vSphere Integrated Containers notes about firewall

vsphere_vic_firewall_notes.txt

vSphere Integrated Containers

* requires that firewall on esxi hosts are updated with the following firewall rule, 
otherwise the containerhosts (vch) cannot communicate properly with the vic host

 <!-- vSphere Integrated Containers Engine to allow outbound 2377/cp -->
  <service id='0044'>
    <id>vic-engine</id>
    <rule id='0000'>
      <direction>outbound</direction>
      <protocol>tcp</protocol>
      <porttype>dst</porttype>
      <port>
        <begin>2377</begin>
        <end>2377</end>
      </port>
    </rule>
    <enabled>false</enabled>
    <required>false</required>
  </service>


1. ssh to exsi host
2. cd /etc/vmware/firewall
3. chmod a+w services.xml
4. chmod a+t services.xml
5. vi services.xml
6. scroll to end of file and paste in the above snippet, just above </ConfigRoot>
7. <service id='0044'> - should be changed to <service id='next number'> i.e. look at the previous service's id and add one to that number
8. ESC :wq (to save and quit)
9. chmod 444 services.xml
10. esxcli network firewall refresh

Now your container hosts should be able to communicate properly with the VIC host