Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

DMZ virtualization and network design. UCS+VMWARE

Up to now, we had a physically segmented network with internal and external different vtp domains/zones. Internal zone switches have a VLAN set, and external zone switches have a different VLAN set. VLANs are not propagated between different zones for security reasons, are isolated.

Currently, we just have started working with UCS+VMWARE, and we are facing some troubles. According to the previous model, if we virtualize servers within the internal zone in the UCS farm, we cannot virtualize servers within the external zone in the same UCS farm, since I would have to propagate external VLANs to the internal zone switches as well as to the UCS farm, mixing them. As a result of this, isolation would be lost.

I am trying to redesign all my core network, to adapt current infraestructure to the new one with UCS+VMWARE, without missing any point of security.

My major point, is to know whether it is posible to virtualize external and internal zone virtual machines in the same UCS farm, without compromising my network security.

Could you give me some advice or design guidelines?

Regards,

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

DMZ virtualization and network design. UCS+VMWARE

Hello -

You are correct that up through UCS 1.4 all VLANs needed to be available on the upstream switches.  However, UCS 2.x introduced a feature named "Disjointed L2."  Using this feature you will be able to connect the Fabric Interconnects to both your internal network & DMZ then provision those vlans to blades.

http://www.cisco.com/en/US/docs/unified_computing/ucs/sw/gui/config/guide/2.0/b_UCSM_GUI_Configuration_Guide_2_0_chapter_010101.html

Matthew

4 REPLIES
Cisco Employee

DMZ virtualization and network design. UCS+VMWARE

Hello -

You are correct that up through UCS 1.4 all VLANs needed to be available on the upstream switches.  However, UCS 2.x introduced a feature named "Disjointed L2."  Using this feature you will be able to connect the Fabric Interconnects to both your internal network & DMZ then provision those vlans to blades.

http://www.cisco.com/en/US/docs/unified_computing/ucs/sw/gui/config/guide/2.0/b_UCSM_GUI_Configuration_Guide_2_0_chapter_010101.html

Matthew

New Member

DMZ virtualization and network design. UCS+VMWARE

Hello -

How secure is UCS "disjointed L2" solution compare to traditional physically separated L2 domains i.e. DMZ and Back-end network?

Silver

DMZ virtualization and network design. UCS+VMWARE

It might be worthwhile exploring Nexus 1000V and specifically the VSG (Virtual Security Gateway) which targets the ability to provide more granular security within a VMWare virtualised environment.

---

Posted by WebUser Adriaan Steyn

New Member

DMZ virtualization and network design. UCS+VMWARE

Thank you. I greatly appreciate your usefull contributions.

Regards,

4677
Views
0
Helpful
4
Replies