Firewalling traffic between hosts located in the same VLAN

[tony2019]

Hello.

We are trying to achieve the following: traffic between hosts (a bunch of VMs, actually) has to be proctected by a firewall, but these hosts are located in the same L2 VLAN and use a matching L3 addressing subnet.

The problem is not that we simply need to isolate the hosts that belong to the same VLAN (Private VLANs could be used for this purpose), they still need to communicate with each other and we need to firewall all of their communication.

Further segmentation of the VLAN (into smaller networks) is just not feasible.

Does anyone have an idea how to do this the best way in the Fortigate world? Would any features of the "new" Security Fabric be of any use here?

Thanks for your help!

[lobstercreed · Accepted solution]

I'm pretty sure what you're asking is impossible in the FortiGate world unless you could put the FortiGate physically between the two hosts and use transparent mode.  However, I assume these hosts are VMs that live in the same farm.  In that case intra-subnet traffic would not flow northbound, so there would be no way to accomplish this.  This is basically what VMware NSX is for.  The only way to get traffic to flow northbound is to further segment the network, which you have stated is not feasible, soo....   :(

[lobstercreed · Accepted solution]

I'm pretty sure what you're asking is impossible in the FortiGate world unless you could put the FortiGate physically between the two hosts and use transparent mode.  However, I assume these hosts are VMs that live in the same farm.  In that case intra-subnet traffic would not flow northbound, so there would be no way to accomplish this.  This is basically what VMware NSX is for.  The only way to get traffic to flow northbound is to further segment the network, which you have stated is not feasible, soo....   :(

[tony2019]

Hi, lobstercreed!

Thanks for the idea, so the east-west segmentation should be done with VMware NSX. Does it even support any basic firewalling at all?

There is also a product called Fortigate-VMX that supposedly enables you to write Fortigate-like policies on the FG-VMX. FG-VMX is supposed to seamlessly receive the IP addresses of the VMs from the NSX as firewall objects. There's some Fortinet sales info about FG-NSX available here (the video seems quite promising, I suppose): https://www.fortinet.com/...fabric-connectors.html

What we are trying to achieve is to get as much of Fortigate-like policy writing feel for firewalling. Would the FG-VMX (in combination with the NSX) be the right product for this job?

Thanks!

[lobstercreed · Accepted solution]

Full disclosure, I have not used VMware NSX, but from others and reading I believe it does include quite a bit of firewall features.  I knew a guy who was using it exclusively for his datacenter firewall and loved it.

I had not heard of FortiGate VMX, but I agree that it looks like the right product for what you're after.  Right now we feel the FortiGate accomplishes what we need it to at the inter-subnet level and we can't afford NSX, but we have always said that if we outsize our current FortiGate for our datacenter needs (it also handles our edge traffic), we would buy NSX and do that part with it. 

Now that I know about VMX, I wonder if we can afford both if the time comes!  I certainly don't blame you for wanting the FortiGate policy feel.  :)

[tony2019]

So the VMware NSX can do L4 firewalling by itself?

How complex is the management of this feature? Let's say the UTM functions are not our no. 1 priority, would a NSX only solution be far less complex to maintain & troubleshoot than a NSX+VMX one?

[tony2019]

Thanks for the advice, so the NSX would be a useful solution at the minimum and VMX as some sort of an add-on.

I'll try getting a demo of VMX and see how useful it is and how well it does it's job.

[Alexis_G]

Fortigate VMX is the product you need in order (except firewall rules) to be able to have Webfiltering, App Filtering etc.

NSX is required to exist on VCenter Infrastracture.

It is not an step just to check VMX, you need to implement it on VCenter.

Install FGT-SVM, implement VMX service on NSX, create security Groups on NSX, then FGT-VMX are auto deployed on each esxi host.

Prior of all these is that VM admins will be sure of the health status of you VMWARE infrastucture: Utilization, Networking , Vmotioning status.

CONS: Troubleshooting this environment is more complex than usual FGTs