We have an ESXi host running which has 5 NICs in total. Until now it hosts only VMs for our internal network. We also have a firewall so that users on the net can browse the internet (proxy). The firewall is an UTM appliance and also has a DMZ port. Now I thought we could also put a webserver (or similar) on one VM and make it accessible on the internet. This virtual server would get one dedicated NIC on the ESXi which is connected to the DMZ port of the firewall. Would this be a good idea or are there any (security related) considerations against this scenario? Since its a seperate NIC it would get its own vSwitch on the vCenter and would have no physical connection to the internal net. But the vCenter manages the whole host and has access to all NICs etc. so I'm not sure if this is the best solution.
It's not the best solution, of course - ideally you would have a separate VM host for DMZ guests. If you do choose to go this way though, some points you should take into account:
That said, it's still better than not having a DMZ at all so it can be a good stop-gap solution if you can't use a separate host right now. Just keep in mind that it's not as safe as having your DMZ guests on a separate host and real network.
|show 2 more comments|
There is nothing wrong with that approach.
I would typically use VLAN trunking to carry a DMZ over the existing links, but if you want it absolutely and completely separated then yes use another link and assign that NIC into a separate vSwitch. This should keep things nice and segmented for you.