Comments on: Secure to the Hosted VM http://www.2vcps.com/2009/02/10/secure-to-the-hosted-vm/ Mon, 02 Jan 2012 06:16:00 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Jon Owings http://www.2vcps.com/2009/02/10/secure-to-the-hosted-vm/comment-page-1/#comment-21 Jon Owings Wed, 11 Feb 2009 22:54:00 +0000 http://2vcps.com/2009/02/10/secure-to-the-hosted-vm/#comment-21 Thanks for the suggestions. I am going to try to make this work. The VMsafe API would be the framwork to make this work natively. From what I can see no one is doing it yet to provide Ipsec all the way to the vSwitch.<br/><br/>I have a feeling this is the directions things will be going with all the Cisco/VMware integration. Thanks for the suggestions. I am going to try to make this work. The VMsafe API would be the framwork to make this work natively. From what I can see no one is doing it yet to provide Ipsec all the way to the vSwitch.

I have a feeling this is the directions things will be going with all the Cisco/VMware integration.

]]> By: Jon Owings http://www.2vcps.com/2009/02/10/secure-to-the-hosted-vm/comment-page-1/#comment-532 Jon Owings Wed, 11 Feb 2009 22:54:00 +0000 http://2vcps.com/2009/02/10/secure-to-the-hosted-vm/#comment-532 Thanks for the suggestions. I am going to try to make this work. The VMsafe API would be the framwork to make this work natively. From what I can see no one is doing it yet to provide Ipsec all the way to the vSwitch.I have a feeling this is the directions things will be going with all the Cisco/VMware integration. Thanks for the suggestions. I am going to try to make this work. The VMsafe API would be the framwork to make this work natively. From what I can see no one is doing it yet to provide Ipsec all the way to the vSwitch.I have a feeling this is the directions things will be going with all the Cisco/VMware integration.

]]> By: Altonius http://www.2vcps.com/2009/02/10/secure-to-the-hosted-vm/comment-page-1/#comment-20 Altonius Wed, 11 Feb 2009 21:39:00 +0000 http://2vcps.com/2009/02/10/secure-to-the-hosted-vm/#comment-20 VMSafe are the API's that will hopefully allow partners to create this kind of appliance or software, however this is still a very new API and we're waiting on partners to use this API.<br/><br/>I've had a look at thirdbrigade and their product sounds good, however the main item that the post was about was trying to maintain data isolation between the client and the virtual switch. Rather than trying to deploy a Firewall or IDS on each VM, the poster wants to create an IPSEC tunnel from within the Virtual Environment to the Firewall. This would avoid a single pNIC to Port Group configuration requirement as each Port Group could have it's own IPSEC tunnel established on it's own VLAN down the Trunked ports.<br/><br/>An interesting idea, and may need to be tested further. VMSafe are the API’s that will hopefully allow partners to create this kind of appliance or software, however this is still a very new API and we’re waiting on partners to use this API.

I’ve had a look at thirdbrigade and their product sounds good, however the main item that the post was about was trying to maintain data isolation between the client and the virtual switch. Rather than trying to deploy a Firewall or IDS on each VM, the poster wants to create an IPSEC tunnel from within the Virtual Environment to the Firewall. This would avoid a single pNIC to Port Group configuration requirement as each Port Group could have it’s own IPSEC tunnel established on it’s own VLAN down the Trunked ports.

An interesting idea, and may need to be tested further.

]]> By: Altonius http://www.2vcps.com/2009/02/10/secure-to-the-hosted-vm/comment-page-1/#comment-531 Altonius Wed, 11 Feb 2009 21:39:00 +0000 http://2vcps.com/2009/02/10/secure-to-the-hosted-vm/#comment-531 VMSafe are the API's that will hopefully allow partners to create this kind of appliance or software, however this is still a very new API and we're waiting on partners to use this API.I've had a look at thirdbrigade and their product sounds good, however the main item that the post was about was trying to maintain data isolation between the client and the virtual switch. Rather than trying to deploy a Firewall or IDS on each VM, the poster wants to create an IPSEC tunnel from within the Virtual Environment to the Firewall. This would avoid a single pNIC to Port Group configuration requirement as each Port Group could have it's own IPSEC tunnel established on it's own VLAN down the Trunked ports.An interesting idea, and may need to be tested further. VMSafe are the API’s that will hopefully allow partners to create this kind of appliance or software, however this is still a very new API and we’re waiting on partners to use this API.I’ve had a look at thirdbrigade and their product sounds good, however the main item that the post was about was trying to maintain data isolation between the client and the virtual switch. Rather than trying to deploy a Firewall or IDS on each VM, the poster wants to create an IPSEC tunnel from within the Virtual Environment to the Firewall. This would avoid a single pNIC to Port Group configuration requirement as each Port Group could have it’s own IPSEC tunnel established on it’s own VLAN down the Trunked ports.An interesting idea, and may need to be tested further.

