Josh wrote:

quoted text
> Hello there.

>

> We have a bunch of obsd firewalls, 8 at the moment, all working nice and

> so forth. But we

> need to add about another 4 in there for new connections and networks,

> which means more

> machines to find room for.

>

> So basically I have been asked to investigate running all these

> firewalls in two big boxes, with lots

> of NIC's, with a bunch of openbsd vritual machines on them. One main box

> for the primary firewalls,

> one for the secondary. Each virtual machine getting its own physical NIC.

>

> Personally I dont really like the idea, I can see things going wrong,

> lots of stuff balancing on a

> guest os and box.

>

> Can someone please inform me if this is a really bad idea or not,

> ideally with some nice reasoning?

>

>

> Cheers,

>     Josh

Read this:

http://advosys.ca/viewpoints/2007/04/fuzzing-virtual-machines/

Read the paper linked there as well.  Always good to go back to original

source material.
Anyone who told you VM technology and security had anything to do with

each other was full of doo-doo.
After reading that, I'd not want to put any "externally exposed" apps on

a VM system.  Granted, OpenBSD might not be the best entry point for a

VM attack, but the foundation VM design is based on isn't as solid as

people think.
Nick.