securing the virtualized dmz - ciscodmz ‐ based services. thin client nexus 1000v vsm. vcenter....
TRANSCRIPT
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 1
Securing The Virtualized DMZ
David AndersonData Center Solutions ArchitectCCIE, CISSP
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 2
What Is Driving DMZ Virtualization?
Virtualization Benefits
Lower Rack Space Utilization
Power savings
Better Utilization through resource consolidation
Machine and Application mobility
Reduced Deployment Times
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 3
Network Team Virtualization Concerns
Policy EnforcementApplied at physical server—not the individual VMImpossible to enforce policy for VMs in motion
Operations and ManagementLack of VM visibility, accountability, and consistencyDifficult management model and inability to effectively troubleshoot
Roles and ResponsibilitiesMuddled ownership as server admin must configure virtual network Organizational redundancy creates compliance challenges
Machine SegmentationServer and application isolation on same physical serverNo separation between compliant and non-compliant systems…
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 4
Maintaining Compliance Through Virtualization
Nexus 1000V Features Common Requirements
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 5
dcvsm(config)# ip access-list deny-vm-to-vm-trafficdcvsm(config-acl)# deny ip host 10.10.10.10 host 10.10.20.20
dcvsm(config-acl)# permit ip any any
Nexus 1000V: Control and Isolation of Virtual Machine Traffic
dcvsm(config)# ip access-list deny-vm-traffic-to- service console
dcvsm(config-acl)# deny ip 10.10.0.0 192.168.20.0
dcvsm(config-acl)# permit ip any any
Intranet
Application
Servers
DMZ‐Based
ServicesPrivate VLAN
Green
Network Segmentation
• VLANs• Private VLANs
Network Network SegmentationSegmentation
•• VLANsVLANs•• Private Private VLANsVLANs
Access Controls & Network Security
• Port ACLs (IP & MAC)
Access Controls & Access Controls & Network SecurityNetwork Security
•• Port Port ACLsACLs (IP & MAC)(IP & MAC)Private VLAN
Red
Private VLAN
Purple
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 6
Nexus 1000V: Management and Monitoring Virtual Machine Traffic
VM Traffic Mirroring
• ERSPAN
VM Traffic VM Traffic MirroringMirroring
•• ERSPANERSPAN
VM Traffic Analysis and
Reporting • NetFlow• Syslog
VM Traffic VM Traffic Analysis and Analysis and
ReportingReporting•• NetFlowNetFlow•• SyslogSyslog
Intranet
Application
Servers
DMZ‐Based
ServicesPrivate VLAN
GreenPrivate VLAN
Red
Private VLAN
Purple
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 7
Nexus 1000V: Maintaining Roles & Workflows1. Nexus 1000V automatically enables port groups in Virtual Center via API
2. Server Admin uses Virtual Center to assign vnic policy from available port groups
3. Nexus 1000V automatically enables VM connectivity at VM power-on
vSphere
NexusNexus1000V1000VVEMVEM
DMZ‐Based Services
Thin Client
Nexus 1000V VSM
vCentervCenter
Network Admin Benefits• Unifies network mgmt and ops• Improves operational security• Enhances VM network features• Ensures policy persistence• Enables VM-level visibility
Network Admin BenefitsNetwork Admin Benefits•• Unifies network mgmt and opsUnifies network mgmt and ops•• Improves operational securityImproves operational security•• Enhances VM network featuresEnhances VM network features•• Ensures policy persistenceEnsures policy persistence•• Enables VMEnables VM--level visibilitylevel visibility
VI Admin Benefits• Maintains existing VM mgmt• Reduces deployment time• Improves scalability• Reduces operational workload• Enables VM-level visibility
VI Admin BenefitsVI Admin Benefits•• Maintains existing VM mgmtMaintains existing VM mgmt•• Reduces deployment timeReduces deployment time•• Improves scalabilityImproves scalability•• Reduces operational workloadReduces operational workload•• Enables VMEnables VM--level visibilitylevel visibility
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 8
Nexus 1000V: Security Policy Mobility with Vmotion
1. Virtual Center kicks off a VMotion (manual/DRS) & notifies Nexus 1000V
2. During VM replication, Nexus 1000V copies VM port state to new host
3. Once VMotion completes, port on new ESX host is brought up & VM’s MAC address is announced to the network
Mobile Properties Include:
Port policy
Interface state and counters
Flow statistics
Remote port mirror session
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 9
Uplink Ports
Virtual Ethernet (vnet) Adapters
Uplink Ports
Physical Adapters
Intranet Application ServersDMZ‐Based Services
Intranet Server Farm
DMZ Infrastructure
FTP
The Virtualized DMZ: Nexus 1000V & VMware
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 10
Summary
Nexus 1000V:
Supports traditional Network Capabilities
Roles and workflows are unchanged
VM security policies are the same as physical server policies
Maintain Compliance requirements
© 2008 Cisco Systems, Inc. All rights reserved.Presentation_ID 11
For more information visit: www.cisco.com/go/vmworld09