is it safe to virtualize my DMZ network on an ESXi 5.0 host, with internal networks also virtualized on the host?

Posted on 2012-04-03
Medium Priority
Last Modified: 2012-05-01
currently i have 3 ESXi hosts
2 have management IPs that are in my internal network
1 has management IPs that are in my DMZ network

currently the 2 ESXi hosts on the internal network only host VMs that have internal network IPs, and the 1 ESXi host that are in my DMZ network only host VMs that lay in the DMZ

i want to enable HA or FT on the servers, so i need to put all 3 servers in the same cluster,
i would like to manage the 3 ESXi hosts with internal IPs,

in the event that i need to fail a VM over, the DMZ guest machines might need to run on a host that has internal network VMs running on it.
would this be OK from a security standpoint, if i have guest VMs running on both my DMZ and my internal network?
Question by:jsctechy
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
  • 2
  • +1
LVL 123

Assisted Solution

by:Andrew Hancock (VMware vExpert / EE MVE^2)
Andrew Hancock (VMware vExpert / EE MVE^2) earned 1000 total points
ID: 37802835
Yes, we do and our clients do, the virtual switches are not connected.
LVL 35

Accepted Solution

Joseph Daly earned 1000 total points
ID: 37802836
Yes this can be done. You would need to configure a seperate network in VMware on all three of your hosts. This way you can specify which network each of your hosts will run on, either internal or DMZ.

I would suggest removing the management IP from the DMZ and only have the management go through internal.

As long as all three of your hosts can access both the internal and DMZ LAN you should be able to run HA failover without issue. The maps feature will help you determine if you have connections to these networks.
LVL 35

Expert Comment

by:Joseph Daly
ID: 37802840
The first sentence should read.

"Yes this can be done. You would need to configure a seperate network in VMware on all three of your hosts. This way you can specify which network each of your VIRTUAL MACHINES will run on, either internal or DMZ. "
Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

LVL 123
ID: 37802846
perfectly safe, there is no communicatin between virtual switches.

Author Comment

ID: 37803106
what if we only had 2 NICs per ESXi host?
all the servers are part of a HP c-class blade chassis, and the chassis has 2 switches in it, which is the equivalent of 2 physical NICs when presented to the blade servers
would vlans create the same security when dealing with the 10gb uplinks?
LVL 123
ID: 37803111
Use VLANs and Trunk network to host server

Author Comment

ID: 37803121
would vlans provide the same security as the vswitches?
LVL 123
ID: 37803129
Yes, only VMs connected in the portgroup will be able to communicate with DMZ, this is what we do here, and on client sites, to reduce physical networking.
LVL 19

Expert Comment

by:vmwarun - Arun
ID: 37803982
As long as the hosts see the same IP subnets, internal or DMZ would be easy to host. Make sure that you consider case sensitivity for port groups if you are going for Standard vSwitches.

Featured Post

Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
A look into Log Analysis and Effective Critical Alerting.
This Micro Tutorial walks you through using a remote console to access a server and install ESXi 5.1. This example is showing remote access and installation using a Dell server. The hypervisor is the very first component of your virtual infrastructu…
This video shows you how to use a vSphere client to connect to your ESX host as the root user. Demonstrates the basic connection of bypassing certification set up. Demonstrates how to access the traditional view to begin managing your virtual mac…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question