• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 488
  • Last Modified:

Block traffic between 2 vswitches on same ESXi 5 server

I have setup a ESXi5 server with 2 vswitches using separate vmnics.
vmnic0/vswitch0 - 192.168.31.0
vmnic1/vswitch1 - 192.168.1.0

each vswitch has multiple VMs.

I can ping and access across these subnets and i don't want to. I want to block the traffic. How can I accomplish this?

Thank you.
0
locrawler
Asked:
locrawler
  • 15
  • 8
1 Solution
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
change your subnet mask
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
can you upload screen shots of your networking?
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
what are the actual ip addresses and subnet masks you are using?
0
Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
you have probably got a subnet mask of 255.255.0.0

change it to 255.255.255.0 on both VMs.
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
or you could use VLANs.
0
 
locrawlerAuthor Commented:
i change the subnet mask of the 192.168.1.0 to 255.255.0.0 from 255.255.255.0. this stops the traffic to 192.168.1.5 but not the 192.168.1.0 gateway of 192.168.1.1. changing the subnet mask also breaks my firewall access to 192.168.1.0 from the outside so I changed it back.

vswitch0 is on 192.168.31.0 255.255.255.0
vswitch1 is on 192.168.1.0 255.255.255.0
vmware-network.jpg
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Nothing on the vSwitches is going to block traffic, because you are using the same network subnet. Because ALL the traffic is on the same network.

Other than using VLANs, or selecting different networks.

e.g.

10.xx.xx.xx
172.xxx.xxx.xxx

This is not a VMware ESXi 5.0 issue.

The job of a vSwitch, is a virtual switch, the same function that a physical switch performs, but inside ESXi. There are no traffic blocking functions.

To isolate traffic, we use VLANs, and VLAN Tagging.

0
 
locrawlerAuthor Commented:
vmnic1 is connected to the DMZ side of an internet facing firewall.

vmnic0 is connected to a switch on the LAN connect to the same firewall.

0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
but all on the same physical wired network?
0
 
locrawlerAuthor Commented:
I change the IP addressing for the vswitch1 to 172.16.1.0 from 192.1681.0
same subnet mask 255.255.255.0

Still the same problem.


the networks are separated at the firewall and at the ESXi and not on the same wire.

or not separate ESXi?


0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
is vmnic0 and vmnic1 connected to the same switch?
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
traffic is isolated between vswitches. they are completely separate, think of them as physical devices that exist inside your server.
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
so, a vm on 192.168.1.1 can ping a vm on 172.16.1.1?
0
 
locrawlerAuthor Commented:
vmnic0 and vmnic1 are not connected to the same switch.

As I said vmnic1 is connect straight to the firewall and vmnic0 is connect to a Cisco switch that is connect to the firewall.

192.168.31.105 (on vswitch0) can ping 172.16.1.5 (on vswitch1)
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
well that is bizarre, because the only way traffic could reach 172.16.1.5 from 192.168.31.105 is if it was routed, via a router, because ESX performs no routing, for traffic to leave one network subnet, and reach another network segment.

is you router performing routing between LANS

there is no link from vswitch0 to vswitch1, if you remove the physical nic from the network, can it still ping, this will show there is no link between switches internally.
0
 
locrawlerAuthor Commented:
I will do some more troubleshooting tonight.

The only time the 2 subnets get close to one another (virtually or physically) is at the ESXi server or the firewall.

I will attempt to take the firewall out of the equation.
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
well if the routing is between the switches, it should still route, and be ping-able, if you remove a network cable from the server!
0
 
locrawlerAuthor Commented:
agreed. I will check that.
0
 
locrawlerAuthor Commented:
sorry for the delay. i need to test a couple of different items.

so it looks to be a firewall issue after all. i haven't found the exact issue will with the firewall but I will.

As all of you pointed out and the documentation which I read, the vswitches are separated just like physical switch which was also proven in the test I did by isolating the ESXi server.

Thanks for all your time and help.

Please share the points with all the experts that helped.
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
I'm glad you've resolved your issue. I believe there's only been one expert on this Question! (me - hanccocka). If this answer has been helpful please assign points.
0
 
locrawlerAuthor Commented:
Hanccocka,

Thanks for your help!
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
that's not a problem.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 15
  • 8
Tackle projects and never again get stuck behind a technical roadblock.
Join Now