Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Or will I need to administer each firewall for each guest server OS?

Do I do both? Hardware firewall on host, software firewall on each server OS?

What is the best practice here?

share|improve this question
add comment

3 Answers 3

up vote 0 down vote accepted

Keep in mind that if you have more than one subnet in your network (which is quite usual even for small ones), your ESX(i) host will have a management IP on one of them, but your guest VMs will be spread across them depending on your needs; so, putting a firewall in front of the host's management connection will not defend the guest VMs.

This means your question actually makes sense only if you have a single network where both the host and the guests reside; in this case, it depends on your setup and needs; having a firewall on each machine gives you more flexibility, and having a global firewall in front of all of them gives you two layers of defense.

share|improve this answer
    
Thanks for the clarity. –  ioSamurai May 13 '11 at 14:51
add comment

Defense in depth, my friend. It is my policy to protect my hosts and VMs with both a dedicated firewall device (hardware firewall is sort of a misnomer), as well as host firewalls running on each VM (either iptables or Windows Advanced firewall).

share|improve this answer
add comment

"Best Practice" is to have both an organizational firewall as well as host-based firewalls.

However, if you configure the hardware firewall correctly in front of the ESXi servers, it should do just fine for external protection without host(guest)-based firewalls. Your vulnerability in that instance will be server-to-server traffic being wide open.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.