Server 2012 Clustered Hosts - How can I place a Hyper-V Guest in the DMZ?

Question

I have 3 server 2012 hyper v clustered hosts. I've been recently asked to create a VM where external parties will have local admin rights. I've been resisting things for a variety of IMO valid security reasons. What I'm trying to understand is if it would
be possible to build a guest VM that was not part of our domain and put in our firewalls DMZ zone. In this way these folks could be local admins but there's be no connection with the internal network.
In a single host environment if I'm understand things correctly I'd create a external type virtual switch, connect it to a specific physical network card on my host and then connect that card to my switch's DMZ port. But my environment is clustered... does
that mean I'd designate a physical network card on all 3 hosts, connect them to all the same named external virtual switch and plug all 3 in to DMZ ports on my firewall? Could I also instead of plugging all 3 in to DMZ ports on my firewall plug all 3 into
some little rinky dink 4 port gigabit switch and then plug that in to my firewall's dmz port?

Answer 1

Hi,
When your guest vm using the external vswitch, it can be considered as the physical host, therefore it has the physical network features, in the DMZ zone we often create the
decided subnet for the security reason. Therefore the decide NIC is needed, it will used for the Hyper-V host VLAN settings.
When considering Hyper-V for server consolidation in a DMZ it is recommended not to run VMs of vastly differing trust levels on the same physical host in production environments
(i.e. do not consolidate all DMZ boxes on one physical host). 
Instead, the recommendation is to consolidate all the front-end boxes on one physical server and do the same for the back-end, depending on the workloads.
More information:
Hyper-V 2008 R2: Virtual Networking Survival Guide
http://social.technet.microsoft.com/wiki/contents/articles/151.hyper-v-2008-r2-virtual-networking-survival-guide.aspx
Hyper-V: What are the uses for different types of virtual networks?
 http://blogs.technet.com/jhoward/archive/2008/06/17/hyper-v-what-are-the-uses-for-different-types-of-virtual-networks.aspx
Understanding Networking with Hyper-V
 http://www.microsoft.com/downloads/details.aspx?FamilyID=3FAC6D40-D6B5-4658-BC54-62B925ED7EEA&displaylang=en&displaylang=en
VLAN Settings and Hyper-V
http://blogs.msdn.com/virtual_pc_guy/archive/2008/03/10/vlan-settings-and-hyper-v.aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.