Put VMs in DMZ

In VCenter, if I have all my ESX servers inside the Network, later on I will decide to put some VMs in the DMZ. Considering that we have 2 cisco physical ASA firewall appliances.
 in this case do I have to add for instance 2 Physical NICs to some ESX servers and plug them to a physical Switch in the DMZ ?

OR I need to configure a Virtual DMZ ?

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
in this case do I have to add for instance 2 Physical NICs to some ESX servers and plug them to a physical Switch in the DMZ ?

You would create a new virtual switch, e.g. vSwitch1, with at least two nics, connected to a physical Switch in the DMZ.

then create a virtual machine portgroup called DMZ, b nature of doing this you have created a virtual DMZ.

All VMs, you want in the DMZ, use the virtual machine portgroup called DMZ, in their nic selection.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Zephyr ICTCloud ArchitectCommented:
I like the idea of a separate vswitch but sometimes that's not a possibility, for those times it's not one could use VLANs to separate traffic (obviously non-routed onces). Safe's from needing to add extra network cards when budget is tight.

More info on VMware+VLANs
Phil DavidsonCommented:
You may need to use bridges and bonding (e.g., in the /etc/network/interfaces file assuming the VMs are Linux).  This can help you configure them to be in the DMZ of a physical firewall yet virtual.
Benjamin Van DitmarsSr Network EngineerCommented:
security technical i would create a second vswitch with connects the dmz virtal machines to a own physical switch and then connect it to the second asa. then you dont have any access to youre lan.
when needed to make more then one dmz just add vlans on this "dmz" network and add the vlan to the ASA
jskfanAuthor Commented:
Thank you Guys
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.