Using virtual firewall in productive system

[MIAMI_deVICE]

Hi!

Today I had a small fight with our firewall admin, because I wanted to install our Astaro Firewall as a virtual Machine on our ESX Host as a productive Firewall.

He thinks it is not secure enough.

Now I need some arguments / official statements from VMware or customers who are also using a virtual firewall on a productive system.

Greets

Jens

[admin]

What is his argument?

He will let you install it on a physical Server but not a Virtual Server?

Heck it looks like they ship it in a VM if you want.

http://www.softek.co.uk/prod/as/astaro_vmware.asp

http://www.softek.co.uk/prod/as/astaro_download.asp

Astaro Security Gateway for VMware

Want to try Astaro right now? You can with the pre-configured Astaro for VMware image.

The Astaro Security Gateway for VMware virtual appliance is functionally identical to the physical appliances.

The major difference is that instead of being built on a physical computing device, a virtual appliance is built using virtual machine technology and can be run on VMware Player, VMware Workstation, VMware Server, or VMware ESX Server.

Major benefits for users include simpler deployment in large and complex environments, better hardware allocation and reduced hardware expenditures because physical computers can run multiple virtual appliances. And because Astaro’s unified threat management is ASIC-free, performance when running in a virtual machine is maximized.

To quickly understand the nine integrated security applications in Astaro Security Gateway for VMware, customers are encouraged to use the free VMware Player with Astaro Security Gateway for VMware.

\*VMware version Note* There are several versions of the Astaro VMware image available to download - select the one which is appropriate for you. For example if you currently run / use "VMware ESX Server" on your internal network choose the ESXv2 or ESXv3 versions of Astaro, OR if you plan on using the free VMware player listed above, then select the non-ESX file.

[Dave_Mishchenko · Accepted solution]

I'm using 3 Astaro firewalls in such a configuration and I'm more concerned with someone comprimising the firewall itself than ESX to get onto the internal network.

Here's a thread that discusses the concern:

http://www.vmware.com/community/thread.jspa?messageID=592012

A few PDFs that discuss this type of deployment:

http://www.vmware.com/pdf/esx2_security.pdf

http://download3.vmware.com/vmworld/2006/dvt0026.pdf

[dbis]

Jens,

Depending on your deployment, there might be another argument against deploying it as a VM.

Firewalls build up and tear down lots of sessions, this is a big overhead for ESX.

If you are using the software to protect just a few servers this should not be a big problem. Due to the overhead most of the time firewalls and proxies do not make sense to consolidate.

Daniel