“The Scary Side of Virtualization.” That’s the title of Computerworld’s November 8 cover story that exposed a few “gotchas” to be aware of when virtualizing servers.
Is virtualization scary? Well, the article discusses several concerns, one of which is the co-mingling of data that should otherwise reside on physically separate networks.
That data must be protected. VLANs provide one way to maintain network separation, but Gartner analyst Neil MacDonald states in the article that “VLANs and router-based access controls alone are not sufficient for security separation.”
Yikes! No wonder one user, Jai Chanini of Rent-a-Center, comments that “for security reasons” his shop does not virtualize apps such as ERP, DB, or email.
Virtual I/O Eliminates the Fear Factor
Fortunately, virtual I/O provides a solution that retains the network isolation of a physical connection, without sacrificing real-time management flexibility. It lets you create isolated “virtual” connections that function exactly like a cable from the server to a specific network.
Here’s how it works.
- Create a vNIC in a server: The hypervisor views that vNIC as a standalone entity, just like a physical card.
- Create a vitual switch that is connected to that vNIC: In this example, virtual machine “A” sees only data from vNIC “A”.
- Associate that vNIC with a port on the I/O Director: Data from that vNIC then goes to that port and that port only.
- Connect a network to that port: In this example, data from Network “A” goes only to VM “A”. It has no path to VM “B”.
Even though VM A and VM B share a physical path from the server to the I/O Director, data from those VMs is available only at the assigned ports. It cannot be snooped on other ports, and there is no reliance on VLANs.
Isolation is the same as a physical link, but a lot more flexible. Should a server goes down, or if you want to move an application from one server to another, the virtual NICs and HBAs can be moved from that server to another device… and you still retain the original isolation.
If this sounds like something that could help you sleep at night, drop me a note and I’ll send you a white paper about exactly how this network isolation works. We have numerous customers who have virtualized their most mission-critical apps. And some of those guys are among the most security-conscious organizations in the world. If they’re not scared by this, you shouldn’t be either.