DO create Service Accounts on your authentication directory or SSO for vSphere associated services.DO create specific vCenter Roles per required service (Such as: Veeam Backup and Replication), allowing only the specific privilege(s) required by the service and as published by the OEM of the service.DO disable SSH access for the ESXi Hosts and vCenter VCSA whenever not actively using SSH for administration.DO restrict the vSphere Management Network access, allowing only necessary communications (Such as: NTP, AD, Client) to other networks on the Layer 3 firewall/router.DO use the ESXi and VCSA firewall to restrict access to specific hosts/networks.DO Enable Lockdown Mode on ESXi Hosts.DO use DNS to register/access your VMware vSphere assets such as vCenter and ESXi.DO configure forward lookup DNS for ESXi Hosts and forward+reverse lookup DNS for vCenter VCSA.DO configure vCenter VCSA backups using the VAMI backup utility.DO set vCenter VCSA root and SSO administrator password expiration policy and update the password as specified in that policy.DO set strong passwords for all your vSphere and Infrastructure host and device accounts (Such as: root, SSO administrator, etc.).DO use a secure password manager to generate and store strong passwords for all your vSphere and Infrastructure assets.Example ESXi Firewall rule for vSphere Management Network: 9.Example ESXi Firewall rule for client communication: 8.

Understanding the vCenter VCSA Firewall 7.If you have a Best Practice you would like to see included in this list, or if you feel any of my Best Practices are mis-stated, I welcome input please contact me by email or phone. My intent is to help VMware users of all skills and experience levels avoid some of the “gotcha’s” that I have seen, experienced, or heard about from other users. I base these Best Practices recommendations on my personal, and VMsources collective experience, in dealing with hundreds (if not thousands, at this point) of unique client environments over the last decade. In this post I have created a general-purpose Best Practices guideline for VMware vSphere, including references. John Borhek VMware, VMware vSphere March 9, 2022

Esxi remove vcenter control