Good People, I am a long time reader, novice poster, and I have a question for you.
I have a environment where I want to put a single physical filer across two distinct networks (one internal and once external).  Using v-filers I want to provide services for both networks.  Generally I would use two physical filers for this, so attacks on the physical filer in the external network would only compromise storage in the external network.
In using a single physical filer, and using v-filers, I am hoping to achieve the same results, the issue is however that I can still get to v-filer0, and thus the filer as a whole from the IP address on the interface that is hosting the v-filers provisioned to the external network. Â Thus providing an attack vector to something that before (with two physical filers) was completely inaccessible.
I see two possible solutions that I am not sure are implementable:
(1)Â Somehow creating the interface connected to the external network without an IP address, thus v-filers would have IP address on that interface, and be accessible, but the v-filer0 would not be accessible, as there is no IP to access it, or
(2) Somehow deny ssh to v-filer0 from the external network interface, but it would still have to work for the v-filers on that interface.
Not sure if these are possible, or an extensive list of the ways to achieve what I am attempting. Â Also in re-reading this SSH isn't the only attach vector, http and any other management interface would have to be denied from the external interfaces as well. Â Any advice or thoughts would be much appreciated.
thanks
c