Network engineers often implement security at Layer 2, turning ports off if a system is misbehaving. For VMware ESX, this practice could be potentially disastrous as many virtual machines (VM) may share a single port. Fortunately, with a little help from a VMware tool, you can avoid this mess and never suffer the wrath of a Layer-2 overkill outage again.
The VMware ESX service console is being retired, so there goes the ability to run scripts locally on an ESX server. That means that the VI3 (VMware Infrastructure 3) Software Developers Kit is about to become a necessity for those who want to interact with ESX programatically. This tip, and others in my SDK series, offers useful ways to leverage the SDK to help make your everyday interaction with ESX/VI3 all the more seamless.
That is why I am writing a series of tips about the VI3 SDK. These tips will focus on useful ways to leverage the SDK to help make your everyday interaction with VI3 all the more seamless. To begin this series I present instructions on how to build a small program that can be used to modify the connection status of a guest's network interface card (NIC). Many organizations' information security and/or networking departments implement security at a Layer-2 level - if they detect an infected machine on the network they will shut off its port. That's fine and dandy when dealing with physical servers, but what about ESX? If a port is shut down then it could potentially shut off access for several virtual machines (VMs), not just the one that is misbehaving. The solution is to produce a tool that can shutdown the network interface of a specific VM. Follow along with me as I present code written in C# that does just that.
If you want to follow along in your integrated development environment (IDE) the complete project is available for download at lostcreations.com. It is a Visual Studio 2005 project.
The code I have written, available for download here, builds on previous examples I have written about the SDK. I will begin my explanation of this program on line 106 of the file Program.cs, but explanations for how I parse the command line options and how I connect to the VI3 SDK Web service are available in my three part introduction to the VI3 SDK: Understanding the VI3 SDK, Leveraging the VI3 SDK with .NET, and Exploring the SDK.
That's all there is to it! The program gnicmod.exe can be executed from the command line in order to alter the connection state of one, or many, guest NICs. An example of its usage and output is as follows:
C:\gnicmod -s vcms.lostcreations.local -l -u akutz -p mypassword -m i:
192.168.0.111,p:connected,v:true,f:true -m i:
192.168.0.87,p:connected,v:false,f:false
+,192.168.0.111,connected,true
+,192.168.0.87,connected,false
Network engineers often implement security at Layer 2, turning ports off if a system is misbehaving. For VMware ESX, this practice could be
potentially disastrous as many virtual machines (VM) may share a single port. Fortunately, with a little help from a VMware tool, you can avoid this mess and never suffer the wrath of a Layer-2 overkill outage again.
The VMware ESX service console is being retired, so there goes the ability to run scripts locally on an ESX server. That means that the VI3 (Virtual Infrastructure 3) Software Developers Kit is about to become a necessity for those who want to interact with ESX programatically.
This is one of several VI3 SDK tips I'm offering on useful ways to leverage these tools to help make your everyday interaction with ESX/VI3 all the more seamless. In this tip, I give instructions on how to build a small program that can be used to modify the connection status of a guest's network interface card (NIC).
As I said above, many organizations' information security and/or networking departments implement security at a Layer-2 level. If they detect an infected machine on the network, they will shut off its port. That's fine and dandy when dealing with physical servers, but what about ESX? If a port is shut down then, it could potentially
shut off access for several virtual machines, not just the one that is misbehaving.
The solution is to produce a tool that can shut down the network interface of a specific VM. Follow along with me as I present code written in C# that does just that.
If you want to follow along in your integrated development environment
(IDE), the complete project is available for download on lostcreations.net in a Visual Studio 2005 project.
The following code builds on previous examples I have written about the SDK. I will begin my explanation of this program on line 106 of the file Program.cs, but explanations for how I parse the command-line options and how I connect to the VI3 SDK Web service are available in my three-part introduction to the VI3 SDK.
That's all there is to it! The program gnicmod.exe can be executed from the command line in order to alter the connection state of one,
or many, guest NICs. An example of its usage and output is as follows:
C:\gnicmod -s vcms.lostcreations.local -l -u akutz -p mypassword -m i:
192.168.0.111,p:connected,v:true,f:true -m i:
192.168.0.87,p:connected,v:false,f:false
+,192.168.0.111,connected,true
+,192.168.0.87,connected,false
If you have any questions about this program, or the VI3 SDK in general, feel free to contact me via editor@searchvmware.com.
Andrew Kutz is deeply embedded in the dark, dangerous world of virtualization. Andrew is an avid fan of .NET, open source, Terminal Services, coding and comics. He is a Microsoft Certified Solutions Developer (MCSD), a SANS/GIAC Certified Windows Security Administrator (GCWN) and a VMware Certified Professional (VCP) in VI3. Andrew graduated from the University of Texas at Austin with a BA in Ancient History and Classical Civilization and currently lives in Austin with his wife Mandy and their two puppies, Lucy and CJ.
