Creating DMZ networks

The term Demilitarized Zone (DMZ) is commonly used to describe a zone in a network with a certain level of trust that is lower compared to the internal or private network. DMZ is sometimes referred to as a semi-trusted zone in which web servers are most commonly placed, published, or exposed to the Internet or an untrusted network.

With the virtualization technology available today, it is not only possible, but also practical to build a DMZ architecture strictly using virtual elements. In order to build a pilot or proof of concept for an Internet-facing application, the requisition of physical servers, network switches, and firewalls is no longer necessary. Now, that same environment can be implemented on a single physical host as an example.

The following example shows a simple DMZ architecture consisting of a single web server, an internal firewall virtual appliance, and an external firewall appliance. Each firewall is connected to its own vSwitch, which is in turn...