vSphere 6.5 Security Product Walkthroughs

Are you aware of the VMware Product Walkthrough site? If not, you’re missing out on some really great content. A product walkthrough is a guided “tour” of many of VMware’s products. They are helpful when you want to do a dry run of a task, like encrypting a VM for example, so that you can become familiar with the necessary steps in the vSphere Web Client. A product walkthrough (PWT) is also helpful when demonstrating to your peers or colleagues just how easy security management has become in vSphere 6.5!

vSphere 6.5 Security Product Walkthroughs

Let’s go over the three new PWT’s that focus on vSphere 6.5 security.

VM Encryption

As mentioned in previous blogs, VM Encryption is new to vSphere 6.5 and takes a different approach from all other encryption methods available today. With VM Encryption, the encryption is done at the hypervisor level. Because a hypervisor has complete control over the virtual machine, we can encrypt I/O’s written to the virtual disk before they even reach the storage layer in the hypervisor. This allows for storage independence and ensures that data being written is never “in the clear”.

This PWT will demonstrate just how easy it is to encrypt a virtual machine. It will lead you through the necessary steps of applying the Encryption Storage Policy and end with a visual indicator that the virtual machine is encrypted.

Secure Boot for Virtual Machines

Secure Boot for Virtual Machines is something that’s been asked for quite a while. And our implementation of it could not be more easy to enable. Secure Boot, combined with the EFI firmware, allows operating systems like Windows to boot with a level of assurance that their boot loading components have not been modified by something like a rootkit. When the VM is started, the EFI firmware will validate the digital signature of the OS boot loader against a digital certificate stored in the EFI firmware. The EFI firmware for virtual machines is Secure Boot 2.3 compliant and contains certificates to support Microsoft, Linux and even nested ESXi!

This PWT will guide you through the steps of configuring a virtual machine with EFI firmware to enable Secure Boot. It is literally a checkbox.

Encrypted vMotion

Encrypted vMotion has been asked about for YEARS. It’s here now in vSphere 6.5! And, like VM Encryption, we’ve taken a different approach than you might think. We don’t actually encrypt the vMotion network. What we DO encrypt is the data going over the vMotion network. At the time of migration, a 256-bit key and 64-bit Nonce are created by vCenter. This is a one-time-use key and is not persisted!

This information is added to the migration specification sent to both hosts. Each packet is encrypted with the key and the nonce and only the receiving host can decrypt it. The best part is you don’t have to ask your network team to do anything!

This PWT will show you how to enable Encrypted vMotion on a virtual machine. It will explain the three different options available to set on the virtual machine.

Wrap Up

As pointed out in my previous blog on the PowerCLI Module for VM Encryption, all of these tasks are very easily to automate and incorporate into your existing provisioning and maintenance workflows.

I hope you find these and all the other fantastic PWT’s that the vSphere Tech Marketing Team has created for vSphere 6.5 useful in getting started in upgrading your environment.

If you have questions, I’m on Twitter or you can reply to this blog post.

Thanks for reading,
mike