Here's my network topology:

enter image description here

WHAT I WANT OT ACHIEVE: access virtual machines from remote network, be able to manage them through vCenter Server, run them, and see vms consoles (what's happening inside every vm, as I can see this in my local network).

WHAT I HAVE SO FAR: at the moment Im able to successfully connect from my computer in the remote network to vCenter Server, which is a virtual machine on one of my ESXi hosts. vCenter Server is the VM on ESXi 1, its IP address is

WHAT I DID: I forwarded some ports on my JSRX router, forwarded to, used this:

edit security
set zones security-zone trust address-book address accessvsphere

edit security policies from-zone untrust to-zone trust
set policy vspherepolicy match source-address any destination-address [ accessvsphere ] application any
set policy vspherepolicy then permit

edit security nat destination
set pool dst-nat-pool-vsphere address port 443
set rule-set rs1 from zone untrust
set rule-set rs1 rule myrule1 match destination-address
set rule-set rs1 rule myrule1 match destination-port 443
set rule-set rs1 rule myrule1 then destination-nat pool dst-nat-pool-vsphere

edit security nat
set proxy-arp interface ge-0/0/0.0 address

And it works great, I can connect to vCenter Server, but then I try to launch virtual machine, I see only black screen and the message: Unable to connect to the MKS: Failed to connect to server

I read that vCenter Server need also port 902 and 903 for full connectivity but have no idea how to do this further. Which ports I need to forward, and - how?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 10 '17 at 3:29

You cannot do this through NAT. When you connect to the VM console, the traffic goes to the server running the VM, not vCenter. And it's going to get the "inside" address relative to vCenter, not the "outside" address you need.

  • So what do I need to be able to make such connection? I dont need to forward ports 902 and 903 on my JSRX? Im very new to networking, thanks for help :)
    – mirx
    Mar 25 '14 at 19:56
  • What he is saying is that this would be very difficult to setup as you have a NAT rule to point inbound traffic to the vCenter server but the Console connections come from the host itself. Currently the outbound console traffic is not being routed and translated to your remote machine which results in the MKS error and the connection timing out. Attempting to setup NAT rules for this would be difficult and most likely result in more problems than it solves. I would highly recommend a VPN connection to accomplish this as other options open up more security holes in your firewall. Mar 25 '14 at 21:01
  • @Mike, more than that... It. Cannot. Be. Done. vCenter is going to provide the local address of the esx server, which is NOT the address to which he needs to connect. This is communicated through an SSL connection were it cannot be rewritten. The only solution is to be in the LAN (directly, vpn, or using global addresses) with the servers.
    – Ricky
    Mar 25 '14 at 22:05
  • @RickyBeam: Ok thanks guyz but I need a little more help with this :) I understand that I need to setup VPN client on the computer in the remote network (lets say, its VPN IP: and VPN server on the same virtual machine where I have my vCenter Server istalled? (lets say, And when I setup such connection should I do a port forwarding, -> Will it be enough for this to work as I want?
    – mirx
    Mar 26 '14 at 7:47
  • @MikeNaylor: just another noob question: I know that its possible to setup VPN on JSRX - never done this before but will this be good for my needs? Found this art: juniper.net/techpubs/en_US/junos12.1x44/topics/example/…
    – mirx
    Mar 26 '14 at 8:26

You can use a web client to do this. NAT you'r public IP address to VCenter web client's IP address and connect to web client using web browser. Add Vcenter Host name to your 'host' file with public IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.