Firewall - XML Changes (Updated)

froboy — Fri, 18 Jan 2008 18:54:00 GMT

I decided that I didn't like changing the firewall by executing esxcfg-firewall all the time. So I edited the appropriate XML file to include the nececssary ports for TSM and VMM (HP) agent. This is different for ESX 3.0.x and 3.5. One word of caution: In ESX 3.5 if you add a service to services.xml and it exists in another XML file. You can render your system inaccessible.

ESX 3.5
Service - TSM
Location - ibmTSM.xml


<ConfigRoot>
<service>
<id>TSM</id>
<rule id='0000'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>1500</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0001'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>1500</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0002'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1581</begin>
<end>1583</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0003'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1581</begin>
<end>1583</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
</service>
</ConfigRoot>

ESX 3.0.x
Service - TSM
Location - services.xml
<service id='0023'>
<id>TSM</id>
<rule id='0000'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>1500</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0001'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>1500</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0002'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1581</begin>
<end>1583</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0003'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1581</begin>
<end>1583</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
</service>

Service - VMM
Location - services.xml
Note: We discontinued use of VMM do to VM reboots.

<service id='0028'>
<id>VmmService</id>
<rule id='0000'>
<direction>inbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1124</begin>
<end>1126</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
<rule id='0001'>
<direction>outbound</direction>
<protocol>tcp</protocol>
<port type='dst'>
<begin>1124</begin>
<end>1126</end>
</port>
<flags>-m state --state NEW</flags>
</rule>
</service>

Firewall - Sync with Virtual Center

froboy — Fri, 28 Sep 2007 19:42:00 GMT

One of the initial issues I had with Virtual Center is that it did not always show the correct firewall settings. The command esxcfg-firewall seemed to be the authority on open ports. By executing 'service mgmt-vmware restart' at the command prompt it syncs up VC with esxcfg-firewall. If you decide to script this and plan on having commands after this, you will want to add a 'sleep 20' command on the next line so that the VM management service has a chance to finish the sync.

Jonathan Marrott's VM Scripting Blog

Firewall - XML Changes (Updated)

Firewall - Sync with Virtual Center