DMZ virtualization and network design. UCS+VMWARE

Answered Question
Feb 23rd, 2012

Up to now, we had a physically segmented network with internal and external different vtp domains/zones. Internal zone switches have a VLAN set, and external zone switches have a different VLAN set. VLANs are not propagated between different zones for security reasons, are isolated.

Currently, we just have started working with UCS+VMWARE, and we are facing some troubles. According to the previous model, if we virtualize servers within the internal zone in the UCS farm, we cannot virtualize servers within the external zone in the same UCS farm, since I would have to propagate external VLANs to the internal zone switches as well as to the UCS farm, mixing them. As a result of this, isolation would be lost.

I am trying to redesign all my core network, to adapt current infraestructure to the new one with UCS+VMWARE, without missing any point of security.

My major point, is to know whether it is posible to virtualize external and internal zone virtual machines in the same UCS farm, without compromising my network security.

Could you give me some advice or design guidelines?

Regards,

I have this problem too.
0 votes
Correct Answer by Matthew Wronkowski about 2 years 1 month ago

Hello -

You are correct that up through UCS 1.4 all VLANs needed to be available on the upstream switches.  However, UCS 2.x introduced a feature named "Disjointed L2."  Using this feature you will be able to connect the Fabric Interconnects to both your internal network & DMZ then provision those vlans to blades.

http://www.cisco.com/en/US/docs/unified_computing/ucs/sw/gui/config/guide/2.0/b_UCSM_GUI_Configuration_Guide_2_0_chapter_010101.html

Matthew

  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 5 (1 ratings)
Correct Answer
Matthew Wronkowski Thu, 02/23/2012 - 18:53

Hello -

You are correct that up through UCS 1.4 all VLANs needed to be available on the upstream switches.  However, UCS 2.x introduced a feature named "Disjointed L2."  Using this feature you will be able to connect the Fabric Interconnects to both your internal network & DMZ then provision those vlans to blades.

http://www.cisco.com/en/US/docs/unified_computing/ucs/sw/gui/config/guide/2.0/b_UCSM_GUI_Configuration_Guide_2_0_chapter_010101.html

Matthew

sajidilyas Wed, 01/16/2013 - 01:58

Hello -

How secure is UCS "disjointed L2" solution compare to traditional physically separated L2 domains i.e. DMZ and Back-end network?

fb_webuser Thu, 02/23/2012 - 23:22

It might be worthwhile exploring Nexus 1000V and specifically the VSG (Virtual Security Gateway) which targets the ability to provide more granular security within a VMWare virtualised environment.

---

Posted by WebUser Adriaan Steyn

Actions

Login or Register to take actions

This Discussion

Posted February 23, 2012 at 9:35 AM
Stats:
Replies:4 Avg. Rating:5
Views:3106 Votes:0
Shares:0
Tags: dmz, vmware, ucs
+
Categories: General UCS Hardware
+

Related Content

Discussions Leaderboard