Or will I need to administer each firewall for each guest server OS?
Do I do both? Hardware firewall on host, software firewall on each server OS?
What is the best practice here?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Keep in mind that if you have more than one subnet in your network (which is quite usual even for small ones), your ESX(i) host will have a management IP on one of them, but your guest VMs will be spread across them depending on your needs; so, putting a firewall in front of the host's management connection will not defend the guest VMs.
This means your question actually makes sense only if you have a single network where both the host and the guests reside; in this case, it depends on your setup and needs; having a firewall on each machine gives you more flexibility, and having a global firewall in front of all of them gives you two layers of defense.
"Best Practice" is to have both an organizational firewall as well as host-based firewalls.
However, if you configure the hardware firewall correctly in front of the ESXi servers, it should do just fine for external protection without host(guest)-based firewalls. Your vulnerability in that instance will be server-to-server traffic being wide open.