ESX VI3 Host with Nics on both Internal and DMZ Networks

[robertc65]

We have a large VMware Infrastructure now V2.53 and are planning an upgrade to VI3 in the near future. Currently we have two Hosts dedicated for VMs running in our DMZ to host public facing websites. Since we only have 20 VMs total running on these Hosts they are significantly under utilized. We have also thought it to be a bad idea to host both internal and external VMs on the same host from a security stand point. With VI3 is it still not a good idea to mix internal and external VMs on the same host?

Thanks

Rob

[sbeaver]

I have it running this way and have no issues. I have a seperate nic and vSwitch for the DMZ and as long as you make sure that the VM's do not have a nic in prod and DMZ you will be fine

[Texiwill]

Hello,

The mixing of internal/external hosts truly depends on how your networking is setup.

A vSwitch can not communicate with another vSwitch unless there is a link between them either through a VM on both vSwitches or something external like a patch cable. Within a vSwitch the same holds true for a port gorup.

If you have very few NIC ports say 4. Then I would not mix them as your VM Network NICs are using 2 of those ports, vMotion for another, and the SC for the 4th. If you add more NIC ports say 2, then you can add anothe network to the ESX server and you can mix them easily.

At this point it really is a networking question. Never, ever place the SC ports or vMotion in your DMZ however. Those have major security concerns.

Best regards,

Edward

[michael_40catbi]

This thread http://www.vmware.com/community/thread.jspa?threadID=96550 indicates that there may be cause for concern with this architecture.

If VI3 can be broken into, then this architecture creates a bridge between your DMZ and your internal network.

Even if there was no evidence of exploits against VI3, I'd say that it all depends on your paranoia level and the strength of your belief in Murphy's Law.

For myself, I am a strong believer in Murphy and the essentially flawed nature of any complex piece of software. I would never choose to configure VI3 this way. If you can't avoid it, then I strongly recommend you look at improving your secondary controls (firewall, IPS ...) to detect and prevent an exploit of VI3 from a complete breakout into your internal network.

Michael

[Texiwill]

Hello,

If VI3 can be broken into.... That is a big if, if there is no way to reach the SC and there is isolation between the guests and host. Any ESX Server that has VMs in the DMZ should enable all possible security in the vSwitches and portgroups. The SC ports should never be in the DMZ. If everything is locked down there is minimized risk. No VM in the DMZ should be on the SC portgroup or even vSwitch.

However, you need to audit/monitor any host in the DMZ.

The real question is can code in a Guest run arbitrary code within the SC with elevated privileges or any privileges. And so far that answer is no.

Granted not everyone does secure everything six ways to sunday. Also, your corporate security policy may not even allow ESX in the DMZ... Most do not allow multihomed systems inside a DMZ and by its very nature ESX is multihomed.

BTW, the 'thread' points back to itself. Not sure where you wanted to go.

Best regards,

Edward

Message was edited by:

Texiwill

Message was edited by:

Texiwill

[sbeaver]

And alot of times it is the mighty dollar that has the loudest voice

[robertc65]

Thank you for the responses. This was my understanding, however I'm wondering if VMware suggests not doing so. I need to CYA.

Thanks

Rob

[Texiwill]

Hello,

The only thing I have read is that VMware does not recommend placing the SC in the DMZ. Not much else unless someone has a better document.

There is coming out a book that covers ESX security in quite a lot of detail....

Best regards,

Edward