topic Re: Controling East-West traffic without NSX in General Topics

Controling East-West traffic without NSX

handshake — Wed, 16 May 2018 06:04:24 GMT

Hello,

In a "Supported Deployments on VMware vSphere Hypervisor (ESXi)" section of the documentation (https://www.paloaltonetworks.com/documentation/71/virtualization/virtualization/set-up-a-vm-series-firewall-on-an-esxi-server/supported-deployments-on-vmware-vsphere-hypervisor-esxi#_92501) for VM series it is mentioned that VM Firewall can be deployed to control East-West traffic of VMs within the same ESXi host - "One variation of this use case is to also require all traffic to flow through the firewall, including server to server (east-west traffic) on the same ESXi host.". It is also mentioned that this is "(for environments that are not using VMware NSX)".

Can anybody, please, describe more detailed technically how to setup this? Thank you!

Hand

Re: Controling East-West traffic without NSX

BPry — Wed, 16 May 2018 13:50:33 GMT

@handshake,

You would have to route all of the traffic from your VMs through the vm-firewall to get this to function properly. This deployment makes heavy use of virtual standard switches to get everything to route properly. I would recommend engaging your SE so that they can look at your existing enviroment and develop a deployment method that will work for you.

Re: Controling East-West traffic without NSX

OtakarKlier — Wed, 16 May 2018 14:04:42 GMT

Hello,

One other thing you could try, could be a lot of work if you have a lot of servers, is to put them all in their own vlan. That way you cna use the PAN to control east-west traffic.

We have one zone setup, call it DMZ, and a bunch of /29 subnets. Since we dont allow inter-zone traffic, we have to have policies to allow traffic to flow between server subnets.

Hope that makes sense.

Regards,

Re: Controling East-West traffic without NSX

handshake — Wed, 30 May 2018 07:01:58 GMT

Thank you, BPry!

If I understand correctly I have to connect each VM to separate virtual switch, right?

Re: Controling East-West traffic without NSX

handshake — Wed, 30 May 2018 07:06:37 GMT

@OtakarKlier

Yes, thanks! But this scenario is possible to implement with any firewall of any type. I thought there is a special case of being able to implement east-west control in a flexible way without using NSX.

Thanks!

Re: Controling East-West traffic without NSX

OtakarKlier — Wed, 30 May 2018 13:59:29 GMT

Hello,

So NSX is just Software Defined Networking and is not required to have traffic flow through a firewall as you have mentioned. All of this is possible without the use of NSX as NSX is just an overlay to make it easier for an admin. As ou mentioned you can have a vswitch for each VM or subnet and have that traffic terminate on a firewall.

https://www.paloaltonetworks.com/documentation/71/virtualization/virtualization/set-up-a-vm-series-nsx-edition-firewall/how-do-the-components-in-the-nsx-edition-solution-work-together

I hope this helps and doesnt confuse, as I might has misread your initial question.

Regards,