02-23-2012 09:35 AM - edited 03-01-2019 10:17 AM
Up to now, we had a physically segmented network with internal and external different vtp domains/zones. Internal zone switches have a VLAN set, and external zone switches have a different VLAN set. VLANs are not propagated between different zones for security reasons, are isolated.
Currently, we just have started working with UCS+VMWARE, and we are facing some troubles. According to the previous model, if we virtualize servers within the internal zone in the UCS farm, we cannot virtualize servers within the external zone in the same UCS farm, since I would have to propagate external VLANs to the internal zone switches as well as to the UCS farm, mixing them. As a result of this, isolation would be lost.
I am trying to redesign all my core network, to adapt current infraestructure to the new one with UCS+VMWARE, without missing any point of security.
My major point, is to know whether it is posible to virtualize external and internal zone virtual machines in the same UCS farm, without compromising my network security.
Could you give me some advice or design guidelines?
Regards,
Solved! Go to Solution.
02-23-2012 06:53 PM
Hello -
You are correct that up through UCS 1.4 all VLANs needed to be available on the upstream switches. However, UCS 2.x introduced a feature named "Disjointed L2." Using this feature you will be able to connect the Fabric Interconnects to both your internal network & DMZ then provision those vlans to blades.
Matthew
02-23-2012 06:53 PM
Hello -
You are correct that up through UCS 1.4 all VLANs needed to be available on the upstream switches. However, UCS 2.x introduced a feature named "Disjointed L2." Using this feature you will be able to connect the Fabric Interconnects to both your internal network & DMZ then provision those vlans to blades.
Matthew
01-16-2013 01:58 AM
Hello -
How secure is UCS "disjointed L2" solution compare to traditional physically separated L2 domains i.e. DMZ and Back-end network?
02-23-2012 11:22 PM
It might be worthwhile exploring Nexus 1000V and specifically the VSG (Virtual Security Gateway) which targets the ability to provide more granular security within a VMWare virtualised environment.
---
Posted by WebUser Adriaan Steyn
02-24-2012 01:33 AM
Thank you. I greatly appreciate your usefull contributions.
Regards,
07-13-2018 06:26 PM
I have a UCS mini, and I do not know what version I have.
a. How do I check the version?
b. How can I upgrade if i am not on the right version?
I am using a Nexus 3000 as my fabric switch to the rest of the network, and i have a 9300 I will also have available for the server cabinet. Can I make this happen or will i need a virtual switch like a Nexus 1000 appliance on my VMware environment. Also not a Cisco engineer.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide