| Updated on: 03 JUN 2021 Image Product 3 | 02 JUN 2021 Check for additions and updates to these release notes. |
DMZ Design for Unified Access Gateway with Multiple Network Interface Cards
kubectl get vm -n my-ns-ubuntu NAME AGE vmsvc-ubuntu-vm 28s
One of the configuration settings for Unified Access Gateway is the number of virtual Network Interface Cards (NICs) to use. When you deploy Unified Access Gateway, you select a deployment configuration for your network.
Name:vmsvc-ubuntu-vm Namespace: my-ns-ubuntu Annotations: vmoperator.vmware.com/image-supported-check: disabled API Version: vmoperator.vmware.com/v1alpha1 Kind: Class Name: custom Image Name: vmservice-ubuntu-20-10-server-cloudimg-amd64 Network Interfaces: Network Name: primary Network Type: vsphere-distributed Power State: poweredOn Storage Class: wcpglobal-storage-profile Metadata: Creation Timestamp: 2021-03-23T19:07:36Z Finalizers: virtualmachine.vmoperator.vmware.com Generation: 1 Managed Fields:
You can specify one, two, or three NICS settings which are specified as onenic, twonic or threenic.
Reducing the number of open ports on each virtual LAN and separating out the different types of network traffic can significantly improve security. The benefits are mainly in terms of separating and isolating the different types of network traffic as part of a defense-in-depth DMZ security design strategy. This can be achieved either by implementing separate physical switches within the DMZ, with multiple virtual LANs within the DMZ, or as part of a full VMware NSX managed DMZ.
Typical Single NIC DMZ Deployment
The simplest deployment of Unified Access Gateway is with a single NIC where all network traffic is combined onto a single network. Traffic from the Internet-facing firewall is directed to one of the available Unified Access Gateway appliances. Unified Access Gateway then forwards the authorized traffic through the inner firewall to resources on the internal network. Unified Access Gateway discards unauthorized traffic.
APIVersion: vmoperator.vmware.com/v1alpha1 kind: VirtualMachine metadata: name: vmsvc-ubuntu-vm namespace: my-ns-ubuntu spec: imageName: vmservice-ubuntu-20-10-server-cloudimg-amd64 className: custom powerState: poweredOn storageClass: wcpglobal-storage-profile networkInterfaces:- networkName: "primary" networkType: vsphere-distributed
Separating Unauthenticated User Traffic from Back-End and Management Traffic
An alternative option over the single NIC deployment is to specify two NICs. The first is still used for Internet facing unauthenticated access, but the back-end authenticated traffic and management traffic are separated onto a different network.
In a two NIC deployment, Unified Access Gateway must authorize the traffic going to the internal network through the inner firewall. Unauthorized traffic is not on this back-end network. Management traffic such as the REST API for Unified Access Gateway is only on this second network
If a device on the unauthenticated front-end network, such as the load balancer, was compromised then reconfiguring that device to bypass Unified Access Gateway is not possible in this two NIC deployment. It combines layer 4 firewall rules with layer 7 Unified Access Gateway security. Similarly, if the Internet facing firewall was misconfigured to allow TCP port 9443 through, this would still not expose the Unified Access Gateway Management REST API to Internet users. A defense-in-depth principle uses multiple levels of protection, such as knowing that a single configuration mistake or system attack does not necessarily create an overall vulnerability
In a two NIC deployment, you can put additional infrastructure systems such as DNS servers, RSA SecurID Authentication Manager servers on the back-end network within the DMZ so that these servers cannot be visible on the Internet facing network. Putting infrastructure systems within the DMZ guards against layer 2 attacks from the Internet facing LAN from a compromised front-end system and effectively reduces the overall attack surface.
Most Unified Access Gateway network traffic is the display protocols for Blast and PCoIP. With a single NIC, display protocol traffic to and from the Internet is combined with traffic to and from the back-end systems. When two or more NICs are used, the traffic is spread across front-end and back-end NICs and networks. This reduces the potential bottleneck of a single NIC and results in performance benefits.
Unified Access Gateway supports a further separation by also allowing separation of the management traffic onto a specific management LAN. HTTPS management traffic to port 9443 is then only possible from the management LAN.
| Purpose | Access | Required Credentials |
|---|---|---|
| You use the VMware Photon Platform console for these system administrator tasks.
|
|
You must be a user with the system administrator role. |
| Purpose | Access | Required Credentials |
|---|---|---|
| You use VMware Photon Platform for these tasks.
|
|
You must be a user with one or more of these roles:
|
| Purpose | Access | Required Credentials |
|---|---|---|
| You use VMware Photon Platform Appliance Management for these tasks.
|
|
|
| Purpose | Access | Required Credentials |
|---|---|---|
| You use the vRealize Orchestrator Client for these tasks.
|
|
You must be a user with the system administrator role or part of the vcoadmins group configured in the vRealize Orchestrator Control Center Authentication Provider settings. |
| Purpose | Access | Required Credentials |
|---|---|---|
| You use the vRealize Orchestrator Control Center to edit the configuration of the default vRealize Orchestrator instance that is embedded in VMware Photon Platform. |
|
User Name
Password
|
| Purpose | Access | Required Credentials |
|---|---|---|
| You use the Linux command prompt on a host, such as the VMware Photon Platform appliance host, for these tasks.
|
|
|
| Purpose | Access | Required Credentials |
|---|---|---|
| You can use a Windows command prompt on a host, such as the IaaS host, to run scripts. |
|
|
