ASP Developer Network - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com

ASPDeveloper

ASPDeveloper.Net / VirtualServerFAQ.COM

Make sure you go to our home page for:

* Virtual Server 2005 FAQ
* ASP.Net 2.0 Information
* ASP.Net 2.0 Streaming Tutorials
* ASP.Net 2.0 HTML based Tutorials

Made possible by Business Internet Technology Shop (BitShop)

Virtual Server 2005

Recent Virtual Server 2005 posts

* Host and Guest OS Stop Responding (freeze, halt, hang up)
* Accessing Virtual Machine via Remote Desktop or Terminal Server
* Virtual Server and SX Virtual Link
* Attach VHD with VUD
* Writing a script to perform a "complete" backup
* VS2005 R2 Admin Website very slow on Windows XP
* Longhorn Cluster on Virtual SErver 2005 R2
* securely routing traffic to virtual server
* Virtual server Networking question
* Migrating a physical server as VM
* can i create undo disk in different location
* VS 2005 R2 SP1 on x64 not working
* CPU Allocation Problems
* Quad Core Processor and production Terminal Server"s in VS? HELP!
* naive question on virtual server 2005 R2
* VMs auto-restarting on host reboot
* Windows xp virtual slow
* W2K Server as Host OS
* VHD Resizer tool updated
* Move undo disks

Add Solution

Segment a physical VS between intranet and DMZ

Source: microsoft.public.virtualserver
Sent: 03/20/2007
From: "David" <(email address - cut out)ail>
Message:

We want to run a VS with one nic in a DMZ (with no IP presented on host OS)
and one nic in the intranet. We then will run a number of VS OS which are
either bound to dmz nic or the intranet nic to provide servers logically
assigned to either the dmz or intranet zone. In terms of security and
sandboxing etc is this ok?
Thanks
David

Post Reply | This is Spam! | Mark as Spam

Related Messages

Re: Segment a physical VS between intranet and DMZ

Sent: 03/20/2007
From: "Sylvain Lafontaine" <sylvain aei ca (fill the blanks, no spam please)>
Message:

Even if there is no IP directly presented to the host OS for the first nic,
are you sure that there will be absolutely no possibility of any tcp/ip
connection/communication via a loopback such as the router between the host
and one of his guest?

--
Sylvain Lafontaine, ing.
MVP - Technologies Virtual-PC
E-mail: sylvain aei ca (fill the blanks, no spam please)

"David" <(email address - cut out)ail> wrote in message
news:(email address - cut out)...

Show quoted text

> We want to run a VS with one nic in a DMZ (with no IP presented on host
> OS) and one nic in the intranet. We then will run a number of VS OS which
> are either bound to dmz nic or the intranet nic to provide servers
> logically assigned to either the dmz or intranet zone. In terms of
> security and sandboxing etc is this ok?
> Thanks
> David
>

Re: Segment a physical VS between intranet and DMZ

Sent: 03/21/2007
From: "David" <(email address - cut out)ail>
Message:

Thanks for your replies. Must admit I don't understand the router loopback
concern (mac addresses are unique for each guest OS as far as I'm aware).
My understanding is that we would need:
DMZ nic: Virtual Machine Network Services
Intranet nic: Virtual Machine Network Services and TCP/IP protocol to get
critical updates and faciltate terminal services admin sessions.
Is this ok?
Thanks
David

"Bill Grant" <not.available@online> wrote in message
news:(email address - cut out)...

Show quoted text

> That would be OK as long as these are the only network connections to
> the host machine. As Sylvain points out, you need to ensure that there is
> no other possible link between the host and a guest which could
> short-circuit the separation.
>
> If these are the only connections, it should work OK. On both NICs,
> disable everything except Virtual Machine Network Services on the host
> side. This will isolate the host from the NICs.
>
> From there on you should be able to link vms to one or other of the
> virtual networks associated with the physical NICs.
>
>
> "David" <(email address - cut out)ail> wrote in message
> news:(email address - cut out)...
>> We want to run a VS with one nic in a DMZ (with no IP presented on host
>> OS) and one nic in the intranet. We then will run a number of VS OS
>> which are either bound to dmz nic or the intranet nic to provide servers
>> logically assigned to either the dmz or intranet zone. In terms of
>> security and sandboxing etc is this ok?
>> Thanks
>> David
>>
>
>

Re: Segment a physical VS between intranet and DMZ

Sent: 03/21/2007
From: "Sylvain Lafontaine" <sylvain aei ca (fill the blanks, no spam please)>
Message:

I'm not a network specialist but a quick test you could to would be to see
if you can ping the host from the guest and vice-versa. If you can, then
you can be sure that you are providing no isolation at all; if you can't,
then the situation looks much better.

