Networking configuration DMZ, Internal using Nexus 1000v

[logiboy123]

Hello peoples, this is my first post in the forums.

I'm currently building a design document for my client with the following configuration;

4 x ESXi hosts on DL380 G7's each with 12GB RAM, 2 x 6 Core X5650 CPU, 8 x 1GB NIC.

2 x LeftHand iSCSI SANS.

The hardware components and several design features I have no control over, they have been decided upon and I cannot change them, nor can I add extra equipment. The following are my constraints;

1) The solution will be using shared Cisco network switches for internal, external and iSCSI traffic.

2) The solution will use a single cluster with each of the four hosts inside this cluster.

3) I have to install and configure a Nexus 1000v into the environment (something I'm not keen on simply because I've never done it before). The client was sold on the concept of a cheap and shared equipment solution because they were told that using a N1Kv would solve all the security issues.

Before I found out I was going to have to use a N1Kv my solution looked like the following attached JPG. The solution used four distributed virtual switches and examples of how they were going to be configured are attached. All details and IP addresses are examples only.

My questions are:

1) What process should I use to setup the environment, should I build the dvSwtiches as described and then export them into the N1Kv?

2) How should I document up this solution? Typically in my design document I will have a section detailing each switch, how it is configured, vital details, port groups etc. However this all gets removed and replaced with uplink ports or something doesn't it?

3) Should I be aiming to use a different switch per dvSwitch, or can I trunk the whole lot and create different port groups, is this secure, is there a standard? Yes I have read the whitepapers regarding DMZ's and the Nexus 1000v.

4) Is my configuration secure and efficient? Are there ways to improve it?

Any other comments and suggestions are welcome.

[Texiwill · Accepted solution]

Hello and welcome to the forums,

1) What process should I use to setup the environment, should I build the dvSwtiches as described and then export them into the N1Kv?

N1KV replace dvSwitch, but there is only ONE N1KV where there are many dvSwitches so N1KV would use the same uplinks everywhere.

2) How should I document up this solution? Typically in my design document I will have a section detailing each switch, how it is configured, vital details, port groups etc. However this all gets removed and replaced with uplink ports or something doesn't it?

If you use N1KV you uplink from the pSwitch to the N1KV.

If you use dvSwitch/vSwitch you uplink from the pSwitches to the individual dvSwitch/vSwitch in use.

3) Should I be aiming to use a different switch per dvSwitch, or can I trunk the whole lot and create different port groups, is this secure, is there a standard? Yes I have read the whitepapers regarding DMZ's and the Nexus 1000v.

No standard, and yes in many cases it may be considered secure.... If your existing physical network relies on VLANs and trusts the Layer2 pSwitches then you can do the exact same thing in the virtual environment and be as secure as your physical environment.

However, if you require separation at the pSwitch layer then you need to maintain different vSwitches for that same separation. Take a look at this post http://www.virtualizationpractice.com/blog/?p=4284 on the subject.

4) Is my configuration secure and efficient? Are there ways to improve it?

Always ways to improve it. I would start looking into defense in depth at the vNIC and Edge layers within your vNetwork.

Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, 2010

Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security'[/url]

Also available 'VMWare ESX Server in the Enterprise'[/url]

Blogging: The Virtualization Practice[/url]|Blue Gears[/url]|TechTarget[/url]|Network World[/url]

Podcast: Virtualization Security Round Table Podcast[/url]|Twitter: Texiwll[/url]

[logiboy123]

Thank you very much for your help.