Following the launch of the article “VMware dispels virtualization myths (sort of),” VMware emailed me to correct some issues about virtual machine security.

According to VMware, an “incorrect statement” was made by Burton Group Analyst Chris Wolf, who, like all of the engineers at VMware he’s spoke with, he thought to be correct.

In the article, Wolf said, “one significant issue with virtual machine security is with virtual switch isolation. The current all-or-nothing approach to making a virtual switch ‘promiscuous’ in order to connect it to an IDS/IPS is not favorable to security.”

For example, “if you connect an IDS appliance to a virtual switch in promiscuous mode,” Wolf said, “not only can the IDS capture all of the traffic traversing the switch, but every other VM on the same virtual switch in promiscuous mode could capture each other’s traffic as well.”

This statement ruffled some feathers at VMware, and they quickly emailed me and Burton to “educate us” and the VMware community that in fact, VMware allows (and encourages) users to configure only the ports they need to be promiscuous as such. This is not a per vswitch setting, but rather a per portgroup setting. The way to configure a vswitch for IDS/IPS is to create a separate portgroup from those used for normal VMs and configure it for “Promiscuous Allowed,” a VMware spokesperson said.

After testing this out in his own lab, Wolf said it is really an easy solution, because the architecture is already there.

“At the switch level, promiscuous mode is an all or nothing configuration. VMware doesn’t argue this. However, a way around this issue is by configuring a separate port group on a virtual switch just for the IDS and making the port group promiscuous. That allows the IDS to monitor the vswitch traffic and still keep all other traffic isolated,” Wolf learned from VMware.

“So, with the port group feature it isn’t all or nothing, it can be granular,” Wolf said. That said, “Vmware’s own team wasn’t even aware of this,” therefore it’s unlikely many VMware administrators are either, he said.

So the record stands corrected. “The option of making a virtual switch ‘promiscuous’ in order to connect it to an IDS/IPS is not favorable to security and should never be used,” Wolf said. Instead, administrators should create a dedicated port group on the switch for the IDS and only make the IDS port group promiscuous. This would allow the IDS to monitor all unicast traffic on the switch while preventing all other VMs on the virtual switch from seeing each other’s unicast traffic.”

Developments at VMworld 2007 show that virtualization 2.0 has arrived, says Burton Group analyst Andrew Kutz. But can virtualization stay sexy when it is mainstream?

VMware CEO Diane Greene says VMworld 2007 wowed her with innovation and enormous vendor and user participation.

Analyst Barb Goldworm explains why VMworld 2007 ushered in a new era in virtualization. 

Good-bye to pesky print drivers, hello to virtual printing. ThinPrint’s VDI-focused printing approach won recognition in the SearchServerVirtualization.com VMworld Awards’ Utilities category.

InovaWave CEO Chris Ostertag describes virtualization’s I/O problems and how InovaWave VirtualOctane for ESX Server could solve them. The soon-to-be release product won a SearchServerVirtualization.com VMworld Award for Best New Technology.

Akorri founder and CTO Richard Corley describes the virtualization management problems solved by Akorri BalancePoint 1.7, which won SearchServerVirtualization.com’s VMworld Award in the performance monitoring and optimization category.

Onaro’s Bryan Semple describes a new product that brings storage and server teams together to deploy ESX.

The sheer bulk of giveaways at VMworld 2007 overwhelm SearchServerVirtualization.com’s intrepid and swag-seeking editors, Bridget Botelho and Jan Stafford.

News about Cisco’s new architecture and an open virtual machine format are the VMworld news of note for Burton Group senior analyst Chris Wolf.