Isn't My Physical Firewall Good Enough?

When looking at how to secure Virtual Servers within your data center many people immediately think that if they have physical firewalls and such in their data center they are protecting those virtual servers.

The answer to the question on whether physical firewalls are good enough is no.  Physical Firewalls and some virtual security products sit inline between the virtual machines and the physical network.  These physical firewalls or virtual security products provide security between the physical world and the virtual world but provide no security within the virtual world.

If one VM is trying to access another VM how can you enforce security policy between those VM's.  The physical firewall isn't in the communication path as you can see from the diagram to the left.

So the only way to provide the VM to VM controls is to either run host based security solutions or a security solution that is in the VM to VM communication path (Virtual Security Switch).

-JP