Solved

is it safe to virtualize my DMZ network on an ESXi 5.0 host, with internal networks also virtualized on the host?

Posted on 2012-04-03
9
1,134 Views
Last Modified: 2012-05-01
currently i have 3 ESXi hosts
2 have management IPs that are in my internal network
1 has management IPs that are in my DMZ network

currently the 2 ESXi hosts on the internal network only host VMs that have internal network IPs, and the 1 ESXi host that are in my DMZ network only host VMs that lay in the DMZ

i want to enable HA or FT on the servers, so i need to put all 3 servers in the same cluster,
i would like to manage the 3 ESXi hosts with internal IPs,

in the event that i need to fail a VM over, the DMZ guest machines might need to run on a host that has internal network VMs running on it.
would this be OK from a security standpoint, if i have guest VMs running on both my DMZ and my internal network?
0
Comment
Question by:jsctechy
  • 4
  • 2
  • 2
  • +1
9 Comments
 
LVL 117

Assisted Solution

by:Andrew Hancock (VMware vExpert / EE MVE)
Andrew Hancock (VMware vExpert / EE MVE) earned 250 total points
Comment Utility
Yes, we do and our clients do, the virtual switches are not connected.
0
 
LVL 35

Accepted Solution

by:
Joseph Daly earned 250 total points
Comment Utility
Yes this can be done. You would need to configure a seperate network in VMware on all three of your hosts. This way you can specify which network each of your hosts will run on, either internal or DMZ.

I would suggest removing the management IP from the DMZ and only have the management go through internal.

As long as all three of your hosts can access both the internal and DMZ LAN you should be able to run HA failover without issue. The maps feature will help you determine if you have connections to these networks.
0
 
LVL 35

Expert Comment

by:Joseph Daly
Comment Utility
The first sentence should read.

"Yes this can be done. You would need to configure a seperate network in VMware on all three of your hosts. This way you can specify which network each of your VIRTUAL MACHINES will run on, either internal or DMZ. "
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
perfectly safe, there is no communicatin between virtual switches.
0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 
LVL 1

Author Comment

by:jsctechy
Comment Utility
what if we only had 2 NICs per ESXi host?
all the servers are part of a HP c-class blade chassis, and the chassis has 2 switches in it, which is the equivalent of 2 physical NICs when presented to the blade servers
would vlans create the same security when dealing with the 10gb uplinks?
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
Use VLANs and Trunk network to host server
0
 
LVL 1

Author Comment

by:jsctechy
Comment Utility
would vlans provide the same security as the vswitches?
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
Yes, only VMs connected in the portgroup will be able to communicate with DMZ, this is what we do here, and on client sites, to reduce physical networking.
0
 
LVL 19

Expert Comment

by:vmwarun - Arun
Comment Utility
As long as the hosts see the same IP subnets, internal or DMZ would be easy to host. Make sure that you consider case sensitivity for port groups if you are going for Standard vSwitches.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

This article will show you how to create an ISO CD-ROM/DVD-ROM image (*.iso), and MD5 checksum signature, for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5). It's a good idea to compare checksums, because many installations fail because of a corr…
In this article, I will show you HOW TO: Create your first Windows Virtual Machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, the Windows OS we will install is Windows Server 2016.
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now