topic NFFW virtual firewall ( formerly FTD) in Network Security

NFFW virtual firewall ( formerly FTD)

adamgibs7 — Fri, 18 Nov 2022 21:58:15 GMT

Dears

Please reply me with your experience

if i m not on a public cloud and completely on premises setup then any organization would require a virtual firewall in ESXI host ?? i think it is not required becz lets assume the vm on the esxi host all are in different subnet and to cross a subnet they need to go to the Default gateway which is physical firewall. ( Assuming ESXi host server is connected as an port channel to the switch and switch also is connected to firewall with ether channel)
how i can control VM traffic within the same vlan, Please correct me it has to be controlled by esxi host switch becz the traffic will never reach to firewall.

Thanks

Re: NFFW virtual firewall ( formerly FTD)

Rob Ingram — Fri, 18 Nov 2022 22:06:08 GMT

@adamgibs7 yes enterprise environments certainly would/could run a virtual environment in their ESX environment, it depends on the organisation requirements. The ESX server can have multiple interfaces, which are mapped to a different interface on the virtual firewall, so you can route through these interfaces, filtering traffic as required. One use organisations may use a virtual firewall is for a scalable remote access, adding virtual firewalls to scale out on demand.

Correct, a firewall will be no good filtering traffic inside the same VLAN, you'd rely on other solutions such as Private VLANs (PVLAN), Downloadable ACL (DACL) or ideally TrustSec SGTs.

Re: NFFW virtual firewall ( formerly FTD)

Kaan Bilici — Fri, 18 Nov 2022 22:08:11 GMT

Hi,

you can use FTDv its usefull solutions. you need to create a virtual switch on esxi host and port group for wan interface. and you need to create a port group on your default virtual switch witch 4095 vlan tag. all you need is to make these settings.

We use a lot of FTDv in customer systems due to problems with product supply.

Re: NFFW virtual firewall ( formerly FTD)

adamgibs7 — Sat, 19 Nov 2022 07:40:52 GMT

Dear Rob

thanks for the reply

The ESX server can have multiple interfaces, which are mapped to a different interface on the virtual firewall, so you can route through these interfaces, filtering traffic as required.

when can be the situation for the above sentence.

Regards

Re: NFFW virtual firewall ( formerly FTD)

Rob Ingram — Sat, 19 Nov 2022 09:27:26 GMT

@adamgibs7 what I am saying is you can deploy the virtual firewall and use a you would with a physical firewall.