Firewall Port Question: Relocating one VCSA to another VMWare Environment

[DanPaLewis]

Hello all,

Please bear with me as I have had to re-write this several times. To illustrate the issue:

VCSA

• Site 1
  • ESXI1
  • ESXI2
• Site 2
  • ESXI1
  • ESXI2
• Site 3
  • ESXI1
    • Current location of VCSA server
  • ESXI2

As you can see, Site 3 is where the current VCSA server is located... however, this site is relocating to another area / facility. The ESXI hosts will go away, and after previous discussion here we decided to simply migrate the VCSA server to the other vSphere environment we manage that is separate from this existing layout. The goal here is to maintain usage of the VCSA server to continue managing this environment while it is moved to the other. All of the sites do not communicate with each other except for the current Site 3. They don't move guests between sites or anything like that.

That being said, one of the things that I'm attempting to figure out is what kind of firewall changes I am going to have to make in order to make this work. Each of the Site specific firewalls are going to have to be modified to point to the new location for things... but that's what I'm trying to determine, what needs to talk.

Obviously the sites will need to communicate with the VCSA server. Is there any reason I would have to open up the firewall to the new setups' ESXI hosts? Or do they ONLY need to talk to the VCSA server that they previously were speaking with?

[pragg12]

Hi

Welcome to VMTN.

Since no specific details regarding VMware infrastructure are mentioned, I will assume when you will migrate VCSA from site 3 to site 2, you will be required to re-configure VCSA as per site 2 network settings and open ports for all other sites' ESXI hosts to VCSA. Once the new site is configured, open ports between VCSA and ESXi hosts. You have the option to either re-migrate with same steps or leave it as it is.

I am listing some common source and destination respectively that as per me, you need to open ports between.

1. ESXi , vCenter

2. vCenter, AD (DNS, NTP, SMTP, SNMP, LDAP, etc)

3. vCenter, Syslog server

4. Client, vCenter

5. vCenter and other 3rd party software like backup, vRealize etc.

You can refer to below VMware KB for port details. Refer to PDF attachment in KB.

Network port diagram for vSphere 6.x (2131180)

Note: Make sure that once this activity is finished, you perform cleanup by getting the unused firewall rules removed.

[DanPaLewis]

Thanks Pragg!

Hopefully this response isn't confusing, I know this is has been tricky for me to write to give enough detail on the layout. So you're correct. We are performing the following:

VCSA 1 - Controls vSphere 1

VCSA 2 - Controls vSphere 2

VCSA 2 is going to be migrated to VCSA 1 / vSphere 1's equipment. VCSA 2 will still only manage vSphere 2, and VCSA 1 will only treat it as another virtual machine, and the two will not necessarily co-exist with each other. I know that I am going to have to update the firewalls at all of the sites under vSphere 2 so that their ESXi hosts can communicate with the new IP address of VCSA 2, which you have confirmed in your thoughtful reply.

I guess what I am attempting to figure out: For any reason, do the ESXi hosts in vSphere 2 need to communicate with the ESXi hosts in vSphere 1, since that is where VCSA 2 is going to reside? Or do hosts in vSphere 2 not need to directly communicate for any reason within vSphere 1 other than the VCSA server that controls them?

In addition to that question, here are some thoughts on your reply below:

1. ESXi , vCenter

This i figured would be required, so the ESXi hosts under vSphere 2 will now have a new opening to the new IP address for VCSA 2 once it is migrated.

2. vCenter, AD (DNS, NTP, SMTP, SNMP, LDAP, etc)

As VCSA 2 will be behind the same firewall as two of the domain controllers for the domain, this is already in place and won't be an issue.

3. vCenter, Syslog server

Hmm this is something that we need to double check. Is there a way to find out what syslog server your VCSA server is pointing to now?

4. Client, vCenter

For this you're referring to the guests right? Ok, that makes sense. Any new guest that I create at a remote site needs to communicate with VCSA. This would already be in place once the changes are made for #1, however it also means going forward if I create any additional guests, additional firewall openings are going to have to be made. Understood!

5. vCenter and other 3rd party software like backup, vRealize etc.

The only thing that we have going on right now is CommVault however that may change with the implementation of VEEAM (MAYBE). I've already reached out to our corporate representative for CommVault for information.

Thanks again!

[pragg12]

I guess what I am attempting to figure out: For any reason, do the ESXi hosts in vSphere 2 need to communicate with the ESXi hosts in vSphere 1, since that is where VCSA 2 is going to reside? Or do hosts in vSphere 2 not need to directly communicate for any reason within vSphere 1 other than the VCSA server that controls them?

If I have got your queries correctly, then - No and Yes.

Basically, hosts in VCSA 2 do not need to communicate with hosts in VCSA 1 and vice versa.The VCSA as a VM can be managed by other VCSA with no issues.

Hmm this is something that we need to double check. Is there a way to find out what syslog server your VCSA server is pointing to now?

Refer to Forward vCenter Server Appliance Log Files to Remote Syslog Server

[DanPaLewis]

Thanks for the reply again Pragg.

So basically while I'm looking at it, we aren't doing anything with remote copying of logs to a different server, so that's a plus. So basically, all I need to do is on the remote site firewalls, allow bidirectional communication back and forth between their two ESXi hosts and the new IP address of the VCSA server?

If that's right, then this is easy peasy. Then, I plan on vMotioning the VCSA to the new environment, and as long as I don't have to update anything other than DNS we should be rocking and rolling. Does this all sound good to you?

[pragg12]

So basically while I'm looking at it, we aren't doing anything with remote copying of logs to a different server, so that's a plus. So basically, all I need to do is on the remote site firewalls, allow bidirectional communication back and forth between their two ESXi hosts and the new IP address of the VCSA server?

Yes, correct. Refer to the network port diagram which I shared earlier and make sure required ports are opened wherever required. If you face any issue, check the ports. Let us know in case of any issue.

Good Luck. 🙂

[DanPaLewis]

Pragg,

There is one thing that is confusing me and I am hoping that you can answer this pretty easily. I took a look at the diagram but will have to study it further. When I am dealing with the firewall rules, do I only need to open up communication between the global ESXi servers and the VCSA server? Or, do I have to worry about having entries for every single VM Guest IP address to ensure it can talk to the VCSA server as well? That second part doesn't make sense to me as you can create a server and operate on it before it even has an IP address.

If the former is true, and we just need to make sure the hosts can talk to the VCSA, then that makes my life a lot easier and I don't have to worry about as many IP addresses being added and tracked.

Thanks!

[pragg12]

When I am dealing with the firewall rules, do I only need to open up communication between the global ESXi servers and the VCSA server?

Yes, if there's no other services connected with VMware environment like Syslog, which you have already confirmed in previous response.

Or, do I have to worry about having entries for every single VM Guest IP address to ensure it can talk to the VCSA server as well?

This is not required. You need to ensure vCenter talks with ESXi hosts and that will be enough to manage VMs on the same ESXi hosts.