Hello,

Assuming all your VMs on the vSwitches are single homed then there is no way within the virtual world for this to happen, however, standard networking does apply here, if you have a bridge, router, gateway between the DMZ and intranet then that does offer a possibility, If you have multihomed VMs, then you also have a mechanism for this.

Outside of standard Networking issues, there is nothing within the Virtual world that would allow a 'jump'

Best regards,
Edward L. Haletky, author of the forthcoming 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', publishing January 2008, (c) 2008 Pearson Education. Available on Rough Cuts at http://safari.informit.com/9780132302074

Hello,

If you can set your vNIC to promiscuous mode then anything is possible on the vSwitch (this is why this is disallowed by default). If you can do VLAN jumping on the physical switch then there is nothing you can do on the virtual switch to prevent that. I have not tested if VLAN jumping is possible on the vSwitch but I do not know anything that precludes that.

Your use of separate hardware devices is the safest approach when trying to split out traffic, this forces the use of separate vSwitches and even if you could do VLAN Jumping you can not jump from vSwitch to vSwitch. I only use VLANs in a low port density situations for critical services (SC, vMotion, DMZ, Production, Storage) as I prefer the physical separation. The other option for using VLANs is when I have more than one network for those major categories of networks.

Best regards,
Edward L. Haletky, author of the forthcoming 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', publishing January 2008, (c) 2008 Pearson Education. Available on Rough Cuts at http://safari.informit.com/9780132302074

Hello,

Interesting read. It does explain a few things, and would you not have to expose the FC-HBA to the VM or something to get an N-Port Virtualization? Which does not currently happen...

Best regards,
Edward L. Haletky, author of the forthcoming 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', publishing January 2008, (c) 2008 Pearson Education. Available on Rough Cuts at http://safari.informit.com/9780132302074

Hello,

It is invisible to the VM in normal circumstances, however perhaps with an RDM some of the FC floats up to the VM? I have not investigated that and would like more commentary from VMware on the subject.

Best regards,
Edward L. Haletky, author of the forthcoming 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', publishing January 2008, (c) 2008 Pearson Education. Available on Rough Cuts at http://safari.informit.com/9780132302074

Hello,

Not always you need to create them yourself.


Yes you created three vSwitches.


Yes they are separate from each other in the vSwitch layer but from a network perspective they may not be, that depends on if you bridge between the vSwitches somewhere with a multihomed VM, bridge, router, gateway, etc. Or if the physical side has some bridging.

Note this vSwitches also have no redundancy.

Best regards,
Edward L. Haletky, author of the forthcoming 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', publishing January 2008, (c) 2008 Pearson Education. Available on Rough Cuts at http://safari.informit.com/9780132302074