]]> By: Pironet http://www.2vcps.com/2009/02/10/secure-to-the-hosted-vm/comment-page-1/#comment-19 Pironet Wed, 11 Feb 2009 12:22:00 +0000 http://2vcps.com/2009/02/10/secure-to-the-hosted-vm/#comment-19 Hi,<br/><br/>This issue has been addressed with this new technology called VMSafe (http://www.vmware.com/technology/security/vmsafe.html)<br/><br/>Look at VM Protection from Thirdbrigade.com to see how they deal with security within vSwitch for instance.<br/><br/>Rgds, Hi,

This issue has been addressed with this new technology called VMSafe (http://www.vmware.com/technology/security/vmsafe.html)

Look at VM Protection from Thirdbrigade.com to see how they deal with security within vSwitch for instance.

Rgds,

]]> By: Pironet http://www.2vcps.com/2009/02/10/secure-to-the-hosted-vm/comment-page-1/#comment-530 Pironet Wed, 11 Feb 2009 12:22:00 +0000 http://2vcps.com/2009/02/10/secure-to-the-hosted-vm/#comment-530 Hi,This issue has been addressed with this new technology called VMSafe (http://www.vmware.com/technology/security/vmsafe.html)Look at VM Protection from Thirdbrigade.com to see how they deal with security within vSwitch for instance.Rgds, Hi,This issue has been addressed with this new technology called VMSafe (http://www.vmware.com/technology/security/vmsafe.html)Look at VM Protection from Thirdbrigade.com to see how they deal with security within vSwitch for instance.Rgds,

]]> By: Altonius http://www.2vcps.com/2009/02/10/secure-to-the-hosted-vm/comment-page-1/#comment-18 Altonius Tue, 10 Feb 2009 23:35:00 +0000 http://2vcps.com/2009/02/10/secure-to-the-hosted-vm/#comment-18 Hiya,<br/><br/>Good thought. I have seen a similar layout, however not with a firewall appliance, but with the Bluelane VirtualShield Inline Patching appliance (they have now been purchased by VMWare). A couple of thoughts from when I looked into this:<br/><br/>1. Their model was to have an appliance (in your case the VPN Firewall) on each host, set to not participate in VMotion. I think this may be the better scenario as I don't know of any way to make sure that machines with an affinity move at identical times (so that the firewall is always present and there is limited drop outs)<br/><br/>2. There was an extra setting that needed to be applied so that a VM attached to a vSwicth that doesn't have a pNIC attached to it. See http://communities.vmware.com/thread/89240;jsessionid=606864BA1A3CBACB94BB40B1E6341B52?tstart=26550 for information that needs to be applied to the vpxd.cfg file on teh Virtual Center to allow the VM to migrate.<br/><br/>Hope this helps and starts things moving in the right direction Hiya,

Good thought. I have seen a similar layout, however not with a firewall appliance, but with the Bluelane VirtualShield Inline Patching appliance (they have now been purchased by VMWare). A couple of thoughts from when I looked into this:

1. Their model was to have an appliance (in your case the VPN Firewall) on each host, set to not participate in VMotion. I think this may be the better scenario as I don’t know of any way to make sure that machines with an affinity move at identical times (so that the firewall is always present and there is limited drop outs)

2. There was an extra setting that needed to be applied so that a VM attached to a vSwicth that doesn’t have a pNIC attached to it. See http://communities.vmware.com/thread/89240;jsessionid=606864BA1A3CBACB94BB40B1E6341B52?tstart=26550 for information that needs to be applied to the vpxd.cfg file on teh Virtual Center to allow the VM to migrate.

Hope this helps and starts things moving in the right direction

]]> By: Altonius http://www.2vcps.com/2009/02/10/secure-to-the-hosted-vm/comment-page-1/#comment-529 Altonius Tue, 10 Feb 2009 23:35:00 +0000 http://2vcps.com/2009/02/10/secure-to-the-hosted-vm/#comment-529 Hiya,Good thought. I have seen a similar layout, however not with a firewall appliance, but with the Bluelane VirtualShield Inline Patching appliance (they have now been purchased by VMWare). A couple of thoughts from when I looked into this:1. Their model was to have an appliance (in your case the VPN Firewall) on each host, set to not participate in VMotion. I think this may be the better scenario as I don't know of any way to make sure that machines with an affinity move at identical times (so that the firewall is always present and there is limited drop outs)2. There was an extra setting that needed to be applied so that a VM attached to a vSwicth that doesn't have a pNIC attached to it. See http://communities.vmware.com/thread/89240;jsessionid=606864BA1A3CBACB94BB40B1E6341B52?tstart=26550 for information that needs to be applied to the vpxd.cfg file on teh Virtual Center to allow the VM to migrate.Hope this helps and starts things moving in the right direction Hiya,Good thought. I have seen a similar layout, however not with a firewall appliance, but with the Bluelane VirtualShield Inline Patching appliance (they have now been purchased by VMWare). A couple of thoughts from when I looked into this:1. Their model was to have an appliance (in your case the VPN Firewall) on each host, set to not participate in VMotion. I think this may be the better scenario as I don’t know of any way to make sure that machines with an affinity move at identical times (so that the firewall is always present and there is limited drop outs)2. There was an extra setting that needed to be applied so that a VM attached to a vSwicth that doesn’t have a pNIC attached to it. See http://communities.vmware.com/thread/89240;jsessionid=606864BA1A3CBACB94BB40B1E6341B52?tstart=26550 for information that needs to be applied to the vpxd.cfg file on teh Virtual Center to allow the VM to migrate.Hope this helps and starts things moving in the right direction

]]>