On Fri, Aug 16, 2019 at 6:12 PM Dan Poltawski <dan.poltawski(a)tnp.net.uk>
wrote:
For some security requirements, I’ve been asked if it’s possible to
segregate the hosted engine from the physical nodes, with specific
firewalling for access to do node/ storage operations (I’m using managed
block storage).
Is this an approach others us, or is it better practice and just ensure
the nodes and engine are all sharing the same network?
The hosted-engine needs to communicate with the hosts for management
operations; this happens over a logical network called management network.
The hosts have to communicate with the storage, you can create an
additional logical network with different addressing for that; the engine
doesn't need any direct access to the storage which is always mediated by
the hosts.
For simplicity, if feasible in your environment, I'd suggest to create an
additional storage dedicated logical network on your hosts instead of
playing with manual injected firewall rules over the management one.
Thanks,
dan
------------------------------
The Networking People (TNP) Limited. Registered office: Network House,
Caton Rd, Lancaster, LA1 3PE. Registered in England & Wales with company
number: 07667393
This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the system manager.
This message contains confidential information and is intended only for the
individual named. If you are not the named addressee you should not
disseminate, distribute or copy this e-mail. Please notify the sender
immediately by e-mail if you have received this e-mail by mistake and
delete this e-mail from your system. If you are not the intended recipient
you are notified that disclosing, copying, distributing or taking any
action in reliance on the contents of this information is strictly
prohibited.
_______________________________________________
Users mailing list -- users(a)ovirt.org
To unsubscribe send an email to users-leave(a)ovirt.org
Privacy Statement:
https://www.ovirt.org/site/privacy-policy/
oVirt Code of Conduct:
https://www.ovirt.org/community/about/community-guidelines/
List Archives:
https://lists.ovirt.org/archives/list/users@ovirt.org/message/C4SAO7NAQGE...