Or will I need to administer each firewall for each guest server OS?
Do I do both? Hardware firewall on host, software firewall on each server OS?
What is the best practice here?
|
feedback
|
|
Keep in mind that if you have more than one subnet in your network (which is quite usual even for small ones), your ESX(i) host will have a management IP on one of them, but your guest VMs will be spread across them depending on your needs; so, putting a firewall in front of the host's management connection will not defend the guest VMs. This means your question actually makes sense only if you have a single network where both the host and the guests reside; in this case, it depends on your setup and needs; having a firewall on each machine gives you more flexibility, and having a global firewall in front of all of them gives you two layers of defense. | |||
|
feedback
|
|
Defense in depth, my friend. It is my policy to protect my hosts and VMs with both a dedicated firewall device (hardware firewall is sort of a misnomer), as well as host firewalls running on each VM (either iptables or Windows Advanced firewall). | |||
|
feedback
|
|
"Best Practice" is to have both an organizational firewall as well as host-based firewalls. However, if you configure the hardware firewall correctly in front of the ESXi servers, it should do just fine for external protection without host(guest)-based firewalls. Your vulnerability in that instance will be server-to-server traffic being wide open. | |||
|
feedback
|
