- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
05-15-2018 11:04 PM
Hello,
In a "Supported Deployments on VMware vSphere Hypervisor (ESXi)" section of the documentation (https://www.paloaltonetworks.com/documentation/71/virtualization/virtualization/set-up-a-vm-series-f...) for VM series it is mentioned that VM Firewall can be deployed to control East-West traffic of VMs within the same ESXi host - "One variation of this use case is to also require all traffic to flow through the firewall, including server to server (east-west traffic) on the same ESXi host.". It is also mentioned that this is "(for environments that are not using VMware NSX)".
Can anybody, please, describe more detailed technically how to setup this? Thank you!
Hand
05-16-2018 06:50 AM
You would have to route all of the traffic from your VMs through the vm-firewall to get this to function properly. This deployment makes heavy use of virtual standard switches to get everything to route properly. I would recommend engaging your SE so that they can look at your existing enviroment and develop a deployment method that will work for you.
05-16-2018 07:04 AM
Hello,
One other thing you could try, could be a lot of work if you have a lot of servers, is to put them all in their own vlan. That way you cna use the PAN to control east-west traffic.
We have one zone setup, call it DMZ, and a bunch of /29 subnets. Since we dont allow inter-zone traffic, we have to have policies to allow traffic to flow between server subnets.
Hope that makes sense.
Regards,
05-30-2018 12:01 AM
Thank you, BPry!
If I understand correctly I have to connect each VM to separate virtual switch, right?
05-30-2018 12:06 AM
Yes, thanks! But this scenario is possible to implement with any firewall of any type. I thought there is a special case of being able to implement east-west control in a flexible way without using NSX.
Thanks!
05-30-2018 06:59 AM
Hello,
So NSX is just Software Defined Networking and is not required to have traffic flow through a firewall as you have mentioned. All of this is possible without the use of NSX as NSX is just an overlay to make it easier for an admin. As ou mentioned you can have a vswitch for each VM or subnet and have that traffic terminate on a firewall.
I hope this helps and doesnt confuse, as I might has misread your initial question.
Regards,
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!