Thanks for the replies, Alan & David. I appreciate it.

My networking group is pretty flexible and asked me what *I* wanted, for
the most part. Nice to have that option.  :)

Dave 

-----Original Message-----
From: The IBM z/VM Operating System [mailto:[email protected]] On
Behalf Of Alan Altmark
Sent: Friday, January 09, 2009 7:26 AM
To: [email protected]
Subject: Re: Ethernet vswitch definition

On Thursday, 01/08/2009 at 06:09 EST, KEETON Dave * SDC
<[email protected]> wrote:

> Scenario: If you had an environment that consisted of Administration, 
> Production networks and you wanted a guest to participate in both, 
> wouldn't you just create two VLAN memberships to eth0 (ala vconfig)? 
> Or would it be prudent to create a separate VSWITCH for Administration

> and Production and use eth0 and eth1 nics (using the PORTTYPE ACCESS 
> method)?

This will be driven by your Networking folks.  If they would normally
configure a trunk port for a distributed system, then it's ok for a
guest. 
 If not, no.  From a z/VM security point of view, it's the same, though
the increased complexity of trunk ports can trigger a failure in the
human 
element of the equation.   As David says, this may make the Network Gods

nervous.

Trunk v. Access:  Sometimes the 'obvious' solution is the 'wrong' (or
unworkable) solution.  For instance, most sites will not mix Internet
and Intranet traffic on the same physical switch.  Ergo you cannot use a
trunk port to carry both.  Or they will not carry traffic in different
security domains, as represented by a VLAN, on the same wire, so again,
a trunk won't help.

While on one level it may seem silly, being largely based on history and
Everyone Knows kinds of things, ranking right up there with "telnet is
not secure".  On the other hand, using separate switches to carry
Internet traffic can be a wise thing for other reasons, including ease
of physical audit (put red tape on it and allowo only red ethernet
cables) and the ability to just turn it off in an emergency without
affecting your ability to access the systems internally.  Don't fight
with your networking people about this stuff - it's their territory and
their responsibility, not yours.  If you need to buy additional OSAs,
for example, then just say so and TPTB will decide whether the expense
is worth the risk.  (Hint: 
Network folks almost always get their way on this soft of stuff.  It's
ok. 
 Breathe in.  Breathe out.  In.  Out.)

It goes without saying, but it must be said, that involving network AND
security people *early* in the design is far better (for you) than
surprising them at the 11th hour.  Talk about cranky....

Alan Altmark
z/VM Development
IBM Endicott

Reply via email to