Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Configuring IPv6 and IPsec on vSphere ESX, ESXi 4.1, 5.x and 6.0 (1021769)

Last Updated: 3/20/2024Categories: Best PracticesTotal Views: 50224Language:
Chinese (Simplified)JapaneseEnglish

4 like this article

Subscribe to get an email
newsletter with new updates

4 people found this helpful Please provide article feedback:

Purpose

VMware vSphere ESX/ESXi 4.1 supports IPv4 and IPv6, though IPv6 support is disabled by default. This article provides steps to enable IPv6, and configuring the IPsec for IPv6 VMkernel traffic.

For more information, see the Advanced Networking: Internet Protocol Version 6 section in the ESX/ESXi 4.1 Configuration Guide.

For more information on configuring IPv6 on ESX/ESXi 4.0, see Configuring IPv6 on ESX 4.0.x (1010812).

IPv6 is disabled by default in ESXi 5.0, and enabled by default in ESXi 5.1, 5.5 and 6.0. For more more information, see the Enable or Disable IPv6 Support on a Host by Using the vSphere Web Client section in the vSphere Networking Guide.

Resolution

VMware vSphere ESX/ESXi 4.1 supports IPv6 for use with the Service Console and VMkernel management interfaces, and is compatible with vMotion, High Availability (HA) and Fault Tolerance (FT).

Notes:

IPv6 should be considered experimental when used for iSCSI purposes in ESX/ESXi 4.x and 5.x.

IPv6 is not supported for use with iSCSI in ESXi 5.1 and ESXi 5.5. For more information, see ESXi iSCSI SAN Restrictions section in the vSphere Storage Guide.

IPv6 cannot be used with dependent hardware iSCSI initiators in conjunction with TCP Checksum Offload.

Enabling IPv6 on vSphere ESX/ESXi 4.1

IPv6 support can be enabled or disabled on a vSphere ESX/ESXi 4.1 host using the vSphere Client, the console or using the vSphere Command-Line Interface. Enabling IPv6 requires a restart to take effect.

To enable IPv6 using the vSphere Client:

Connect to the host or vCenter Server using the vSphere Client.

Select the host in the inventory and click the Configuration tab.

Under the Hardware section, click the Networking.

In the Virtual Switch view, click the top-level Properties.

Select Enable IPv6 support on this host system.

Click OK.

Restart the host for changes to take effect.

Note: To disable IPv6, deselect the checkbox and restart.

To enable IPv6 using the console or vCLI commands:

Open a console to the ESX or ESXi host, or to the location the vCLI is installed. For more information, see:

Unable to connect to an ESX host using Secure Shell (SSH) (1003807)

Using Tech Support Mode in ESXi 4.1 (1017910)

vSphere Command-Line Interface documentation.

Enable IPv6 support on the VMkernel network interfaces by running one of these commands:

At the console: esxcfg-vmknic --enable-ipv6 true

Using the vCLI: vicfg-vmknic connection_options --enable-ipv6 true

For ESX only, additionally enable IPv6 support for the Service Console network interfaces by running this command:

At the console: esxcfg-vswif --enable-ipv6 true

Restart the host for the changes to take effect.

Note: To disable IPv6, replace true with false in the commands and restart.

Enabling IPv6 on vSphere ESX/ESXi 5.5 and 6.0

To enable IPv6 in ESXi 5.5 and 6.0:

In the vSphere Web Client, navigate to the host.

In the Manage tab, click Networking and select Advanced.

Click Edit.

In the IPv6 support option, enable or disable IPv6 support.

Click OK.

Reboot the host to apply the changes in the IPv6 support.

Configuring IPv6 interface addresses on vSphere ESX/ESXi 4.1

IPv6 addresses can be configured for VMkernel and Service Console network interfaces using the vSphere Client or using the command line.

To set an IPv6 address using the vSphere Client, see the VMkernel Networking Configuration and Service Console Configuration section in the ESX/ESXi 4.1 Configuration Guide.

Set an IPv6 address for a VMkernel network interfaces using the console or vCLI by running one of these commands:

esxcfg-vmknic --ip X:X:X:X::/XPortgroupName
vicfg-vmknic connection_options --ip X:X:X:X::/X PortgroupName

Set an IPv6 address for a Service Console network interface using the console by running this command:
esxcfg-vswif --ip X:X:X:X::/X vSwifName
Configuring IPsec for IPv6 on vSphere ESXi 5.x and 6.0

Internet Protocol Security (IPsec) secures IP communications coming from and arriving at a host. ESXi hosts support IPsec using IPv6.

After you set up IPsec on a host, you enable authentication and encryption of incoming and outgoing packets. The time and the method of IP traffic encryption depends on the method you use to set up the security associations and the security policies of the system. For more information, see the vSphere Security Guide.

Configuration is performed from the ESXi host console or remotely through the vSphere Command-Line Interface using the esxcli network ip ipsec command. Configuration of IPsec cannot be performed using the vSphere Client. For more information, see the vSphere Command-Line Interface documentation.

