ESX Configuration Guide

Remove a Security Policy

You can remove a security policy from the ESX host.

You can remove a security policy using the vSphere CLI. For information on using the vSphere CLI, see the vSphere Command-Line Interface Installation and Scripting Guide and the vSphere Command-Line Interface Reference.

Prerequisites

Be sure that the security policy you want to use is not currently in use. If you try to remove a security policy that is in use, the removal operation fails.

Procedure

uUse the command esxcfg-ipsec --remove-sp security policy name.

List Available Security Policies

ESX can provide a list of all security policies on the host.

You can get a list of available security policies using the vSphere CLI. For information on using the vSphere CLI, see the vSphere Command-Line Interface Installation and Scripting Guide and the vSphere Command-Line Interface Reference.

Procedure

uUse the command esxcfg-ipsec -L.

ESX displays a list of all available security policies.

Securing iSCSI Storage

The storage you configure for an ESX host might include one or more storage area networks (SANs) that use iSCSI. When you configure iSCSI on an ESX host, you can take several measures to minimize security risks.

iSCSI is a means of accessing SCSI devices and exchanging data records by using TCP/IP over a network port rather than through a direct connection to a SCSI device. In iSCSI transactions, blocks of raw SCSI data are encapsulated in iSCSI records and transmitted to the requesting device or user.

iSCSI SANs let you make efficient use of existing Ethernet infrastructures to provide ESX hosts access to storage resources that they can dynamically share. iSCSI SANs provide an economical storage solution for environments that rely on a common storage pool to serve numerous users. As with any networked system, your iSCSI SANs can be subject to security breaches.

NOTE The requirements and procedures for securing an iSCSI SAN are similar for the hardware iSCSI adapters you can use with ESX hosts and for iSCSI configured directly through the ESX host.

Securing iSCSI Devices Through Authentication

One means of securing iSCSI devices from unwanted intrusion is to require that the ESX host, or initiator, be authenticated by the iSCSI device, or target, whenever the host attempts to access data on the target LUN.

The goal of authentication is to prove that the initiator has the right to access a target, a right granted when you configure authentication.

ESX does not support Kerberos, Secure Remote Protocol (SRP), or public-key authentication methods for iSCSI. Additionally, it does not support IPsec authentication and encryption.

Use the vSphere Client to determine whether authentication is being performed and to configure the authentication method.