![\"image\"](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2011\/10\/image3.png\" "\\"image\\"")
<\/a><\/p>\nNIC teaming can change things quite a bit if you have 2 pNICs for virtual switch traffic on the host (read the OEM\u2019s guidance). In the case of the HP Network Configuration Utility, you need to do something like this to maintain security:<\/p>\n
Both of those deal with traditional firewall and network isolation. But is that enough? The virtualisation guidance for Forefront Threat Management Gateway<\/a> (TMG – Microsoft\u2019s firewall solution) indicates that we have more thinking to do. Firewall and network isolation is not enough.<\/p>\n A distributed denial of service (DDOS) attack aims to disrupt or bring down an online service by flooding it with traffic of some kind. I\u2019ve seen one in action (against a small company in Ireland). They really are more common than you would think, small companies do get targeted (not just the big guys\/government), and you rarely hear about them. <\/p>\n The one I saw succeeded in bringing down the edge network devices, first one, and then the next in line when the defence\/attack were adjusted. That attack brought down dedicated network appliances. What if the appliances hadn\u2019t gone down. What was next in line? With the above two designs the next network device is either the pNICs in the host or the virtual switch in the host. The pNICs share traffic for internal (LAN) VMs and external (DMZ) VMs. If the NIC fails \u2013 everything loses communication and therefore the DDOS hits not just the online presence but the LAN VMs too. If the virtual switch is hit then we\u2019re looking at the CPU and RAM of the parent partition being stressed, and DMZ and<\/em> LAN traffic\/VMs experiencing downtime. We need physical isolation of LAN and DMZ in some fashion.<\/p>\n The cheapest solution would be to have dedicated NICs in the hosts: one for LAN traffic and one for DMZ traffic. This would allow a single host\/cluster to still run internal and external VMs but to isolate the impact of traffic at the NIC level (as below). At least now, if the online presence is hit by a DDOS attack then we\u2019ve limited the impact of the damage. In the below example, pNIC2 is the last physical device that can fail or be flooded. The VMs on pNIC1 are physically isolated from the DMZ and should be unaffected \u2026 of course that assumes that the virtual switch for the DMZ (on pNIC2) doesn\u2019t spike the CPU\/RAM of the parent partition \u2013 I actually have no idea what would happen in this case to be honest \u2013 my guess is that an edge network or the WAN connection would suffer first but I really do not know.<\/p>\n If your web presence is large enough, then maybe you can justify a dedicate Hyper-V host\/cluster for the edge network. The design would be something like below. This design is a take-no-chances solution that completely isolates everything. If the online presence in the DMZ is hit by a DDOS attack then there is not a single physical connection to the LAN Hyper-V hosts that should impact their normal operations within the LAN.<\/p>\n There is another benefit to this design approach too. The handful of security fixes for Hyper-V have been related to DDOS attacks from within<\/em> a compromised VM on a host. In other words, if a VM is compromised (for example, a hacker gains admin rights on a VM via a SQL injection attack or a WordPress website compromise), they can use their local log on in the VM to DDOS attack the host that the VM is on if<\/em> the relevant Hyper-V security fixes (as shared by MSFT via Windows Update) have not been applied. If you aren\u2019t quick about your updates you might<\/em> get hit by a zero day attack if you have the really bad luck of (a) not having the update deployed and (b) a hacker gaining logon rights on a VM. If that\u2019s the case \u2013 you know at least that all that the hacker can DDOS attack are the DMZ VMs that are on that particular DMZ host. And hopefully you\u2019ve been good with your network isolation, password rules, etc, to slow down the hacker, and maybe you have an IDS to detect their attempts to break out from that VM via the network.<\/p>\n Anyway, there\u2019s a few thoughts to keep you thinking.<\/p>\n The question of mixing internal and edge network virtual machines on a single Hyper-V host or cluster has popped up a number of times over the past few years. Businesses are under pressure to reduce costs, but there is that old issue of security. It\u2019s something I\u2019ve given consideration to over the past few weeks … Continue reading “Can I Mix LAN and DMZ\/Internet VMs On A Hyper-V Host\/Cluster?”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[20],"tags":[181,190,195,117],"class_list":["post-11847","post","type-post","status-publish","format-standard","hentry","category-hyper-v","tag-hyper-v","tag-security","tag-virtualisation","tag-windows-server-2008-r2"],"aioseo_notices":[],"jetpack_featured_media_url":"","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/11847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11847"}],"version-history":[{"count":0,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/11847\/revisions"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n