I have 3 server 2012 hyper v clustered hosts. I've been recently asked to create a VM where external parties will have local admin rights. I've been resisting things for a variety of IMO valid security reasons. What I'm trying to understand is if it would be possible to build a guest VM that was not part of our domain and put in our firewalls DMZ zone. In this way these folks could be local admins but there's be no connection with the internal network.
In a single host environment if I'm understand things correctly I'd create a external type virtual switch, connect it to a specific physical network card on my host and then connect that card to my switch's DMZ port. But my environment is clustered... does that mean I'd designate a physical network card on all 3 hosts, connect them to all the same named external virtual switch and plug all 3 in to DMZ ports on my firewall? Could I also instead of plugging all 3 in to DMZ ports on my firewall plug all 3 into some little rinky dink 4 port gigabit switch and then plug that in to my firewall's dmz port?