Micro segmentation/port isolation - what is the best way to go about this

[Keeper of the Keys]

Hi,
We're experimenting with proxmox and I'm hoping I'll be able to bring it in to replace VMware.

One of the things I very much would like to do for "DMZ" servers is have microsegmentation/port-isolation (ie the only way for them to talk to other servers is through the firewall).

I could of course create a lot of vlans but that is not really scalable in the long run (since the number of vlans is limited to 4000, though I don't expect to have that many vms having a vlan per vm would still mean a ridiculous amount of management overhead).

So what is the best solution for such a thing? OpenVswitch? some other cool proxmox feature I don't know yet?
Thanks!

 

[Dunuin]

Maybe you could make use of the experimental software defined networks?
https://pve.proxmox.com/pve-docs/chapter-pvesdn.html

 

[spirit]

Hi,
We're experimenting with proxmox and I'm hoping I'll be able to bring it in to replace VMware.

One of the things I very much would like to do for "DMZ" servers is have microsegmentation/port-isolation (ie the only way for them to talk to other servers is through the firewall).

I could of course create a lot of vlans but that is not really scalable in the long run (since the number of vlans is limited to 4000, though I don't expect to have that many vms having a vlan per vm would still mean a ridiculous amount of management overhead).

So what is the best solution for such a thing? OpenVswitch? some other cool proxmox feature I don't know yet?
Thanks!

proxmox firewall

 

[Stereoscope]

proxmox firewall

Using your firewall for micro-segmentation, turns your firewall into a bottleneck. The more you scale up your network, the bigger problem this becomes. At least, I'm pretty sure this is the case.

The other problem is management. Managing firewall rules with many small subnets quickly becomes a massive headache. Or so they say.