--
Sylvain Lafontaine, ing.
MVP - Technologies Virtual-PC
E-mail: sylvain aei ca (fill the blanks, no spam please)

"David" <(email address - cut out)ail> wrote in message
news:(email address - cut out)...

Show quoted text

> Thanks for your replies. Must admit I don't understand the router loopback
> concern (mac addresses are unique for each guest OS as far as I'm aware).
> My understanding is that we would need:
> DMZ nic: Virtual Machine Network Services
> Intranet nic: Virtual Machine Network Services and TCP/IP protocol to get
> critical updates and faciltate terminal services admin sessions.
> Is this ok?
> Thanks
> David
>
>
>
>
> "Bill Grant" <not.available@online> wrote in message
> news:(email address - cut out)...
>> That would be OK as long as these are the only network connections to
>> the host machine. As Sylvain points out, you need to ensure that there is
>> no other possible link between the host and a guest which could
>> short-circuit the separation.
>>
>> If these are the only connections, it should work OK. On both NICs,
>> disable everything except Virtual Machine Network Services on the host
>> side. This will isolate the host from the NICs.
>>
>> From there on you should be able to link vms to one or other of the
>> virtual networks associated with the physical NICs.
>>
>>
>> "David" <(email address - cut out)ail> wrote in message
>> news:(email address - cut out)...
>>> We want to run a VS with one nic in a DMZ (with no IP presented on host
>>> OS) and one nic in the intranet. We then will run a number of VS OS
>>> which are either bound to dmz nic or the intranet nic to provide servers
>>> logically assigned to either the dmz or intranet zone. In terms of
>>> security and sandboxing etc is this ok?
>>> Thanks
>>> David
>>>
>>
>>
>
>

Re: Segment a physical VS between intranet and DMZ

Sent: 03/21/2007
From: "Bill Grant" <not.available@online>
Message:

That would be OK as long as these are the only network connections to the
host machine. As Sylvain points out, you need to ensure that there is no
other possible link between the host and a guest which could short-circuit
the separation.

If these are the only connections, it should work OK. On both NICs,
disable everything except Virtual Machine Network Services on the host side.
This will isolate the host from the NICs.

From there on you should be able to link vms to one or other of the
virtual networks associated with the physical NICs.

"David" <(email address - cut out)ail> wrote in message
news:(email address - cut out)...

Show quoted text

Re: Segment a physical VS between intranet and DMZ

Sent: 03/22/2007
From: "Bill Grant" <not.available@online>
Message:

That is only the case if you want to make the host part of you local
(intranet) network. I prefer to keep the host machine isolated from both
virtual networks. Regard the host as an engine which powers the vms rather
than a server on your network.

What exactly are you trying to simulate here? Is the vm to act as a
router/firewall between the DMZ and intranet, or are you simply trying to
add extra servers to an existing DMZ/intranet setup?

"David" <(email address - cut out)ail> wrote in message
news:(email address - cut out)...

Show quoted text

Re: Segment a physical VS between intranet and DMZ

Sent: 03/22/2007
From: "David" <(email address - cut out)ail>
Message:

It is all based on server consolidation. We want the VS host to provide
different VS clients some to the dmz and some to the intranet (but no
clients to have both nics enabled). The host should *not* do any routing
between the DMZ and the intranet. But we need to update it (crtical
updates) so we must surely have TCP/IP enabled on at least one host nic
(intranet).
Thanks
David

"Bill Grant" <not.available@online> wrote in message
news:(email address - cut out)...

Show quoted text

> That is only the case if you want to make the host part of you local
> (intranet) network. I prefer to keep the host machine isolated from both
> virtual networks. Regard the host as an engine which powers the vms rather
> than a server on your network.
>
> What exactly are you trying to simulate here? Is the vm to act as a
> router/firewall between the DMZ and intranet, or are you simply trying to
> add extra servers to an existing DMZ/intranet setup?
>
> "David" <(email address - cut out)ail> wrote in message
> news:(email address - cut out)...
>> Thanks for your replies. Must admit I don't understand the router
>> loopback concern (mac addresses are unique for each guest OS as far as
>> I'm aware). My understanding is that we would need:
>> DMZ nic: Virtual Machine Network Services
>> Intranet nic: Virtual Machine Network Services and TCP/IP protocol to get
>> critical updates and faciltate terminal services admin sessions.
>> Is this ok?
>> Thanks
>> David
>>
>>
>>
>>
>> "Bill Grant" <not.available@online> wrote in message
>> news:(email address - cut out)...
>>> That would be OK as long as these are the only network connections to
>>> the host machine. As Sylvain points out, you need to ensure that there
>>> is no other possible link between the host and a guest which could
>>> short-circuit the separation.
>>>
>>> If these are the only connections, it should work OK. On both NICs,
>>> disable everything except Virtual Machine Network Services on the host
>>> side. This will isolate the host from the NICs.
>>>
>>> From there on you should be able to link vms to one or other of the
>>> virtual networks associated with the physical NICs.
>>>
>>>
>>> "David" <(email address - cut out)ail> wrote in message
>>> news:(email address - cut out)...
>>>> We want to run a VS with one nic in a DMZ (with no IP presented on host
>>>> OS) and one nic in the intranet. We then will run a number of VS OS
>>>> which are either bound to dmz nic or the intranet nic to provide
>>>> servers logically assigned to either the dmz or intranet zone. In
>>>> terms of security and sandboxing etc is this ok?
>>>> Thanks
>>>> David
>>>>
>>>
>>>
>>
>>
>
>

