nerdexam
Broadcom-VMware

2V0-621 · Question #228

An administrator creates a custom ESXi firewall rule using an XML file, however the rules do not appear in the vSphere Web Client. Which action should the administrator take to correct the problem?

The correct answer is B. Load the new rules using esxcli network firewall refresh. After placing a custom firewall rule XML file in the correct directory, the administrator must run 'esxcli network firewall refresh' to load the new rules without restarting the firewall service.

Section 1 – Configure and Administer vSphere 6.x Security

Question

An administrator creates a custom ESXi firewall rule using an XML file, however the rules do not appear in the vSphere Web Client. Which action should the administrator take to correct the problem?

Options

  • ALoad the new rules using esxcli network firewall reload.
  • BLoad the new rules using esxcli network firewall refresh.
  • CVerify the entries in the XML file and then reboot the ESXi host.
  • DRemove the ESXi host from the inventory and add it back.

How the community answered

(41 responses)
  • A
    12% (5)
  • B
    78% (32)
  • C
    5% (2)
  • D
    5% (2)

Why each option

After placing a custom firewall rule XML file in the correct directory, the administrator must run 'esxcli network firewall refresh' to load the new rules without restarting the firewall service.

ALoad the new rules using esxcli network firewall reload.

'esxcli network firewall reload' unloads and reloads the entire firewall module rather than simply refreshing rule definitions from XML files, making it the incorrect command for this specific task.

BLoad the new rules using esxcli network firewall refresh.Correct

The 'esxcli network firewall refresh' command re-reads the firewall rule XML files from /etc/vmware/firewall/ and applies any new or updated rules to the running firewall configuration, making them visible in the vSphere Web Client without requiring a reboot or full firewall reload.

CVerify the entries in the XML file and then reboot the ESXi host.

Rebooting the ESXi host is unnecessary and disruptive - the refresh command is specifically designed to apply new XML-based rules to a live system without a reboot.

DRemove the ESXi host from the inventory and add it back.

Removing and re-adding the host from vCenter inventory is a drastic administrative action that has no effect on loading custom firewall rules defined in local XML files on the host.

Concept tested: ESXi custom firewall rule XML refresh

Source: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-6B749301-B4A0-4F9C-AA1D-C4A7B4A56D5B.html

Topics

#ESXi firewall#custom firewall rules#esxcli firewall refresh#XML rule configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 2V0-621 Practice