ESX Configuration Guide

Automating Service Behavior Based on Firewall Settings

ESX can automate whether services start based on the status of firewall ports.

Automation helps ensure that services start if the environment is configured to enable their function. For example, starting a network service only if some ports are open can help avoid the situation where services are started, but are unable to complete the communications required to complete their intended purpose.

In addition, having accurate information about the current time is a requirement for some protocols, such as Kerberos. The NTP service is a way of getting accurate time information, but this service only works when required ports are opened in the firewall. The service cannot achieve its goal if all ports are closed. The NTP services provide an option to configure the conditions when the service starts or stops. This configuration includes options that account for whether firewall ports are opened, and then start or stop the NTP service based on those conditions. Several possible configuration options exist, all of which are also applicable to the SSH server.

NOTE The settings described in this section only apply to service settings configured through the vSphere Client or applications created with the vSphere Web services SDK. Configurations made through other means, such as the esxcfg-firewall utility or configuration files in /etc/init.d/, are not affected by these settings.

nStart automatically if any ports are open, and stop when all ports are closed – The default setting for these services that VMware recommends. If any port is open, the client attempts to contact the network resources pertinent to the service in question. If some ports are open, but the port for a particular service is closed, the attempt fails, but there is little drawback to such a case. If and when the applicable outgoing port is opened, the service begins completing its tasks.

nStart and stop with host– The service starts shortly after the host starts and closes shortly before the host shuts down. Much like Start automatically if any ports are open, and stop when all ports are closed, this option means that the service regularly attempts to complete its tasks, such as contacting the specified NTP server. If the port was closed but is subsequently opened, the client begins completing its tasks shortly thereafter.

nStart and stop manually – The host preserves the user-determined service settings, regardless of whether ports are open or not. When a user starts the NTP service, that service is kept running as long as the host is powered on. If the service is started and the host is powered off, the service is stopped as part of the shutdown process, but as soon as the host is powered on, the service is started again, preserving the userdetermined state.

Configure How Service Startup Relates to Firewall Configuration

The Startup Policy determines when a service starts. You can configure how service startup relates to a firewall configuration by editing the Startup Policy.

Procedure

1 Log in to a vCenter Server system using the vSphere Client.

2Select the host in the inventory panel.

3Click the Configuration tab and click Security Profile.

The vSphere Client displays a list of active incoming and outgoing connections with the corresponding firewall ports.

4Click Properties.

The Firewall Properties dialog box lists all the services and management agents you can configure for the host.

158	VMware, Inc.