01-05-2022 01:38 PM
I am spinning up a new DMZ and wonder if there was a some means of restricting traffic between hosts on the DMZ using the PAN.
I have a Cisco Nexus switch and the hosts are VMs in Cisco UCS. Thank you.
01-05-2022 02:03 PM
Hello,
This is somewhat limited due to architecture. The VM's live on 'dumb' layer 2 virtual switches, so even if the vlan gateway was the PAN, two VM's on the same host could talk to each other since they are on the same vlan on the same switch. I hope this makes sense. There are more complicated ways of doing this, i.e. one server per vlan (ouch), using global protect with always on to it forces all the traffic to go through the PAN, or some other software defined networking solution. I tend to group servers based on function/criticality, so its OK for two or more servers to live in the same vlan as long as they are locked down locally. You can also use the local firewalls of the servers to block traffic between them.
Its not a one size fits all architecture. The larger it is the more one solution is feasible over others.
Hope that makes sense.
01-05-2022 02:03 PM
Hello,
This is somewhat limited due to architecture. The VM's live on 'dumb' layer 2 virtual switches, so even if the vlan gateway was the PAN, two VM's on the same host could talk to each other since they are on the same vlan on the same switch. I hope this makes sense. There are more complicated ways of doing this, i.e. one server per vlan (ouch), using global protect with always on to it forces all the traffic to go through the PAN, or some other software defined networking solution. I tend to group servers based on function/criticality, so its OK for two or more servers to live in the same vlan as long as they are locked down locally. You can also use the local firewalls of the servers to block traffic between them.
Its not a one size fits all architecture. The larger it is the more one solution is feasible over others.
Hope that makes sense.
01-05-2022 02:08 PM
Thank you. That's how I thought it would work. I appreciate the confirmation.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
