vSphere in the DMZ Question

[timcwhite]

Good morning,

We are in the process of implementing vSphere 4 in our DMZ and I wanted to run a question by you regarding the design. Currently, we are running our Virtual Center server within our Core network. The new vSphere servers will reside within our DMZ but will need to be managed by the internal Virtual Center server. Below are the following scenarios that we are considering.

Scenario I:

Open the following ports:

• Port 22 and 902 between our VC and ESX hosts

• Port 903 between our VI client and Virtual Machines for remote console

• Port 27000 and 27010 between our vSphere hosts and license server (this is also our virtual center server)

• Port 443 for inbound HTTPS connections

Scenario II

Don't open any ports and connect the service console and the Vkernel network to our core network.

Has anyone implemented either? What is your opinion/suggestions regarding either scenario?

[weinstein5]

I have seen both scenarios implemented with success - my preference is scenario two in that it keeps the communication between the DMZ and the core network shutdown and there are no worries about a vm jumping to the service console since the VMs run isolated from the service console -

If you find this or any other answer useful please consider awarding points by marking the answer correct or helpful

[MKguy]

I'm more fond of Scenario II, and we run a Cluster hosting DMZ VMs like that too.

However, that internal network is a dedicated subnet for ESX and vCenter and is being protected by a firewall with a tight ruleset. As long as you keep that in mind and regularly patch your ESX hosts (and VMware tools if there is a vulnerability discovered), you should be fine.

[azn2kew]

I would concur with David using scenario 2 is much secure and it should work perfectly. I've done that with ESX 3.5U4 environment because you don't want to give people "the key to the kingdom" is like inviting people to sneak at your house for stealing. Here's a new guide from VMware DMZ you can read for details

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

Regards,

Stefan Nguyen

VMware vExpert 2009

iGeek Systems Inc.

VMware, Citrix, Microsoft Consultant

[jayctd]

We also implement scenario 2. Keeping the VMkernal and service console protected in an infrastructure management network only.

Jered Rassier

*EqualLogic Technical certified professional

*Dell Enterprise Foundations v.2 Certified professional

##If you have found my post has answered your question or helpful please mark it as such##

[timcwhite]

Thanks for all of your help.

I've have been reading various articles regarding ESX in the DMZ. One of the pdf's that read from VMware suggested that we place the service console nic on our internal network and place the Vkernel nic and VM nic within the DMZ. Any thought on that?

[Texiwill]

Hello,

I've have been reading various articles regarding ESX in the DMZ. One of the pdf's that read from VMware suggested that we place the service console nic on our internal network and place the Vkernel nic and VM nic within the DMZ. Any thought on that?

Bad IDEA.

SC/VMotion/vmkernel ports need to be protected OUTSIDE your DMZ. DMZ should ONLY be for the pNICS attached to the vSwitch used exclusively for DMZ based VMs.

vmkernel should never be in the DMZ.

OUtside<->FW<->pNIC-DMZ<->vSwitch<->DMZ VMs

Inside<->FW<->Management Network<->pNIC-SC<->vSwitch<->SC

On the management network would exist VC, and other ESX management tools.
vmkernel for VMOTION is 100% private
vmkernel for iSCSI/NFS links ONLY to iSCSI/NFS network

There is quite a bit written on this available.

vmkernel within the DMZ leaves the vmkernel open to attack for possible memory or disk information, the type hackers love to get.


Best regards,

Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, Virtualization Practice Analyst[/url]
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment'[/url]
Also available 'VMWare ESX Server in the Enterprise'[/url]
[url=http://www.astroarch.com/wiki/index.php/Blog_Roll]SearchVMware Pro[/url]|Blue Gears[/url]|Top Virtualization Security Links[/url]|Virtualization Security Round Table Podcast[/url]

[azn2kew]

As mentioned, you wouldn't want anything to expose to DMZ, only present VLAN ID for DMZ networks and connected to physical NIC and DMZ port group on vSwitch. The rest should be protected with VLAN and firewalls since VMotion, NFS, iSCSI is not encrypted only use clear text which allow someone on the same network can capture the memory state and retrieve valuable credentials/info. Always place SC in a management network with secure VLAN/firewall and same to Out of Band Networks such as HP iLo, DRAC, IBM Directors.

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

Regards,

Stefan Nguyen

VMware vExpert 2009

iGeek Systems Inc.

VMware, Citrix, Microsoft Consultant

[Texiwill]

Hello,

Protected by VLAN? Please. There is no such thing. You use VLANs only if you 'TRUST' VLANs, they are not in themselves a protection mechanism. THe protection mechanism would be ACLs and Port security to ensure that only the proper machines could connect, mac flooding is controlled, etc.

In general, DMZ's are implemented using segregated physical switches for JUST VM traffic. Your Vitualization Networks (iSCSI, NFS, Management, VMotion, etc.) should not be seen by anything within the DMZ.

Best regards,

Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, Virtualization Practice Analyst[/url]
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment'[/url]
Also available 'VMWare ESX Server in the Enterprise'[/url]
[url=http://www.astroarch.com/wiki/index.php/Blog_Roll]SearchVMware Pro[/url]|Blue Gears[/url]|Top Virtualization Security Links[/url]|Virtualization Security Round Table Podcast[/url]