The Virtualization Room


September 28, 2007  11:17 AM

VMware clarifies stance on virtual switch security

Bridget Botelho Profile: Bridget Botelho

Following the launch of the article “VMware dispels virtualization myths (sort of),” VMware emailed me to correct some issues about virtual machine security.

According to VMware, an “incorrect statement” was made by Burton Group Analyst Chris Wolf, who, like all of the engineers at VMware he’s spoke with, he thought to be correct.

In the article, Wolf said, “one significant issue with virtual machine security is with virtual switch isolation. The current all-or-nothing approach to making a virtual switch ‘promiscuous’ in order to connect it to an IDS/IPS is not favorable to security.”

For example, “if you connect an IDS appliance to a virtual switch in promiscuous mode,” Wolf said, “not only can the IDS capture all of the traffic traversing the switch, but every other VM on the same virtual switch in promiscuous mode could capture each other’s traffic as well.”

This statement ruffled some feathers at VMware, and they quickly emailed me and Burton to “educate us” and the VMware community that in fact, VMware allows (and encourages) users to configure only the ports they need to be promiscuous as such. This is not a per vswitch setting, but rather a per portgroup setting. The way to configure a vswitch for IDS/IPS is to create a separate portgroup from those used for normal VMs and configure it for “Promiscuous Allowed,” a VMware spokesperson said.

After testing this out in his own lab, Wolf said it is really an easy solution, because the architecture is already there.

“At the switch level, promiscuous mode is an all or nothing configuration. VMware doesn’t argue this. However, a way around this issue is by configuring a separate port group on a virtual switch just for the IDS and making the port group promiscuous. That allows the IDS to monitor the vswitch traffic and still keep all other traffic isolated,” Wolf learned from VMware.

“So, with the port group feature it isn’t all or nothing, it can be granular,” Wolf said. That said, “Vmware’s own team wasn’t even aware of this,” therefore it’s unlikely many VMware administrators are either, he said.

So the record stands corrected. “The option of making a virtual switch ‘promiscuous’ in order to connect it to an IDS/IPS is not favorable to security and should never be used,” Wolf said. Instead, administrators should create a dedicated port group on the switch for the IDS and only make the IDS port group promiscuous. This would allow the IDS to monitor all unicast traffic on the switch while preventing all other VMs on the virtual switch from seeing each other’s unicast traffic.”

September 13, 2007  11:02 PM

Can virtualization stay sexy in 2.0 era?

Ryan Shopp Ryan Shopp Profile: Ryan Shopp

Developments at VMworld 2007 show that virtualization 2.0 has arrived, says Burton Group analyst Andrew Kutz. But can virtualization stay sexy when it is mainstream?


September 13, 2007  9:30 PM

VMworld’s scale wows VMware CEO Diane Greene

Ryan Shopp Ryan Shopp Profile: Ryan Shopp

VMware CEO Diane Greene says VMworld 2007 wowed her with innovation and enormous vendor and user participation.


September 13, 2007  9:29 PM

Virtualization 2.0 started at VMworld 2007, analyst says

Ryan Shopp Ryan Shopp Profile: Ryan Shopp

Analyst Barb Goldworm explains why VMworld 2007 ushered in a new era in virtualization.


September 13, 2007  9:28 PM

VMworld Awards: Printing for the virtual computing age

Ryan Shopp Ryan Shopp Profile: Ryan Shopp

Good-bye to pesky print drivers, hello to virtual printing. ThinPrint’s VDI-focused printing approach won recognition in the SearchServerVirtualization.com VMworld Awards’ Utilities category.


September 13, 2007  9:27 PM

How new InovaWave technology tackles virtualization I/O

Ryan Shopp Ryan Shopp Profile: Ryan Shopp

InovaWave CEO Chris Ostertag describes virtualization’s I/O problems and how InovaWave VirtualOctane for ESX Server could solve them. The soon-to-be release product won a SearchServerVirtualization.com VMworld Award for Best New Technology.


September 13, 2007  9:26 PM

Problem-solving leads Akorri to VMworld Award

Ryan Shopp Ryan Shopp Profile: Ryan Shopp

Akorri founder and CTO Richard Corley describes the virtualization management problems solved by Akorri BalancePoint 1.7, which won SearchServerVirtualization.com’s VMworld Award in the performance monitoring and optimization category.


September 13, 2007  9:25 PM

How Onaro, VMworld Award winner, aids VMware ESX deployments

Ryan Shopp Ryan Shopp Profile: Ryan Shopp

Onaro’s Bryan Semple describes a new product that brings storage and server teams together to deploy ESX.


September 13, 2007  10:57 AM

See VMworld: Get bags of swag

Ryan Shopp Ryan Shopp Profile: Ryan Shopp

The sheer bulk of giveaways at VMworld 2007 overwhelm SearchServerVirtualization.com’s intrepid and swag-seeking editors, Bridget Botelho and Jan Stafford.


September 13, 2007  10:56 AM

Analyst’s top VMworld picks: Cisco, open VM format

Ryan Shopp Ryan Shopp Profile: Ryan Shopp

News about Cisco’s new architecture and an open virtual machine format are the VMworld news of note for Burton Group senior analyst Chris Wolf.


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: