<html><body>
<p>Note that this is the case for the standard VMware ESX vSwitch. However, the Cisco Nexus 1000v, <br>
which is an optional virtual switch for ESX, does appear to provide (guest) VM firewall capabilities. <br>
See for example the section on "isolation and protection" and ACLs in the link below:<br>
<br>
<a href="http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9902/dmz_virtualization_vsphere4_nexus1000V.pdf">http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9902/dmz_virtualization_vsphere4_nexus1000V.pdf</a><br>
<br>
In terms of interfaces, the 1000v claims a CLI (likely similar to physical Cisco switches), support for SNMP <br>
and an XML API.<br>
<br>
Thanks,<br>
Dimitrios<br>
<br>
<img width="16" height="16" src="cid:1__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt="Inactive hide details for Matthias Bolte ---01/13/2010 05:43:41 PM---2010/1/13 Stefan Berger <stefanb@us.ibm.com>: >"><font color="#424282">Matthias Bolte ---01/13/2010 05:43:41 PM---2010/1/13 Stefan Berger <stefanb@us.ibm.com>: ></font><br>
<br>
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2" color="#5F5F5F">From:</font></td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2">Matthias Bolte <matthias.bolte@googlemail.com></font></td></tr>
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2" color="#5F5F5F">To:</font></td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2">Stefan Berger/Watson/IBM@IBMUS</font></td></tr>
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2" color="#5F5F5F">Cc:</font></td><td width="100%" valign="middle"><img width="1" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2">Gerhard Stenzel <gerhard.stenzel@de.ibm.com>, libvir-list@redhat.com, Vivek Kashyap/Beaverton/IBM@IBMUS</font></td></tr>
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2" color="#5F5F5F">Date:</font></td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2">01/13/2010 05:43 PM</font></td></tr>
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2" color="#5F5F5F">Subject:</font></td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2">Re: [libvirt] [RFC] Proposal for introduction of network traffic filtering capabilities for filtering of network traffic from and to VMs</font></td></tr>
<tr valign="top"><td width="1%"><img width="96" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2" color="#5F5F5F">Sent by:</font></td><td width="100%"><img width="1" height="1" src="cid:2__=0ABBFC39DFED06B58f9e8a93df938@us.ibm.com" border="0" alt=""><br>
<font size="2">libvir-list-bounces@redhat.com</font></td></tr>
</table>
<hr width="100%" size="2" align="left" noshade style="color:#8091A5; "><br>
<br>
<br>
<tt>2010/1/13 Stefan Berger <stefanb@us.ibm.com>:<br>
><br>
> Daniel Veillard <veillard@redhat.com> wrote on 01/13/2010 12:03:22 PM:<br>
><br>
>> On Mon, Jan 11, 2010 at 12:55:27PM -0500, Stefan Berger wrote:<br>
>> > Hello!<br>
>> ><br>
> [...]<br>
[...]<br>
>> other case of limitiations could be found. Also this may not map well<br>
>> for other kind of hypervisors like VMWare, right ?<br>
><br>
> I don't know much about the API that VMWare is exposing. Maybe only a<br>
> certain subset of what would be possible with this XML could be applied<br>
> to their API, if such functionality exist. Otherwise, if libvirt<br>
> can run ebtables and iptables commands on their management VM and<br>
> all traffic passes through VM=specific network interface (tap) in that VM,<br>
> it *should* work as well.<br>
<br>
VMware ESX hosts allow to configure the host level firewall via the<br>
remote VI API. But AFAIK there is no virtual machine level firewall.<br>
<br>
You're not supposed to do something like that in the service console,<br>
doing anything in the service console is not supported in general.<br>
Also there is no libvirtd in the service console because of that and<br>
because it is not necessary. The ESX driver does everything using the<br>
remote VI API.<br>
<br>
Matthias<br>
<br>
--<br>
libvir-list mailing list<br>
libvir-list@redhat.com<br>
</tt><tt><a href="https://www.redhat.com/mailman/listinfo/libvir-list">https://www.redhat.com/mailman/listinfo/libvir-list</a></tt><tt><br>
</tt><br>
<br>
</body></html>