ESXi on network edge

BoomAM · 19 Jan 2011 at 14:57

Afternoon all,
Im pondering the idea of creating a virtual TMG server to replace our flaky ISA box, with the idea being that one NIC on one of our ESXi servers would connect directly into our internet connection in the same way that our ISA does physically.

Is there any risk involved in this? As i cant find any good documentation on this particular usage of ESXi.

Thanks.

Skidilliplop · 19 Jan 2011 at 15:01

The Virtual networking within ESXi should allow this ok. You can create virtual switches to keep the net traffic well clear of your production traffic.

Do you run a hardware firewall that the ISA box plugs into or is it straight into the net?

BoomAM · 19 Jan 2011 at 15:11

Skidilliplop said:
The Virtual networking within ESXi should allow this ok. You can create virtual switches to keep the net traffic well clear of your production traffic.

Thought so, i created a new virtual network with one physical NIC binded to it.
Got the TMG box im building now with one NIC on that and one on the 'internal' network.
Was just curious as i know ESXi doesnt have a firewall on it like ESX does.

Do you run a hardware firewall that the ISA box plugs into or is it straight into the net?

Strait into the net.

Skidilliplop · 19 Jan 2011 at 15:34

I don't know if I'd e totally comfortable having a Box with multiple VMs on it directly connected to the public internet with nothing in the way.

It would PROBABLY be fine, but personally I'd always have a firewall of sorts in there to be sure.

madman045 · 19 Jan 2011 at 16:00

I would have a look at these links

They generally only recommend a single nic if you already have a firewall in place, otherwise you could expose all the VMs on the box to the internet

You would need to define virtual networks

http://technet.microsoft.com/en-us/edge/virtualize-your-isa-or-forefront-tmg-servers.aspx

http://technet.microsoft.com/en-us/library/cc891502.aspx

BoomAM · 19 Jan 2011 at 16:26

Separate networks are already defined....