I was asked today about using (W2008 R2 SP1 Hyper-V) Dynamic Memory and Forefront Threat Management Gateway (TMG). To be honest, I hadn\u2019t looked at TMG on virtualisation before \u2013 Microsoft has a huge product catalogue.<\/p>\n
I searched, and found a long and detailed article<\/a> on the subject. The guidance starts with understanding the network role of the TMG installation in question. That means understanding workloads (network and server) that the VM will be handling. This leads to some general TMG configurations, which will obviously affect resource requirements and performance. We are reminded that the TMG VM will be sharing a host with other VM workloads, and therefore a spiking TMG VM could affect resource utilisation of other VMs. Consider this when sizing hosts or placing virtual machines. The TMG group recommends doing a 2 week proof-of-concept or assessment to gather empirical data for this sizing process. TMG will eat CPU and memory.<\/p>\n Speaking of memory, a SQL back end is used for logging. This is normally an Express install. This edition (at the moment) doesn\u2019t have the ability to deal with expanding memory such as Hyper-V Dynamic Memory. The minimum RAM for TMG is 2 GB. Well, SQL Express has a \u201cone GB memory limit for the buffer pool\u201d<\/em><\/a>. <\/em>If you decide you must enable DM on your TMG VM(s), then maybe you should set the start up memory setting for a TMG VM to 2048 MB. That will leave SQL Express in a healthy state in terms of memory (knowing how much to take at startup) and will ensure that TMG always has the minimum required. You can set your maximum memory setting to what you find is required after your assessment.<\/p>\n Physical networking is discussed. Any VLANing or DMZ\/edge network designs for a physical installation should still apply. Don\u2019t<\/em> redesign or compromise the network design to suit virtualisation; do<\/em> redesign the virtualisation hosts to suit the network and security requirements.<\/p>\n Ideally, a host used for providing capacity to network security VMs should not run other VM roles, e.g. you ideally won\u2019t mix Exchange VMs and TMG VMs on the same host. But hey, sounds great in mid\/enterprise environments but a bit pricey for SMEs.<\/p>\n There\u2019s lots of advice on lock down policies, patching, and enabling BitLocker on the parent partition. And of course, only provide access to the parent partition as and when is (business critically) required.<\/p>\n An interesting one which might answer many forum questions, the TMG group recommends that internal and external virtual NICs should not share virtual switches. That means you should ideally use different physical NICs for those networks, and maybe<\/em> use different virtual NICs that are created by your network provider (e.g. Broadcom, HP NCU, etc).<\/p>\n There is a reminder to disable everything except the virtual switch protocol in the parent partition NICs that are used for external virtual switches.<\/p>\n You should have a way to log into or manage\/monitor the parent partition separately from the virtual machine workloads. In other words, have a dedicated parent partition physical network card that is not used by virtual networks. This will allow you to manage the parent partition and it\u2019s other workloads if something like a DOS attack happens and the internet facing NIC for the TMG VM is being hammered.<\/p>\n For your virtual machine disks, it is recommended that you place OS, SQL logs on different drives. If you are using host server internal disks then you\u2019ll need to create different LUNs. Things aren\u2019t that simple in a SAN where virtual disk systems are used, because different LUNs are actually striped across the same disks in the disk group. I\u2019d consider a CSV with all VHDs on there. And then you get into the normal CSV\/backup design decision making process. Remember to keep IOPS requirements (from the assessment) in mind.<\/p>\n The article<\/a> ends with a discussion of various virtual networking designs and how they will impact on the performance of your TMG VM.<\/p>\n I was asked today about using (W2008 R2 SP1 Hyper-V) Dynamic Memory and Forefront Threat Management Gateway (TMG). To be honest, I hadn\u2019t looked at TMG on virtualisation before \u2013 Microsoft has a huge product catalogue. I searched, and found a long and detailed article on the subject. The guidance starts with understanding the network … Continue reading “Forefront TMG (or any Firewall) & Virtualisation”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[20],"tags":[179,181,190,195],"class_list":["post-11237","post","type-post","status-publish","format-standard","hentry","category-hyper-v","tag-forefront","tag-hyper-v","tag-security","tag-virtualisation"],"aioseo_notices":[],"jetpack_featured_media_url":"","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/11237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11237"}],"version-history":[{"count":0,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/11237\/revisions"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}