Running a firewall on ESX

[Gabrie1]

Hi

For my current customer we are virtualizing about 600 fysical machines. They have quite a number of ISA servers. Some crossing DMZ and LAN, some only serving multiple DMZ's. Now the basic rule was that ISA / firewalls will not be virtualized because they connect two different networks. But since there seem to be so many of them, I could afford a seperate cluster of ESX hosts to only run firewalls on. When talking about this with the security guys they ofcourse go nuts, but that is no problem Problem is how do I convince them with the right arguments to virtualize a firewall.

My opinion:

- Mostly the network admins tell me to never connect two networks together without a firewall. Well, in my opinion the firewall is still the only thing connecting the two networks. Even misconfiguring a virtual switch can not make a connection / bridge between two networks.

- ESX Virtual Switches are secure. What I've been told is that they only contain layer2 switching software. No code to do routing in whatever way.

What do you think?

Gabrie

[weinstein5]

I have not heard of issues virtualizing firewalls - it all depnds on the clients comfort level with ESX - and yes you are correct the virtual swtches are layer to devices and there is no routing informaiotn passed -

[adolopo]

I've run into the same issue in the past, and even after explaining the concepts of (ESX) networking, I've always had to concede. In the end I think it comes down to the simple fact that some people (security especially) don't understand the phrase "Because it doesn't work like that...."

[weinstein5]

also it is my experience with security folk if they can not touch it - it won't work -

[Gabrie1]

hehehehe yeah that sounds familiair !!

[Texiwill]

Hello,

I would call in VMware or someone from the Virtualization Security field to explain that ESX is not just a black box and that it contains a multitude of networks and that you will need some virtual firewalls to connect them. The old world of looking at a Virtualization server as just an endpoint of networks is not correct and the Security folks who base their decisions on that will end up spending more money and lead to insecure virtualization implementations. I would recommend that they get some training in this area before they cost the company either more funds than necessary or serious information leakage.

Check out My Latest CIO Blog for some commentary on this.

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education. CIO Virtualization Blog: http://www.cio.com/blog/index/topic/168354, As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization

[Gabrie1]

Hi

I read your blog today, but it doesn't clearly proof that ESX is secure enough. I know and you know how secure it is, but which docu is there to proof it?

Gabrie

[Texiwill]

Hello,

I see what you are after.... There are documents discussing the vSwitch and its security. There are documents on the vmkernel and its security. These are on the VMware Document site. But unless your Security Administrator is willing to read them. do the necessary excersize to consider security, and willing to learn about Virtualization, then they not doing their jobs as far as I am concerned. Yes harsh terms, but virtualization is MORE than just a black box, it contains networks, and isolation capabilities. This is the biggest up hill battle and the answer is to me, that if the Security 'folks' are not willing to learn then do not implement virtualization because they will just force a design of something incredibly INSECURE from their lack of knowledge. Their lack of knowledge will end up costing the company in terms of liability.

Put it in dollars and cents. How much liability do they want to have? FOr example, in the place the SC in the DMZ issue that pops up quite a lot. How much is the data on the ESX server worth to them when it gets out into the wild? Actually, if they forced me to put the SC within the DMZ, I would refuse to do the implementation and tell them that if they want it, they do it as that is as insecure as you can possibly get. And I would put it in writing. Explain it like this.... "Do you put the door to your Data Center off your lobby? Well that is just what they want to do with another Data Center."

As for your original question, I have a Firewall with a DMZ behind it running within ESX. I have my Orange (DMZ) Network which has its open ports for standard FTP, WEB, etc.... I also have my Green Network... The only link between the two is the firewall. THere is no way to bypass it unless I purposefully add more vNIC to a VM on one of the networks. But the only bridge is a VERY strong firewall. Just like normal. This basic networking 101 and has really nothing to do with virtualization.

So the rule for my system is, unless the VM is a Router, Gateway, Firewall there should only be one vNIC per VM. I would not even consider adding a backup vNIC as backing up the full VMDK is better.

But as I stated, I think you need to pull in someone who can explain it to them either from VMware or elsewhere, and that may fail if they still consider Virtualization to be just a box that has to be protected by traditional means. In this case, they have already shot themselves in the foot.

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education. CIO Virtualization Blog: http://www.cio.com/blog/index/topic/168354, As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization