?
Solved

Security for virtualizing DMZ servers on your internal production hardware and storage

Posted on 2011-09-02
5
Medium Priority
?
1,976 Views
Last Modified: 2012-06-22
If we wanted to run our DMZ servers on our internal production hypervisors and storage (iscsi) does that cause any security concerns? I haven’t really heard of anyone hacking their way from one virtual machine to dom0 or to another virtual machine on that hypervisor. Is that a best practice or do most shops have separate physical storage and hardware for their DMZ virtual servers? If this is an acceptable practice are their additional things we should do to ensure it is secured?
0
Comment
Question by:wburgiss5805
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 7

Expert Comment

by:d3ath5tar
ID: 36475450
Sharing equipment for DMZ/LAN kind of negates the point of a LAN. We run seperate DMZ/LAN virtual environments.

It must be possible to hack out from one VM to another via the hypervisor otherwise VMWare wouldn't have had to introduce a virtual firewall between VMs (on certain editions.....)
0
 
LVL 20

Assisted Solution

by:Svet Paperov
Svet Paperov earned 501 total points
ID: 36475492
I don’t see any concerns with running a DMZ VM on an internal hypervisor as long as the DMZ VM uses separated NIC to connect directly to the DMZ network. It is not a good security practice to mix DMZ and internal network traffic on the same media, even on VLANs. However, I am not aware of a way to hack a hypervisor from a virtual machine.
0
 
LVL 16

Accepted Solution

by:
Danny McDaniel earned 498 total points
ID: 36475628
I've been looking for documentation that takes a stand on storage sharing between DMZ and internal hosts but haven't found anything.  We use FC and if you have separate LUN's for the DMZ, I don't think it should be a concern with proper zoning but my management wants it in black & white.

here's a thread discussing same host concerns and it has contributions from Ed Haletky who wrote a book on the subject of vSphere security http://communities.vmware.com/message/1701309
0
 
LVL 123

Assisted Solution

by:Andrew Hancock (VMware vExpert / EE MVE^2)
Andrew Hancock (VMware vExpert / EE MVE^2) earned 501 total points
ID: 36475854
We use many different types of storage, FC, iSCSI and NFS, all our Virtual hosts use a storage network, using VLANs when using ethernet.

ESX hosts have their own secure VLAN for management which the ESX hosts Management Network is connected to.

DMZ servers have their own DMZ VLAN which all the DMZ servers physical and virtual are connected to.

All servers on the DMZ are behind Cisco-PIX firewalls, and have public IP addresses, and only nominated ports are allowed via the firewalls into the DMZ. Also servers in the DMZ have limited access to each other, depending upon service.

It is extremely unlikely, that "hackers" will be able to reach the host Hypervisor, or Storage Networks from the DMZ.
0
 
LVL 42

Expert Comment

by:kevinhsieh
ID: 36476657
If you are a smaller environment, then it is reasonable to use production hosts for DMZ VMs if the VMs use a separate physical NIC dedicated to the DMZ. If you are a high value target, use dedicated equipment and possibly even an air gapped network. I would not me the VM have direct iSCSI access to production storage. FC is probably okay is you know how to zone properly.

Breakout issues from the VM to the host are very rare.
0

Featured Post

Plug and play, no additional software required!

The ATEN UE3310 USB3.1 Gen1 Extender Cable allows users to extend the distance between the computer and USB devices up to 10 m (33 ft). The UE3310 is a high-quality, cost-effective solution for professional environments such as hospitals, factories and business facilities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will show you how to create an ISO CD-ROM/DVD-ROM image (*.iso), and MD5 checksum signature, for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5). It's a good idea to compare checksums, because many installations fail because of a corr…
In this article, I will show you HOW TO: Suppress Configuration Issues and Warnings Alert displayed in Summary status for ESXi 6.5 after enabling SSH or ESXi Shell.
Teach the user how to use configure the vCenter Server storage filters Open vSphere Web Client:  Navigate to vCenter Server Advanced Settings: Add the four vCenter Server storage filters: Review the advanced settings: Modify the values of the four v…
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question