Re: Segment a physical VS between intranet and DMZ

Sent: 03/23/2007
From: "Bill Grant" <not.available@online>
Message:

You could always use a third NIC in the host which has VMNS disabled.
This NIC would then be dedicated to the host while the other two were
dedicated to the two virtual networks.

You can certainly have the host machine linked to the same network as
the intranet machines as you described earlier. It is just a personal
preference of mine to keep the host isolated from the "virtual" networks.

"David" <(email address - cut out)ail> wrote in message
news:(email address - cut out)...

Show quoted text

> It is all based on server consolidation. We want the VS host to provide
> different VS clients some to the dmz and some to the intranet (but no
> clients to have both nics enabled). The host should *not* do any routing
> between the DMZ and the intranet. But we need to update it (crtical
> updates) so we must surely have TCP/IP enabled on at least one host nic
> (intranet).
> Thanks
> David
>
>
> "Bill Grant" <not.available@online> wrote in message
> news:(email address - cut out)...
>> That is only the case if you want to make the host part of you local
>> (intranet) network. I prefer to keep the host machine isolated from both
>> virtual networks. Regard the host as an engine which powers the vms
>> rather than a server on your network.
>>
>> What exactly are you trying to simulate here? Is the vm to act as a
>> router/firewall between the DMZ and intranet, or are you simply trying to
>> add extra servers to an existing DMZ/intranet setup?
>>
>> "David" <(email address - cut out)ail> wrote in message
>> news:(email address - cut out)...
>>> Thanks for your replies. Must admit I don't understand the router
>>> loopback concern (mac addresses are unique for each guest OS as far as
>>> I'm aware). My understanding is that we would need:
>>> DMZ nic: Virtual Machine Network Services
>>> Intranet nic: Virtual Machine Network Services and TCP/IP protocol to
>>> get critical updates and faciltate terminal services admin sessions.
>>> Is this ok?
>>> Thanks
>>> David
>>>
>>>
>>>
>>>
>>> "Bill Grant" <not.available@online> wrote in message
>>> news:(email address - cut out)...
>>>> That would be OK as long as these are the only network connections to
>>>> the host machine. As Sylvain points out, you need to ensure that there
>>>> is no other possible link between the host and a guest which could
>>>> short-circuit the separation.
>>>>
>>>> If these are the only connections, it should work OK. On both NICs,
>>>> disable everything except Virtual Machine Network Services on the host
>>>> side. This will isolate the host from the NICs.
>>>>
>>>> From there on you should be able to link vms to one or other of the
>>>> virtual networks associated with the physical NICs.
>>>>
>>>>
>>>> "David" <(email address - cut out)ail> wrote in message
>>>> news:(email address - cut out)...
>>>>> We want to run a VS with one nic in a DMZ (with no IP presented on
>>>>> host OS) and one nic in the intranet. We then will run a number of VS
>>>>> OS which are either bound to dmz nic or the intranet nic to provide
>>>>> servers logically assigned to either the dmz or intranet zone. In
>>>>> terms of security and sandboxing etc is this ok?
>>>>> Thanks
>>>>> David
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>

Post Reply | This is Spam! | Mark as Spam

Other groups

Virtual PC (Mac)(3592)	Virtual PC(12844)	Virtual PC (French)(496)
Virtual Server 2005(6245)

Our Sponsors

Virtual Server 2005 Info Here!
http://www.aspdeveloper.net

Wiki

Blogs

Articles

Image galleries

File galleries

Forums

Maps

Directories

ASP Developer Network (since 1996) - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com
Copyright © 1997-2005 by BitShop, Inc. All Rights Reserved.
No content may be reproduced in any form without written permission from BitShop, Inc.
We will be honored to assist with reproduction rights on our material if you contact us.
We also can provide print articles for your magazine, private training seminars at your site, and conference presentations.
Thank you for visiting. Please bookmark our site if you found it useful!
If you wish to make a donation it will help further the development of these free resources: