PAN Microsegmentation of DMZ

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

PAN Microsegmentation of DMZ

L3 Networker

I am spinning up a new DMZ and wonder if there was a some means of restricting traffic between hosts on the DMZ using the PAN. 
I have a Cisco Nexus switch and the hosts are VMs in Cisco UCS. Thank you.

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hello,

This is somewhat limited due to architecture. The VM's live on 'dumb' layer 2 virtual switches, so even if the vlan gateway was the PAN, two VM's on the same host could talk to each other since they are on the same vlan on the same switch. I hope this makes sense. There are more complicated ways of doing this, i.e. one server per vlan (ouch), using global protect with always on to it forces all the traffic to go through the PAN, or some other software defined networking solution. I tend to group servers based on function/criticality, so its OK for two or more servers to live in the same vlan as long as they are locked down locally. You can also use the local firewalls of the servers to block traffic between them.

 

Its not a one size fits all architecture. The larger it is the more one solution is feasible over others.

 

Hope that makes sense.

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

Hello,

This is somewhat limited due to architecture. The VM's live on 'dumb' layer 2 virtual switches, so even if the vlan gateway was the PAN, two VM's on the same host could talk to each other since they are on the same vlan on the same switch. I hope this makes sense. There are more complicated ways of doing this, i.e. one server per vlan (ouch), using global protect with always on to it forces all the traffic to go through the PAN, or some other software defined networking solution. I tend to group servers based on function/criticality, so its OK for two or more servers to live in the same vlan as long as they are locked down locally. You can also use the local firewalls of the servers to block traffic between them.

 

Its not a one size fits all architecture. The larger it is the more one solution is feasible over others.

 

Hope that makes sense.

Thank you. That's how I thought it would work. I appreciate the confirmation.

  • 1 accepted solution
  • 1854 Views
  • 2 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!