VSG and Virtual Network firewalling

[dani_bosch]

Hello,

Just a basic doubt: as per Virtual network firewalling (like VSG or vShield), I assume that we only need a virtual firewall when very different VM's or tennants share the same L2 domain, right?...otherwise (when these different security domains have different L2 domains), one already has physical firewalling in place on the physical L3 layer.

Am I wrong?

Thanks,

[dani_bosch]

Any inputs, please?

[Robert Burns · Accepted solution]

Correct.  The VSG & vShield are position to mainly protect L2 communication or Intra-ESX VM communication where the networking traffic may never leave the host/hypervisor.

Regards,

Robert