Quad port NIC vmkernel assignments

Question

I have a quad port NIC in Vmware ESXi 5.5 and each nic port has an equivalent vmkernel with unique ip's/subnet (vmkernel1, 2, 3 and 4). if in case one of my vm's assigned to vmkernel1 is compromised by some hacker, does that mean the rest of my vm's assigned to the other vmkernels are also compromised automatically even if the subnets are different? I'm assuming vm's from vmkernel1 should not be able to ping vm's from vmkernel2..etc. Any advice? Thank you.

Answer 1

You don't connect virtual machines to VMkernel Ports, you connect them to Virtual Machine Port Groups.

Your VMkernel port ip address assignment has nothing to do with the ip address assignment of your virtual machines. VMkernel ports are for things like management access to the host, vMotion, iSCSI, etc. They're not related to virtual machine communication.

Virtual machines connected to different vSwitches can't communicate with each other except through the physical network.

If you need to provide isolation between the virtual machines connected to different vSwitches then look into using VLAN's on your physical switch.

Someone gaining unauthorized access to a VM connected to one vSwitch doesn't automatically proffer access to virtual machines connected to other vSwitches, but you should probably assume that if they can gain access to one VM than they probably can gain access to your other VM's.

Answer 2

I think you are confusing vswitches with vmkernel interfaces.

To isolate nics you need one vswitch and one port group (to put vms in) per seperate subnet/nic.

You only need vmkernel interfaces on networks you want vsphere itself to talk on for management, one could be enough. You don't need them on the networks that you will not manage from.