Controling East-West traffic without NSX

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Controling East-West traffic without NSX

L1 Bithead

Hello,

In a "Supported Deployments on VMware vSphere Hypervisor (ESXi)" section of the documentation (https://www.paloaltonetworks.com/documentation/71/virtualization/virtualization/set-up-a-vm-series-f...) for VM series it is mentioned that VM Firewall can be deployed to control East-West traffic of VMs within the same ESXi host - "One variation of this use case is to also require all traffic to flow through the firewall, including server to server (east-west traffic) on the same ESXi host.". It is also mentioned that this is "(for environments that are not using VMware NSX)".

 

Can anybody, please, describe more detailed technically how to setup this? Thank you!

Hand

5 REPLIES 5

Cyber Elite
Cyber Elite

@handshake,

You would have to route all of the traffic from your VMs through the vm-firewall to get this to function properly. This deployment makes heavy use of virtual standard switches to get everything to route properly. I would recommend engaging your SE so that they can look at your existing enviroment and develop a deployment method that will work for you. 

Hello,

One other thing you could try, could be a lot of work if you have a lot of servers, is to put them all in their own vlan. That way you cna use the PAN to control east-west traffic. 

 

We have one zone setup, call it DMZ, and a bunch of /29 subnets. Since we dont allow inter-zone traffic, we have to have policies to allow traffic to flow between server subnets.

 

Hope that makes sense.

 

Regards,

Thank you, BPry!

If I understand correctly I have to connect each VM to separate virtual switch, right? 

@OtakarKlier

Yes, thanks! But this scenario is possible to implement with any firewall of any type. I thought there is a special case of being able to implement east-west control in a flexible way without using NSX.

 

Thanks!

Hello,

So NSX is just Software Defined Networking and is not required to have traffic flow through a firewall as you have mentioned. All of this is possible without the use of NSX as NSX is just an overlay to make it easier for an admin. As ou mentioned you can have a vswitch for each VM or subnet and have that traffic terminate on a firewall.

 

https://www.paloaltonetworks.com/documentation/71/virtualization/virtualization/set-up-a-vm-series-n...

 

I hope this helps and doesnt confuse, as I might has misread your initial question.

 

Regards,

  • 2772 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!