Ah right so similar to what I've seen/used before then in a virtual ips appliance.
But from what I can tell what I've used in the past hasn't linked with the vms directly via an api, it really is just a virtual device with 2 virtual interfaces to inspect any traffic passing through it, exactly the same as a physical network IPS, that you plonk where ever on the virtual network.
In my demo environment I have a virtual ips device with one interface connected to a virtual switch that has access to outside of the virtual environment, and the other interface connected to a different virtual switch that doesn't have the external access, but is where my 'internal' vms sit.
Thus any traffic going into and out of the virtual machines network zone is inspected, does the job for a test environment.
Guess the thing I need to read up on is whether the api hooking part of things provides much benefit or not, as the virtual appliances I've used will inspect any traffic passing through them.
From a pricing point of view the method I'm used too could be beneficial, you're not licensed by how many machines are behind the appliance, just on how many appliances you use. But do you lose out on enough to warrant the increase in costs by licensing per host?
