topic Can not disable vsanvp firewall rule... in ESXi Discussions

Can not disable vsanvp firewall rule...

JarryG — Thu, 24 Sep 2015 18:32:09 GMT

I'm trying to tighten a little bit security of my solo ESXi 6.0 server by disabling unnecessary services/rules, so I want to disable firewall rule for vsanvp. But when I try it (using native client), all I get is the message:

Call "HostFirewallSystem.DisableRuleset" for object "firewallSystem" on ESXi "<my_esxi_IP>" failed.

And Security Profile still shows I have allowed incomming/outgoing connections for vsanvp.

vSphere 6.0 docu says:

VSAN VASA Vendor Provider. Used by the Storage Management Service (SMS) that is part of vCenter to access information about Virtual SAN storage profiles, capabilities, and compliance. If disabled, Virtual SAN Storage Profile Based Management (SPBM) does not work.

But I'm using neither vCenter nor virtual san-storage. So why I still can not disable firewall rule for vsanvp?

Re: Can not disable vsanvp firewall rule...

danpritts3 — Thu, 19 Nov 2015 04:17:23 GMT

I am having the same problem.

In lieu of disabling it entirely, I restricted it to an unused IP range.

esxcli network firewall ruleset allowedip add -i 10.x.y.z/31 -r vsanvp

Re: Can not disable vsanvp firewall rule...

AndyDodsworth — Thu, 16 Jun 2016 22:01:36 GMT

Interested to know if either of you had an update on a fix other than removing IP range?

Re: Can not disable vsanvp firewall rule...

msjagadish — Fri, 24 Jun 2016 04:58:41 GMT

Hello,

I don't it is recommended to disable "vsanvp" firewall rule. This is a required parameter on a ESXi host.

Vmware KB for reference : http://kb.vmware.com/kb/2092598

I hope this answers your query.

Best Regards,

Jagadish M S