ESX Configuration Guide

Both methods prevent anyone without access to the service console VLAN or virtual switch from seeing traffic to and from the service console. They also prevent attackers from sending any packets to the service console. As an alternative, you can choose to configure the service console on a separate physical network segment instead. Physical segmentation provides a degree of additional security because it is less prone to later misconfiguration

Set up a separate VLAN or virtual switch for vMotion and network attached storage.

Virtual Switch Protection and VLANs

VMware virtual switches provide safeguards against certain threats to VLAN security. Because of the way that virtual switches are designed, they protect VLANs against a variety of attacks, many of which involve VLAN hopping.

Having this protection does not guarantee that your virtual machine configuration is invulnerable to other types of attacks. For example, virtual switches do not protect the physical network against these attacks; they protect only the virtual network.

Virtual switches and VLANs can protect against the following types of attacks.

MAC flooding	Floods a switch with packets that contain MAC addresses tagged as having
	come from different sources. Many switches use a content-addressable
	memory (CAM) table to learn and store the source address for each packet.
	When the table is full, the switch can enter a fully open state in which every
	incoming packet is broadcast on all ports, letting the attacker see all of the
	switch’s traffic. This state might result in packet leakage across VLANs.
	Although VMware virtual switches store a MAC address table, they do not get
	the MAC addresses from observable traffic and are not vulnerable to this type
	of attack.
802.1q and ISL tagging	Force a switch to redirect frames from one VLAN to another by tricking the
attacks	switch into acting as a trunk and broadcasting the traffic to other VLANs.
	VMware virtual switches do not perform the dynamic trunking required for
	this type of attack and, therefore, are not vulnerable.
Double-encapsulation	Occur when an attacker creates a double-encapsulated packet in which the
attacks	VLAN identifier in the inner tag is different from the VLAN identifier in the
	outer tag. For backward compatibility, native VLANs strip the outer tag from
	transmitted packets unless configured to do otherwise. When a native VLAN
	switch strips the outer tag, only the inner tag is left, and that inner tag routes
	the packet to a different VLAN than the one identified in the now-missing outer
	tag.
	VMware virtual switches drop any double-encapsulated frames that a virtual
	machine attempts to send on a port configured for a specific VLAN. Therefore,
	they are not vulnerable to this type of attack.
Multicast brute-force	Involve sending large numbers of multicast frames to a known VLAN almost
attacks	simultaneously to overload the switch so that it mistakenly allows some of the
	frames to broadcast to other VLANs.
	VMware virtual switches do not allow frames to leave their correct broadcast
	domain (VLAN) and are not vulnerable to this type of attack.

164	VMware, Inc.