Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Imagine you need several Virtual Machine onto your ESX server. The VMs are composed of two distinct group and those group can only communicate to each others over a physical firewall.

Now, what make sense from an network isolation standpoint? Are all the Virtual Machines running in the same virtual ethernet engine and simply separated using VLANs tagging behind the scene or is it something else like using different memory space with a virtual ethernet engine for each vSwitch? I could not find any information regarding the actual strength of vSwitch isolation except a sale pitch from Cisco stating only Nexus 1000v were doing real separation.

I would like to known your thoughts around the security of virtual switch isolation and VLAN tagging in those kind of environment.


Bottom line, it should really change the way we build LAN connection with Virtual Machines. If it's comparable to physical separation this diagram is quite logical: alt text

Otherwise, if it's using VLAN tagging we need to be consequent and use VLAN tagging on the physical switch (which would not lower the security of this solution). alt text

Keep in mind I did not represent the redundancy layer into those diagrams.

share|improve this question
what is the question? – knitti Oct 1 '10 at 21:30
What would you do and why? Any concern with VLAN hopping? – northox Oct 2 '10 at 3:51
up vote 2 down vote accepted

I don't know where the misconception arose, or why Cisco might claim that only the Nexus 1000V provides full isolation, but the basic facts of VMware ESX virtual switching are that there is no connectivity between vSwitches within an ESX host. They are extremely simple virtual layer2 devices with no ability to set up inter-switch links.

Your first diagram describes the behaviour of all vSwitches. Distributed vSwitches are a bit more complex as they have to have external uplinks that enable traffic to move between hosts but even with those there is no way for Ethernet traffic to move between the vSwitches within the hypervisor(s), it has to travel to an external device and then be switched or routed back in.

share|improve this answer
Couldn't have answered it better myself - cheeky Cisco :) – Chopper3 Feb 3 '11 at 9:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.