configured to allow bursts of traffic to flow through at higher speeds.

Enable TCP Segmentation Offload support for a virtual machine (same as vSphere 4.x)

See the vSphere Networking Guide (page 38). TCP Segmentation Offload (TSO) is enabled on the VMkernel interface by default, but must be enabled at the virtual machine level.

Enable Jumbo Frames support on appropriate components (new in vSphere 5)

See the vSphere Networking Guide (page 39). Now it’s possible configure the MTU from GUI also in standard vSwitch and on vmkernel interfaces.

Determine appropriate VLAN configuration for a vSphere implementation (similar as vSphere 4.x)

See the vSphere Networking Guide (page 66).  VLAN tagging is possible at diffent level: External Switch Tagging (EST), Virtual Switch Tagging (VST), and Virtual Guest Tagging (VGT).

Missing advanced features

The blueprint does not cover port Mirroring and NetFlow (new from vSphere 5)… but I suggest to study them as well. Note that also a new (and standard) discover protocol (LLDP) has been added (but only to vDS).

Objective 1.4 –Secure vCenter Server and ESXi

Most of the references are from the vSphere Security Guide, but also the old (from VI 3.x) Managing VMware VirtualCenter Roles and Permissions is still a good reference.

See also: Objective 1.4 – Secure vCenter Server and ESXi e Objective 1.4 –Secure vCenter Server and ESXi.

Identify common vCenter Server privileges and roles (similar as vSphere 4.x)

See: vSphere Security Guide (page 59). Some are available both in ESXi and vCenter Server:

• No Access: Cannot view or change the assigned object. vSphere Client tabs associated with an object appear without content. Can be used to revoke permissions that would otherwise be propagated to an object from a parent object.
• Read Only: View the state and details about the object. View all the tab panels in the vSphere Client except the Console tab. Cannot perform any actions through the menus and toolbars.
• Administrator: All privileges for all objects. Add, remove, and set access rights and privileges for all the vCenter Server users and all the virtual objects in the vSphere environment. NOTE Users who are in the Active Directory group ESX Admins are automatically assigned the Administrator role.

Describe how permissions are applied and inherited in vCenter Server (same as vSphere 4.x)

See: vSphere Security Guide (page 48 and also page 51 for some examples).

When you assign a permission to an object, you can choose whether the permission propagates down the object hierarchy. You set propagation for each permission. Propagation is not universally applied. Permissions defined for a child object always override the permissions that are propagated from parent objects.

Note that in previous releases of vCenter Server, datastores and networks inherited access permissions from the datacenter. In vCenter Server 5.0, they have their own set of privileges that control access to them. This might require you to manually assign privileges, depending on the access level you require. For more info see the vSphere Upgrade Guide (page 61).

Configure and administer the ESXi firewall (new in vSphere 5.x)

See: What’s new in vSphere 5: ESXi firewall.

Enable/Configure/Disable services in the ESXi firewall (new in vSphere 5.x)

See: What’s new in vSphere 5: ESXi firewall.

Enable Lockdown Mode (same as vSphere 4.1)

See: The New Lockdown Mode in ESXi 4.1 and the vSphere Security Guide (page 81).

Note that lockdown mode does not apply to root users who log in using authorized keys. When you use an authorized key file for root user authentication, root users are not prevented from accessing a host with SSH when the host is in lockdown mode. Also the root user is still authorized to log in to the direct console user interface when lockdown mode is enabled.

Configure network security policies (same as vSphere 4.x)

See: VMware Virtual Networking Concepts and the vSphere Security Guide (page 25).

The virtual switch (but also a port group) has the ability to enforce L2 security policies to prevent virtual machines from impersonating other nodes on the network. There are three components to this feature:

• Promiscuous mode is disabled by default for all virtual machines. This prevents them from seeing unicast traffic to other nodes on the network.
• MAC address change lockdown prevents virtual machines from changing their own unicast addresses. This also prevents them from seeing unicast traffic to other nodes on the network, blocking a potential security vulnerability that is similar to but narrower than promiscuous mode.
• Forged transmit blocking, when you enable it, prevents virtual machines from sending traffic that appears to come from nodes on the network other than themselves

For VLAN security see vSphere Security Guide (page 20).

View/Sort/Export user and group lists (same as vSphere 4.x)

See: vSphere Security Guide (page 45). Note that there are local users/groups (both ESXi and vCenter Server local users) and centralized users/groups (from a directory service).

Add/Modify/Remove permissions for users and groups on vCenter Server inventory objects (same as vSphere 4.x)

See: vSphere Security Guide (page 53) and http://www.vmwarehub.com/Permissions.html.

Create/Clone/Edit vCenter Server Roles (same as vSphere 4.x)

See: vSphere Security Guide (page 61). When you remove a role that is assigned to a user or group, you can remove assignments or replace them with an assignment to another role.

Add an ESXi Host to a directory service (similar as vSphere 4.1)

There are two different way to use an Active Directory solution in ESXi 5:

• Add a Host to a Directory Service Domain (same as ESXi 4.1): see vSphere Security Guide (page 63).
• Use the new vSphere Authentication Proxy service (CAM service): see vSphere Security Guide (page 65).

Apply permissions to ESXi Hosts using Host Profiles (same as vSphere 4.x)

See Use Host Profiles to Apply Permissions to Hosts (for host added in the AD) and the vSphere Security Guide (at page 67 to use with the vSphere Authentication Proxy).

Determine the appropriate set of privileges for common tasks in vCenter Server (similar as vSphere 4.x)

See the vSphere Security Guide and also, for other guide, the privileges requirements are always specificated.