Hey,
Can someone point me towards some documentation about the security of network spanning for ESX hosts? Here's an outline of the situation I'm in .
We've got 12 servers in an ESX cluster.
4 servers run VMs which need internet access. These have a physical connection to a network with this access (Network A) as well as a different physical connection and a Service Console IP address on another subnet containing the vCenter server (Network B). VMs get access only to the network with internet access.
8 servers run VMs which cannot have access to the internet. They have a physical connection to a network with no internet access (Network C), but with a firewall rule which allows the vSphere client to connect to the vCenter server. They also have a physical connection & Service Console IP on the subnet which houses the vCenter server.
To access vCenter you need to use a Remote KVM client to connect to a physical server on Network C and then connect to the vCenter server using the vSphere client. Problem is that this is really really slow - we don't have admin access on the firewall and I think it's dropping lots of connections.
I'd like to put all of the servers spanning the same network segments. I.e. Each server would be physically cabled to Network A and C, and the vCenter server and ESX host IPs would be on Network A - this would eliminate problems with host updating and with speed of access to vCenter. I'd completely remove access to Network B as it's not controlled by us. The VMs themselves would then be set to access either Network A or Network C as they individually need.
To get this kind of change approved though I need to show that it's okay to have an ESX host sitting on two networks and that a VM cannot access a physical network unless it's put in a port group which has access to the network. Any ideas on where I can get a whitepaper or technical spec which confirms this?
Cheers!
