Micro segmentation/port isolation - what is the best way to go about this

K

Keeper of the Keys

Member
Jul 7, 2021
33
3
13
Hi,
We're experimenting with proxmox and I'm hoping I'll be able to bring it in to replace VMware.

One of the things I very much would like to do for "DMZ" servers is have microsegmentation/port-isolation (ie the only way for them to talk to other servers is through the firewall).

I could of course create a lot of vlans but that is not really scalable in the long run (since the number of vlans is limited to 4000, though I don't expect to have that many vms having a vlan per vm would still mean a ridiculous amount of management overhead).

So what is the best solution for such a thing? OpenVswitch? some other cool proxmox feature I don't know yet?
Thanks!
 
Keeper of the Keys said:
Hi,
We're experimenting with proxmox and I'm hoping I'll be able to bring it in to replace VMware.

One of the things I very much would like to do for "DMZ" servers is have microsegmentation/port-isolation (ie the only way for them to talk to other servers is through the firewall).

I could of course create a lot of vlans but that is not really scalable in the long run (since the number of vlans is limited to 4000, though I don't expect to have that many vms having a vlan per vm would still mean a ridiculous amount of management overhead).

So what is the best solution for such a thing? OpenVswitch? some other cool proxmox feature I don't know yet?
Thanks!
Click to expand...
proxmox firewall
 
spirit said:
proxmox firewall
Click to expand...
Using your firewall for micro-segmentation, turns your firewall into a bottleneck. The more you scale up your network, the bigger problem this becomes. At least, I'm pretty sure this is the case.

The other problem is management. Managing firewall rules with many small subnets quickly becomes a massive headache. Or so they say.
 
Last edited:
You must log in or register to reply here.
Top Bottom