On Thursday, 01/08/2009 at 06:09 EST, KEETON Dave * SDC <[email protected]> wrote:
> Scenario: If you had an environment that consisted of Administration, > Production networks and you wanted a guest to participate in both, > wouldn't you just create two VLAN memberships to eth0 (ala vconfig)? Or > would it be prudent to create a separate VSWITCH for Administration and > Production and use eth0 and eth1 nics (using the PORTTYPE ACCESS > method)? This will be driven by your Networking folks. If they would normally configure a trunk port for a distributed system, then it's ok for a guest. If not, no. From a z/VM security point of view, it's the same, though the increased complexity of trunk ports can trigger a failure in the human element of the equation. As David says, this may make the Network Gods nervous. Trunk v. Access: Sometimes the 'obvious' solution is the 'wrong' (or unworkable) solution. For instance, most sites will not mix Internet and Intranet traffic on the same physical switch. Ergo you cannot use a trunk port to carry both. Or they will not carry traffic in different security domains, as represented by a VLAN, on the same wire, so again, a trunk won't help. While on one level it may seem silly, being largely based on history and Everyone Knows kinds of things, ranking right up there with "telnet is not secure". On the other hand, using separate switches to carry Internet traffic can be a wise thing for other reasons, including ease of physical audit (put red tape on it and allowo only red ethernet cables) and the ability to just turn it off in an emergency without affecting your ability to access the systems internally. Don't fight with your networking people about this stuff - it's their territory and their responsibility, not yours. If you need to buy additional OSAs, for example, then just say so and TPTB will decide whether the expense is worth the risk. (Hint: Network folks almost always get their way on this soft of stuff. It's ok. Breathe in. Breathe out. In. Out.) It goes without saying, but it must be said, that involving network AND security people *early* in the design is far better (for you) than surprising them at the 11th hour. Talk about cranky.... Alan Altmark z/VM Development IBM Endicott
