Security

Ask something
Discussion Locked

Intermixing Inside/DMZ Segiments on single VMWare ESX Server box

0 helpful
2 replies

by michael_pasternak 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Our network manager had recently posed a question about the possibility of using a single VMWare ESX machine with multiple NICs attached to the Inside and DMZ networks. These NICs are supposedly to remain isolated thru the "virtual switch." My initial personal feeling is that the segments of the network should remain physically as well as logically separate. My question to you is what would you do in this situation? Would you allow this into your infrastructure and what precautions would you take to minimize exposure? Any feedback on this would be greatly appreciated!

Thanks!

-Mike

2 replies

by bfilmfan

I wouldn't recommend using that arrangement as that system then becomes a security risk having exposure to the DMZ.

by mixalis

VMware suggests(http://www.vmware.com/pdf/esx_lun_security.pdf):

The only storage
available to virtual machines is SCSI devices. Put another way, a virtual machine does not have
virtual Fibre Channel HBAs, but only has virtual SCSI adapters. Each virtual machine is able to see
only the virtual disks that are presented to it on its virtual SCSI adapters.
This isolation is complete, with regard to both security and performance. A VMware virtual
machine has no visibility into the WWN, the physical Fibre Channel HBAs, or even the target ID
or other information about the LUNs upon which its virtual disks reside. The virtual machine is
isolated to such a degree that software executing in the virtual machine cannot even detect
that it is running on a SAN fabric. Even multipathing is handled in a way that is transparent to a
virtual machine.

http://www.vmware.com/community/thread.jspa?forumID=21&threadID=19402&messageID=222399#222399

http://www.vmware.com/news/releases/nsa_pr.html

This discussion is closed to new replies.