Isolation based on Security Groups in Advanced Zone - VMWare Hypervisor
1 Background
Isolation of VM Traffic is achieved using Security Groups in Basic Zones. For Advanced zone, traffic can be isolated on a per network basis using VLANs. Advanced Zones support shared as well as isolated networks. Currently, there is no way to isolate guest traffic within a network. There is another similar requirements document for SG support in advanced zone for XS and KVM.
For VMWare Hypervisor, since the classic SG support can't be added, one of the solutions would be to support PVLANs (Private VLANs) for this solution.
Use Cases:
- Isolation within a network: Shared Networks can be created with different levels of scope. It can be shared within an account, domain, project or a global shared network. With multiple users deploying VMs on a shared network, users might want to control traffic on their VMs based on Security groups.
- Isolation across multiple networks: Some customers might deploy multiple shared networks and they might need to restrict communication not only within a network but also across different networks. For example, user A could have VM1 in Network 100 and VM2 in Network 200 but they might want to limit the communication on these VMs to just talk to each other and a limited set of Public IP Addresses.
- VMs deployed using multiple Networks: There could be various cases in which a VM is deployed on two networks (an isolated network for the account and a common shared network providing monitoring capabilities). In these cases, admins will want to limit the communication between different tenants who are sharing the common shared Network.
- Isolated Network: With Isolated Networks (including VPC), users can deploy multiple applications on the same isolated Network or same VPC. Users might want to prevent communication between the applications within the same Network/VPC.
Customer Benefits:
- Allowing users to control traffic within a network would help them deploy multiple applications without communication between application as well as prevent communication with other users’ VMs.
2 Requirements
- Most important requirement is to isolate VMs from other VMs on the same network using PVLANs
- Security Groups capability, identical to Security Groups (Ingress and Egress, Accounts & CIDRs) in basic zone, should be used for this feature.
- Feature needs to be supported for Shared and Isolated Networks in Advanced Zones.
- Feature needs to be supported in VPC as well as non-VPC deployments
- Private VLANs should be used to provide this functionality on VMWare
- Following is what is supported for Security Groups in Basic Zones and should be supported in Advanced Zone for all Hypervisors.
- Ingress & Egress rules
- Ability to create rules based on Security Group or CIDR
- Protocol, Start Port, End Port and CIDR or Security Group
- SG type support should be added on a per NIC basis.
- Users should be allowed to deploy security groups on VMs that are deployed on multiple networks.
- UI workflow should be identical to Security Groups in basic zone.
- The UI workflow should be same irrespective of Hypervisor.
- As part of VM creation/update wizards, users should be able to select from a list of security groups.
4 Upgrade Scenarios
There are no upgrade requirements as this would be a new feature.
5 Non-Requirements
6 Bugs
7 References:
