Network Setup for vCenter , ESX, VMs, with VPN

[stanj]

Please bear with me on this as I am not very network savvy.

Our environment has recently changed in that we have relocated our virtual infrastructure to a new location. We will be configuring vCenter 4.0 in a domain that we are not domain administrators. The reason for connecting to this domain is it is the only way we can get access to our virtual infrastructure via a VPN connection. We may be able to be assigned as an administrator, but that is not clear.

I was wondering if there is a way to have the below virtual configuration configured that would allow access to the infrastructure.

Note that we have a vSphere 4 Standard license.

VCenter Server 4.0 installed in a domain on 128.244.x.x.

The ESX 4.0 Servers are configured in a different network with the ip addresses of – 192.168.x.x.

Some of the VMs are in a 10.10.x.x network with their own VM as a domain.

In order to connect externally to the virtual infrastructure, we must use a VPN connection to 128.244.

We do have routers that are in place but I am not sure of the configuration – NAT, VLAN, etc.

Basically, we need to connect to vCenter via VPN and access the VMs that currently are on ESX Servers at 192.168.x.x.

An option may be to reconfigure the ESX Servers and put them on 128.244.x.x. but we would like to have them kept on our 192.168.x.x if possible.

Any ideas on this?

Thanks

[Texiwill]

Hello,

Moved to the Security forum..... I think I see what you want to do:

VPN <-> vCenter (128.x) <-> Router <-> ESX (192.x)

This is not what I would do actually. Instead I would recommend you do the following:

VPN <-> JumpMachine <-> Firewall <-> ESX SC + vCenter + vSphere CLient VM or physical host.

This way your ESX SC and vCenter stay protected.... Your Jump Machine could be any type of windows and you would VPN to that, then use RDP to access the vSphere Client VM or physical host though a firewall.

The JUmpMachine would then also be able to access VMs at need.

Many people feel that vCenter can act as a management gateway but in reality it should not, that just leads to other insecurities. The suggested setup may actually be the easiest to do as setting up a VM or another machine within the 128.x network will be slightly easier than moving vCenter, etc.


Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009

Virtualization Practice Analyst[/url]
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security'[/url]
Also available 'VMWare ESX Server in the Enterprise'[/url]
[url=http://www.astroarch.com/wiki/index.php/Blog_Roll]SearchVMware Pro[/url]|Blue Gears[/url]|Top Virtualization Security Links[/url]|
[url=http://www.astroarch.com/wiki/index.php/Virtualization_Security_Round_Table_Podcast]Virtualization Security Round Table Podcast[/url]

[stanj]

Hi.

thanks

What and where is the jump machine located?

Can you provide or know of any screen images that you know of that can show this in a pictorial fashion?

thanks again

[Texiwill]

Hello,

What and where is the jump machine located?

The JumpMachine is just an end point for the VPN. In your initial post you made vCenter the endpoint for the VPN. Instead I moved vCenter back behind the firewall and put in another machine as that endpoint. The machine could be physical or virtual. You would launch your VPN and then RDP to the 'Jump Machine' if it was windows. From there you would RDP into the protected area.

Can you provide or know of any screen images that you know of that can show this in a pictorial fashion?

I will have to work on that. Private Message me and we can discuss offline.

Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009

Virtualization Practice Analyst[/url]
Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security'[/url]
Also available 'VMWare ESX Server in the Enterprise'[/url]
[url=http://www.astroarch.com/wiki/index.php/Blog_Roll]SearchVMware Pro[/url]|Blue Gears[/url]|Top Virtualization Security Links[/url]|
[url=http://www.astroarch.com/wiki/index.php/Virtualization_Security_Round_Table_Podcast]Virtualization Security Round Table Podcast[/url]