Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Imagine you need several Virtual Machine onto your ESX server. The VMs are composed of two distinct group and those group can only communicate to each others over a physical firewall.

Now, what make sense from an network isolation standpoint? Are all the Virtual Machines running in the same virtual ethernet engine and simply separated using VLANs tagging behind the scene or is it something else like using different memory space with a virtual ethernet engine for each vSwitch? I could not find any information regarding the actual strength of vSwitch isolation except a sale pitch from Cisco stating only Nexus 1000v were doing real separation.

I would like to known your thoughts around the security of virtual switch isolation and VLAN tagging in those kind of environment.

Thanks,


Bottom line, it should really change the way we build LAN connection with Virtual Machines. If it's comparable to physical separation this diagram is quite logical: alt text

Otherwise, if it's using VLAN tagging we need to be consequent and use VLAN tagging on the physical switch (which would not lower the security of this solution). alt text

Keep in mind I did not represent the redundancy layer into those diagrams.

share|improve this question
1  
what is the question? –  knitti Oct 1 '10 at 21:30
    
What would you do and why? Any concern with VLAN hopping? –  northox Oct 2 '10 at 3:51
add comment

1 Answer

up vote 2 down vote accepted

I don't know where the misconception arose, or why Cisco might claim that only the Nexus 1000V provides full isolation, but the basic facts of VMware ESX virtual switching are that there is no connectivity between vSwitches within an ESX host. They are extremely simple virtual layer2 devices with no ability to set up inter-switch links.

Your first diagram describes the behaviour of all vSwitches. Distributed vSwitches are a bit more complex as they have to have external uplinks that enable traffic to move between hosts but even with those there is no way for Ethernet traffic to move between the vSwitches within the hypervisor(s), it has to travel to an external device and then be switched or routed back in.

share|improve this answer
    
Couldn't have answered it better myself - cheeky Cisco :) –  Chopper3 Feb 3 '11 at 9:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.