Forum Discussion
PCI and Partitions
Not sure if there is any specific documentation about PCI compliance from F5, but I can imagine using solely partitions to implement segregation between PCI and non-PCI servers isn't sufficient. You mention that each partition has it's own network interface, so maybe you are referring to route domains instead of partitions. It's good to know that partitions and route domains are different things, but used together they help to create secure logical isolated environments.
Please note that partitions on the F5 are used for administrative segregation and that route domains are used for network segregation. So, with partitions one can use RBAC to limit administrative rights to specific parts in the configuration. And route domains are like what Cisco is calling VRFs. For example, you could create route domains for LAN and DMZ on the same F5 BIG-IP. When both route domains are configured as strictly isolated route domains, no traffic can be routed between the LAN and DMZ directly on de F5 BIG-IP. In this case you'll need an external router/firewall to route traffic between the two zones.
So, if using partitions in combination with route domains for the PCI and non-PCI servers, I would expect it will satisfy the PCI audit. Since cloud infrastructures are more common, the demand for physical segregation doesn't seem to be a hot topic anymore.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
