1

I have 2 rx300 server with Esxi and I want to use one of these as web virtual server with 2 VM running:
- Mail server
- WEB server for enterprise website and ecommerce.
the esxi server has an iscsi configuration with a SAN, up to now everything is in the same LAN of the rest of the enterprise (physically connected to central LAN Switch). I have a router/firewall with DMZ port and DMZ configuration.

My question is:
Am I forced to put ALL the Esxi+SAN in the DMZ by physically connecting the Esxi+SAN to a New switch connected to DMZ port of the firewall? Or can I left the Esx+SAN connected to the LAN-side-Switch and make some security configuration on firewall to obtain the same security level?
What's the best practice in this case?
In future I will want to use this Esxi server also for VM running application for LAN Side.
Is it possible to make a mixed infrastructure?

1
  • Everything is possible, the question is its price and feasibility. I suggest to re-formulate your question to be more narrow, and concrete.
    – peterh
    Jul 6, 2015 at 20:57

1 Answer 1

0

Ideally you want your storage traffic to be on a completely dedicated/isolated network. Storage traffic can be quite sensitive both in terms of privacy and terms of performance, so separating it from the rest of your traffic is always a good idea.

Also the management network and public network should be separated for better security and performance (you wouldn't want to tap out your public gbit NIC when vmotion-ing for example).

So my suggestion would be:

Separate switch/nics for the storage traffic.
Separate nics for the LAN & Management traffic.
And separate nic(s) for the public traffic.

For public and lan traffic you could use the same managed switch and separate the traffic using VLANs. Though it would be best to use separate switches for each type of traffic.

Just to make myself clear, I don't mean to use a single physical NIC to pass both management and LAN traffic, rather that multiple NICs connected to the same switch on different VLAN (access) ports.

1
  • Thank you so much Cha0s for your support. So, if I understand it correctly, I can connect the DMZ port of the router with a proper VLAN on the same switch with the LAN. Am I forced to put all the ESXi server connected to the public VLAN as shown on this image: link ? or can I left the ESX connected with the LAN VLAN?
    – FabioLog
    Jul 6, 2015 at 6:55

Not the answer you're looking for? Browse other questions tagged .