Hello,
Whether or not to allow the SC/vMotion pair together depends entirely on the trust relationship set out by either the security policy, security administrator, or management of a company/institution. If you trust everyone then it really makes no difference, if you trust no one then it would. This is repeating statements made previously.
Trust is the key element here, as the vMotion data is unencrypted and can contain credential information. I err on the side of being more secure than less in other words I state do not trust. I rather not have any vMotion data sniffable by ANYTHING regardless of location. The only things on my vMotion network are ESX Servers vMotion portgroups and nothing else. I do not overlap SC/vMotion on the same vSwitch because of this as well.
The following questions should all be considered before putting the SC on with any other network actually, vMotion is just one of the more dangerous to access, but any network can have the same issues. The only exception to this rule is imposed by VMware themselves, and that is iSCSI authentication, an SC vswif must participate in this network. So you implicit trust your Administrators with the iSCSI authentication due to this. I rather not but hey, its a current software limitation.
I feel this increases the risk as major changes to virtual networking will be easily recognized as such (moving vMotion to another portgroup for example), but minor changes will not be (enabling Promiscuous mode on the SC or a VM Network portgroup.) By easily recognized as such, you can see almost immediately that something changed when looking at the network configuration screens in the VIC or by using the command line. But subtle changes require deeper review and could be missed easily. That is why I think the risk is elevated. But how much so depends on the Trust Relationships that exist within the organization.
1) Should an ESX administrator be able to access any running VM? If yes then go ahead and combine.
2) Does the ESX administrator have the necessary roles/permissions/classification/privileges within the organization to access a running VM? If yes then go ahead and combine.
3) Does the security policy allow this?
4) Do you trust your ESX administrators? If yes, go ahead and combine.
5) Is there auditing/monitoring for promiscuous mode virtual machines? If yes, go ahead and combine.
6) Do you trust your firewalls? If yes, go ahead and combine.
7) Do you trust your defense in depth? If yes, go ahead and combine.
If you answer no to any of the above then I would not combine my SC with any network (except iSCSI if iSCSI is in use, even so I would have non-authentication iSCSI traffic use its own vmkernel device). Now talking about vMotion and other networks gets the same questions, but I use 'Users' instead of ESX Administrators in these questions.
Only the Security Administrators know the trust relationships, I would talk to them before implementing anything within the virtual network. But if ESX Administrators do not know of the possibility they could think they are safe when they are not. Nor do they know what to look for when reviewing the systems for issues.
In the realm of 'Risk Assessment' is this a very high risk item.... Not as much as it used to be, and the risk is related to the Trust Relationships that are in play. But while this may not be even a low risk in one organization it could be a very high risk in another. This is one of those items that is really dependent on the organization.
Best regards,
Edward L. Haletky
VMware Communities User Moderator
====
Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education. As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization
--
Edward L. Haletky
vExpert XIV: 2009-2023,
VMTN Community Moderator
vSphere Upgrade Saga: https://www.astroarch.com/blogs
GitHub Repo: https://github.com/Texiwill
