Managing the ESXi SSH Server Firewall Exception Across Hosts with PowerCLI

Cosmin Trif — Thu, 21 Mar 2024 18:06:14 +0000

VMware PowerCLI can manage the firewall exceptions on ESXi hosts through vCenter Server. The commands in this guide change the SSH Server firewall exception on ESXi; they do not configure the firewall of the vCenter Server Appliance (VCSA).

Enabling this exception permits inbound SSH traffic through an ESXi host’s firewall. It does not start the SSH service. Opening SSH on many hosts also increases the management-plane attack surface, so target only the hosts that require access and disable the exception as soon as the work is complete.

The cmdlets used below are documented in the Broadcom PowerCLI reference for Get-VMHostFirewallException and Set-VMHostFirewallException.

Prerequisites

VMware PowerCLI installed on the administration workstation.
A vCenter Server account authorized to read ESXi hosts and modify their firewall configuration.
An explicit list of the ESXi hosts that require the change.
Network controls that restrict TCP 22 to approved administration sources.

Install PowerCLI for the current user if it is not already available:

Install-Module -Name VMware.PowerCLI -Scope CurrentUser

Inspect the Current State

Use Get-Credential instead of embedding a password in the script, connect to vCenter Server, and retrieve the exception from a specific ESXi host:

$credential = Get-Credential
$viConnection = Connect-VIServer -Server 'vcsa01.example.com' -Credential $credential
$vmHost = Get-VMHost -Server $viConnection -Name 'esxi01.example.com'

Get-VMHostFirewallException -VMHost $vmHost -Name 'SSH Server' |
 Select-Object VMHost, Name, Enabled

Review the returned host name before making a change. Avoid an unfiltered Get-VMHost when only a subset of hosts needs SSH access.

Enable the Exception on Selected Hosts

The following example enables the exception only on the named hosts:

$targetHostNames = @(
 'esxi01.example.com',
 'esxi02.example.com'
)

$targetHosts = foreach ($targetHostName in $targetHostNames) {
 Get-VMHost -Server $viConnection -Name $targetHostName -ErrorAction Stop
}

$sshExceptions = Get-VMHostFirewallException `
 -VMHost $targetHosts `
 -Name 'SSH Server' `
 -ErrorAction Stop

$sshExceptions |
 Select-Object VMHost, Name, Enabled

$sshExceptions |
 Set-VMHostFirewallException -Enabled $true

Enabling the firewall exception does not start the ESXi SSH daemon. Start that service separately only when it is required by the approved task, and stop it afterward in accordance with your access policy.

Disable the Exception After Use

Reuse the same explicitly scoped $targetHosts collection to close the exception:

Get-VMHostFirewallException `
 -VMHost $targetHosts `
 -Name 'SSH Server' `
 -ErrorAction Stop |
 Set-VMHostFirewallException -Enabled $false

Get-VMHostFirewallException -VMHost $targetHosts -Name 'SSH Server' |
 Select-Object VMHost, Name, Enabled

Disconnect-VIServer -Server $viConnection -Confirm:$false

The final query should report Enabled as False for every targeted host.

Apply the Change Across Multiple vCenter Servers

For multiple vCenter Servers, map each vCenter to its intended ESXi hosts. This keeps the scope visible and avoids changing every host in every connected inventory.

$credential = Get-Credential

$targetsByVCenter = [ordered]@{
 'vcsa01.example.com' = @(
 'esxi01.example.com',
 'esxi02.example.com'
 )
 'vcsa02.example.com' = @(
 'esxi11.example.com'
 )
}

foreach ($entry in $targetsByVCenter.GetEnumerator()) {
 $viConnection = $null

 try {
 $viConnection = Connect-VIServer `
 -Server $entry.Key `
 -Credential $credential `
 -ErrorAction Stop

 $targetHosts = foreach ($targetHostName in $entry.Value) {
 Get-VMHost `
 -Server $viConnection `
 -Name $targetHostName `
 -ErrorAction Stop
 }

 $sshExceptions = Get-VMHostFirewallException `
 -VMHost $targetHosts `
 -Name 'SSH Server' `
 -ErrorAction Stop

 $sshExceptions |
 Select-Object VMHost, Name, Enabled

 $sshExceptions |
 Set-VMHostFirewallException -Enabled $true
 }
 finally {
 if ($null -ne $viConnection) {
 Disconnect-VIServer `
 -Server $viConnection `
 -Confirm:$false
 }
 }
}

After the administrative task, run the same scoped workflow with -Enabled $false, then verify the returned state. If this is scheduled, use a managed secret or non-interactive credential mechanism rather than storing a password in the script or task definition.

Summary

This workflow manages the ESXi SSH Server firewall exception through vCenter Server. It does not modify the VCSA firewall. Keep the host list explicit, confirm the selected objects before making a change, restrict SSH at upstream firewalls, and return both the SSH service and its ESXi firewall exception to their disabled state after use.