What is the Correct Network Design?

Hi kumarnirmal

I think I have the network structured correcly, diagram attached;

You indicate in your reply that the SBS and VMware ESXi Server need not be in the same Domain but surley this cant just be a random choice.

In my particular case should the Domain be the same or different, what is the concequence of going either way?

Regards
William

The Internal SBS Server should have an uplink connected to the vSwitch since u cannot connect to the SBS Server if you do not map it to a vSwitch as indicated in the attachment.

Just like how your vSwithc1 is connected to vmnic1, vSwitch3 should be connected to a vmnic or physical NIC if you intend to have SBS Connectivity to physical network.

Hi kumarnirmal

The SBS Server uses the Gateway Server on its segment of the Lan to reach the External network. In reverse all traffic arriving on the Virtual network has to go through the Gateway Server to reach either the Internal or DMZ segments. Is this not best practice?

That aside my question remains, In my particular case should the Domain on the VMWare be the same or different as the Domain on the SBS Server, and what is the consequence of going either way?

Regards
William

Sorry as I completely missed the Gateway Server 1 in picture.This is a good security practice.

The SBS Domain would be an Active Directory Domain.
Keeping the ESX Server in the same domain would cause no harm.

By the way are you using VIrtualCenter Server in your environment to manage ESX Hosts ?

You would have to put a DNS Host entry in the Windows / Linux DNS Server in your environment.

Hi kumarnirmal

As we are only a small business we are using VMWare Infrastructure Client to Manage the ESXi Hosts.

Our Gateway (Linux) is set up to get its DNS from the OpenDNS servers and all of our other VM's are Windows machines that get their DNS from the Gateway.

On the Domain front is it not the other way around?

My whole network was built in the .localdomain, so have I not then come along and created a .myDomain for the SBS within it. I'm really confused?

Regards
William  

Which version (2003 or 2008) and what edition (Standard or Premium) of Small Business Server are you using ?

For what purpose have you installed SBS ?

You have two domains, .localdomain (physical infrastructure, where ESXi is), and .mydomain (virtual infrastructure, where SBS is).

"That aside my question remains, In my particular case should the Domain on the VMWare be the same or different as the Domain on the SBS Server, and what is the consequence of going either way?"

In this question, what does "VMWare" refer to? The host or the VMs? SBS is isolated and can only be accessed through routing conducted by your Gateway VM. The host should be on the same subnet as the VI client used to manage it.

Did you want to have two separate domains/forests wherein you'll enable uni- or bidirectional forest trusts or are you looking to unify them into one domain?

 
Hi aldanch

 Apologies for confusing things with a poor explanation.

 I have only 1 physical box that contains 2 physical network cards. This machine is collocated in an ISP's data center. I receive a feed into each network card from the ISP's switch. I have been provided with two public IP addresses (92.60.105.12 and 92.60.105.9) both of which have a mask of 255.255.255.128. I was given an address of 92.60.105.1 to use as a gateway and 92.60.105.8 to use for DNS.
 
All other NIC's, switches and machines are virtual and all other addressing uses private IP numbers.

 Im using ESXi embedded, so when the physical server was first turned on the VMWare was booted from an internal USB key. During setup I was asked to provide an IP address for the VMWare Management Network, I used one of my public IP addresses (92.60.105.9) and this was virtually bridged to the ISP's network via one of my physical Nic's.
 
Also during setup the VMware asked for a host name and defaulted "localhost.localdomain"

 I then proceeded to establish the virtual machine containing the Untangle Firewall, VPN and NAT device. This was given three virtual Nic's as follows:-

 External: Assigned my second public address (92.60.105.12) and was virtually bridged to my ISP's network via second physical Nic.

 Internal: Given a private IP address of 192.168.2.1/24

 DMZ: Given a private IP address of 10.0.10.1/8

 The Untangle box is set to get its DNS from OpenDns on 208.67.222.222

 I set up a virtual machine running an IIS server in the DMZ segment. This was given a private address of 10.0.10.2, a gateway of 10.0.10.1 and a DNS of 10.0.10.1. This all appeared to work fine and web pages could be served to the internet.

 I set up a virtual machine running the back end of my website on the internal segment. This was given a private address of 192.168.2.2, a gateway of 192.168.2.1 and a DNS of 192.168.2.1. This all appeared to work fine and I could VPN in to the Untangle box and reach the internal network and my back end could upload to the website to the DMZ

 I now want to install SBS 2008 on the Internal segment of the network. During setup I provided the following information: -

 Server Name: SBS1

 Internal Domain Name (NetBIOS): Indigolime

 Full Internal DNS Name: indigolime.local

 External Domain Name: indigolime.net
 
IP address: 192.168.2.2

 Gateway: 192.168.2.1

 DNS: 192.168.2.1

 This appears to work fine but I'm concerned that the settings on the SBS virtual box "indigolime.local" and the settings on the VMware host "localhost.localdomain" need to be related in some way. They do after all exist on the same virtual network.

 Im very confused, what is best practice in this case?

 Will  

A single network can contain multiple Domains as long as your requirement is fulfilled.

localhost.localdomain is just a generic name which is assigned to an ESX Host when it is installed  if you do not assign a normal domain name such as myesxhost.domain.com.

Besides that, what is the role of the SBS in your Network ?

Will,

How are you accessing your ESX server? Is it through it's Public IP or did your ISP give your a portal to use to access it?

Hi kumarnirmal

The SBS will be used to provide a small number of small SharePoint sites used b y a small number of users, Web Access to email and centralised control for the file storage and backup of the 4 clients and 1 server in the SBS domain.

Regards
William

Aldanac

Diagram was spot on, a great answer triggering one of those Eureka! moments where every thing falls into place.

I access ESXi directly through the public IP address, is this a problem?

A true expert on a great site.

Regards
Will

Will,

It's more of a security issue. ESXi's Management Network (VMkernel) is typically placed in a private network and is not directly accessible through the Internet. Your current predicament is that anyone can simply type in your ESX server's IP address on their favorite web browser, download the VI client, and attempt to gain access by brute forcing their way into your virtual environment.

There was a similar posting in the VMware Communities forum: http://communities.vmware.com/thread/194030

This post also mentions protecting your ESX server behind a firewall and setting up a VPN server that enables you to access your ESX via VI Client.

Did your ISP set up your ESX and then grant you access through a Public IP? Do they have an SLA regarding security of it?

aldanch

Thanks for the additional advice.

The problem I have is that the firewall is virtual so if I move the VMKernal behind the firewall I could end up in a situation where I cant get to the firewall because of a problem in ESXi and I cant get to ESXi because of a problem in the firewall or the other way around.

The ISP provides only power,cooling,ip addresses, a rack to hold the box and a network connection and the rest is down to me.

Without buying some physical hardware and paying to colocate it with the server, I cant see any other options?

Regards
William

Willliam,

Wouldn't it be in the best interest of your company to safeguard your ESXi server as it is the openly exposed to anyone with an Internet connection? IMHO, I think that it's worth the investment (if budget allows).

Bringing hardware (hardware firewall/vpn router) and co-locating it with the server would add a layer of security for your ESX server (which currently only has a username and password as its ownly defense), albeit it will come with a price. I would stake that cost against a security breach that may ruin your company's reputation (and yours) or use your resources for malicious agendas.

aldanch:

Will take on board your comments

Regards

William

Aldanch; Thank you very much for all your help. Kind Regards William