The problem isn't really specific to VMs, besides the fact that in a virtualized environment it is easier to plug / unplug switch ports and to misconfigure them.

Hello,

Oliver is correct, it is not limited to just the virtual infrastructure. Some higher end switches do allow you to lock these activities by port but it is not available in each physical switch. However, this used to be in something you could do in ESX v2.x but was dropped in ESX v3. Personally I would like to see the functionality put back in.

Best regards,
Edward Haletky

FYI- Blue Lane uses controlled code execution (not signatures) to protect vulnerabilities without resetting sessions (blocking code). It decodes all major data center protocols and takes appropriate countermeasures based on the type of attack, vulnerability targeted and protocol used.

Very little blocking if at all... is ever used. We would love to brief you on how our technology is different from run-of-the-mill IPS. www.bluelane.com

Greg Ness
Blue Lane

Hello,

I am familiar with Bluelane's approach to virtual shield and yes it does very little blocking, but its designed implementation limits vMotion capability, unless you make changes to the VMware ESX(i) hosts, and allows yet another place to place VMs that would then be unprotected and hence requires more monitoring of the system. The concern is that its impossible at this moment to limit a VM to a specific portgroup/vSwitch combination.

Someone could always move the VM from vSwitch to vSwitch to bypass the security measure.

Best regards,
Edward Haletky

My mental model is that the portgroup of the vswitch is like the port of the physical switch. Multiple VMs in a portgroup are like multiple physical machines connected via a hub to a port of a physical switch. So the physical and virtual worlds give you the same granularity of control. You can turn on or off promiscuous mode down to the port/port group level.

Also, while its correct that its easier to plug in a VM into a PG, its also easier to detect by analyzing the ESX config. In the physical world, especially if it is not transmitting, there is no way to detect it without physically walking through my data center.

Full disclosure: I work for TBD Networks, which develops configuration/audit software that addresses this issue for ESX.