The network can be one of the most vulnerable parts of any system. The virtual machine network requires as much protection as its physical counterpart. Virtual Machine network security can be enhanced in several ways, including through the use of virtual local area networks (VLANS).

If the virtual machine network is connected to a physical network, it can be subject to breaches to the same degree that a network made up of physical machines is. Even if the virtual machine network is isolated from any physical network, virtual machines in the network can be subject to attacks from other virtual machines in the network. The requirements for securing virtual machines are often the same as those for physical machines.

Virtual machines are isolated from each other. One virtual machine cannot read or write another virtual machine's memory, access its data, use its applications, and so forth. However, within the network, any virtual machine or group of virtual machines can still be the target of unauthorized access from other virtual machines and might require further protection by external means.

Adding firewall protection to the virtual network by installing and configuring host-based firewalls on some or all of its virtual machines.

For efficiency, private virtual machine Ethernet networks or virtual networks can be configured. With virtual networks, a host-based firewall is installed on a virtual machine at the head of the virtual network. This serves as a protective buffer between the physical network adapter and the remaining virtual machines in the virtual network.

Installing a host-based firewall on virtual machines at the head of virtual networks is a good security practice. However, because host-based firewalls can slow performance, it's important to balance security needs against performance before deciding to install host-based firewalls on virtual machines elsewhere in the virtual network.

Keeping different virtual machine zones within a host on different network segments. If virtual machine zones on their own network segments are isolated, the risks of data leakage from one virtual machine zone to the next is minimized. Segmentation prevents various threats, including Address Resolution Protocol (ARP) spoofing, in which an attacker manipulates the ARP table to remap MAC and IP addresses, thereby gaining access to network traffic to and from a host. Attackers use ARP spoofing to generate Man in the Middle attacks, DoS attacks, hijack the target system, and otherwise disrupt the virtual network.

Planning segmentation carefully lowers the chances of packet transmissions between virtual machine zones, which prevents sniffing attacks that require sending network traffic to the victim. Also, an attacker cannot use an insecure service in one virtual machine zone to access other virtual machine zones in the host. Segmentation can be implemented by using either of two approaches, each of which has different benefits.

Use separate physical network adapters for virtual machine zones so that the zones are isolated. Maintaining separate physical network adapters for virtual machine zones is probably the most secure method and is less prone to misconfiguration after the initial segment creation.

Set up virtual local area networks (VLANs) to help safeguard the network. Because VLANs provide almost all of the security benefits inherent in implementing physically separate networks without the hardware overhead, they offer a viable solution that can save the cost of deploying and maintaining additional devices, cabling, and so forth.

This level of security can be implemented in different ways.

VLANs are an IEEE standard networking scheme with specific tagging methods that allow routing of packets to only those ports that are part of the VLAN. When properly configured, VLANs provide a dependable means to protect a set of virtual machines from accidental or malicious intrusions.

VLANs let you segment a physical network so that two machines in the network are unable to transmit packets back and forth unless they are part of the same VLAN. For example, accounting records and transactions are among a company’s most sensitive internal information. In a company whose sales, shipping, and accounting employees all use virtual machines in the same physical network, you might protect the virtual machines for the accounting department by setting up VLANs.

Sample VLAN Layout
Sample VLAN layout

In this configuration, all employees in the accounting department use virtual machines in VLAN A and the employees in sales use virtual machines in VLAN B.

The router forwards packets containing accounting data to the switches. These packets are tagged for distribution to VLAN A only. Therefore, the data is confined to Broadcast Domain A and cannot be routed to Broadcast Domain B unless the router is configured to do so.

This VLAN configuration prevents the sales force from intercepting packets destined for the accounting department. It also prevents the accounting department from receiving packets intended for the sales group. The virtual machines serviced by a single virtual switch can be in different VLANs.