6.5.1

Creating Multiple Networks Within a Single ESXi Host
The ESXi system is designed so that you can connect some groups of virtual machines to the internal
network, others to the external network, and still others to both—all on the same host. This capability is
an outgrowth of basic virtual machine isolation coupled with a well-planned use of virtual networking
features.
Figure 8‑2. External Networks, Internal Networks, and a DMZ Configured on a Single ESXi
Host
physical network
adapters
External
Network 1
Internal
Network 2
External
Network 2
Internal
Network 1
ESXi
VM 2
internal
user
VM 3
internal
user
VM 4
internal
user
VM 5
internal
user
VM 6
firewall
server
VM 7
Web
server
VM 8
firewall
server
VM 1
FTP
server
Internal NetworkExternal Network DMZ
In the figure, the system administrator configured a host into three distinct virtual machine zones: FTP
server, internal virtual machines, and DMZ. Each zone serves a unique function.
FTP server Virtual Machine 1 is configured with FTP software and acts as a holding
area for data sent to and from outside resources such as forms and
collateral localized by a vendor.
This virtual machine is associated with an external network only. It has its
own virtual switch and physical network adapter that connect it to External
Network 1. This network is dedicated to servers that the company uses to
receive data from outside sources. For example, the company uses
External Network 1 to receive FTP traffic from vendors and allow vendors
access to data stored on externally available servers though FTP. In
addition to servicing Virtual Machine 1, External Network 1 services FTP
servers configured on different ESXi hosts throughout the site.
vSphere Security
VMware, Inc. 189