Add a Security Association (SA) by running this command:

esxcli network ip ipsec sa add --sa-source x:x::/x --sa-destination x:x::/x --sa-mode transport --sa-spi 0x1000 --encryption-algorithm Algorithm --encryption-key Encrypton_Key --integrity-algorithm hmac-sha1 --integrity-key 0x6970763672656164796c6f67736861316f757432 --sa-name security_association_name

Add a Security Policy (SP) by running this command:

esxcli network ip ipsec add --sp-source=x:x::/x --sp-destination=x:x::/x --source-port=port --destination-port= port --upper-layer-protocol=tcp --flow-direction= out --action=ipsec --sp-mode=transport --sa-name= security_association_name --sp-name=security_policy_name

List the defined Security Associations and Security Policies by running these commands:

esxcli network ip ipsec sa list
esxcli network ip ipsec sp list

Delete a defined Security Association or Security Policy by running these commands:

esxcli network ip ipsec sa remove --sa-name security_association_name
esxcli network ip ipsec sp remove --sa-name security_policy_name

Configuring IPsec for IPv6 on vSphere ESX/ESXi 4.1

Internet Protocol Security (IPsec) secures IP communications coming from and arriving at an ESX/ESXi host. VMware vSphere ESX/ESXi 4.1 supports IPsec using IPv6 with manual key exchange for VMkernel network interfaces only.

When IPsec is enabled on a host, authentication and encryption of incoming and outgoing packets is performed. When and how IP traffic is encrypted depends on configuration of the system's security associations and policies. For more information, see the Internet Protocol Security section of the ESX/ESXi Server Configuration Guide.

Configuration can be performed from the ESX/ESXi host console using the esxcfg-ipsec command, or remotely through the vSphere Command-Line Interface using the vicfg-ipsec command. Configuration of IPsec cannot be performed using the vSphere Client. The two commands have the same syntax, and only vicfg-ipsec is used in subsequent examples. For more information, see the vSphere Command-Line Interface documentation and the vicfg-ipsec command reference.

Add a Security Association (SA) by running this command:

vicfg-ipsec connection_options --add-sa --sa-src x:x::/x --sa-dst x:x::/x --sa-mode transport --ealgo null --spi 0x200 --ialgo hmac-sha1 --ikey keySAName

Add a Security Policy (SP) by running this command:

vicfg-ipsec connection_options --add-sp --sp-src x:x::/x --sp-dst x:x::/x --src-port 100 --dst-port 200 --ulproto tcp --dir out --action ipsec --sp-mode transport --sa-name SANameSPName

For example, to add a generic security policy with default options:

vicfg-ipsec connection_options --add-sp --sp-src any -sp-dst any --src-port any --dst-port any --ulproto any --dir out --action ipsec --sp-mode transport --sa-name SANameSPName

For example, to add a security policy to filter traffic as in a firewall:

vixcfg-ipsec connection_options --add-sp --sp-src x:x::/x --sp-dst x:x::/x --src-port 100 --dst-port 200 --ulproto tcp --dir out --action discard SPName

List the defined Security Associations and Security Policies by running these commands:

vicfg-ipsec connection_options --list-sa
vicfg-ipsec connection_options --list-sp

Delete a defined Security Association or Security Policy by running these command:

vicfg-ipsec connection_options --remove-sa SAName
vicfg-ipsec connection_options --remove-sp SPName

Related Information

The Internet Engineering Task Force has designated IPv6 as the successor to IPv4. The adoption of IPv6, both as a standalone protocol and in a mixed environment with IPv4, is rapidly increasing. With IPv6, you can use vSphere features in an IPv6 environment.

A major difference between IPv4 and IPv6 is address length. IPv6 uses a 128-bit address rather than the 32-bit addresses used by IPv4. This helps alleviate the problem of address exhaustion that is present with IPv4 and eliminates the need for network address translation (NAT). Other notable differences include link-local addresses that appear as the interface is initialized, addresses that are set by router advertisements, and the ability to have multiple IPv6 addresses on an interface.

An IPv6-specific configuration in vSphere involves providing IPv6 addresses, either by entering static addresses or by using an automatic address configuration scheme for all relevant vSphere networking interfaces.

For more information, see the Advanced Networking: Internet Protocol Version 6 section of the ESX/ESXi 4.1 Configuration Guide.
Configuring IPv6 on ESX 4.0.x
vSphere ESX、ESXi 4.1、および ESXi 5.x で IPv6 と
在 vSphere ESX、ESXi 4.1、5.x 和 ESXi 6.0 上配置 IPv6 和 IPsec

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
VirtualCenter 中大容量快照删除操作超时 (1004932)

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
VMware vSphere や Infrastructure Client で検出できない未処理の差分ファイルやスナップショットがあるかどうかを調べる (1005049)

KB
•
Como consolidar instantâneos (1007849)

Results 1-4 of 4

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vSphere ESXi

VMware ESX Server

Related Versions:

VMware vSphere ESXi 6.0

VMware vSphere ESXi 5.5

VMware vSphere ESXi 5.1

VMware vSphere ESXi 5.0

VMware ESXi 4.1.x Installable

VMware ESXi 4.1.x Embedded

VMware ESX 4.1.x

Take Our Survey

Support Assistant