PCI Compliance considerations in a Virtualized Environment

[RiDDLeRThC]

Okay so this question is getting thrown around my office here lately as we make plans to migrate from a mess of Windows 2k3 boxes running VMware Server to an ESX deployment.

We are currently undergoing PCI audits and as it stands right now each of our different environments are on different subnets with a firewall in between each subnet. Pretty standard I guess.

So in the design of our ESX setup my ideas are to have all the ESX servers share each of the different environments. This method I get the best bang for my buck because some of the subnets have very few servers on them and having to dedicate an esx server to it would be a waste of resources.

Question is, if I set aside a NIC or two per subnet and setup vSwitches for each subnet (or do VLAN's). Would this be PCI compliant? I know this is most likely best to ask the consultant doing our prep for auditing but I would rather get a ball park answer first before going to him.

Anyone have experience with this? I would think its pretty common but this is the first time I have worked at a company that has separated their environments out in such a way and don't have much experience with it.

 

[aaronearles]

From our experience with PCI auditors, I would bet that you're going to get a different answer from one auditor to the next, some of them have been much more lenient than others, so I would wait and ask your assigned auditor.

We do have virtual servers with multiple networks, but only internal and development environments, nothing production or containing cardholder data... and we're good so far, although we don't have the final stamp of approval just yet.

 

[RiDDLeRThC]

Yeah i'm going to have to dig into this a lot more and ping some of the people outside my IT team.

I personally think that Office, Dev, QA, UAT/VR can share ESX hosts and that PROD gets its own ESX Servers. vCenter controls all still from a separate highly locked down management network.

 

[Child of Wonder]

At a previous job we had to have separate clusters for internal and external VMs.