Connection a vmWare Server Host to both DMZ and Internal LAN

Hi Guys,

I'm a vmware vsphere 5 newbie. But have been working with vmware workstation and server for a while.

I have four physical servers that host 50 virtual servers. Everything is licensed on vmware 5 Enterprise Plus Edition.

vmWare vCenter 5 is set up properly. Advanced features such as DRS, vMotion and so on have not been enabled yet.

For now I just need some help with basic configuration.

Vmware network is configured with a single virtual switch, the one that comes out of the box. I don't have much experience with vmware virtual networking. Every physical server has 6 gigabit ethernet connections.

Physical servers are running ESXi 5.

Everything is up and running smoothly.

Now I need to connect these physical servers to DMZ since there are some vm's that should run on that part of our network.

How should I do that?

Should I connect one nic from each server to the DMZ swtich, since we shall have virtual machines from any of these servers running on DMZ? Besides that, how should I set up vmware networking? Should I create a new virtual switch? How do i do that? What are you guys doing out there?

How about vLANS? Can it be set up and span multiple subnets so I can keep all servers connected to internal LAN?

What about the security questions that will be raised when connecting the server both to internal LAN and DMZ? Can't it be explore by a hacker to bypass all security polices enforced at the firewall box?

Thanks in advance.

Rodrigo Garcone
Who is Participating?
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
The quickest and easiest, way, is for you to create a new vSwitch1, add a physical network card in the host to vSwitch1, create a Virtual Machine Portgroup called e.g. DMZ, and then  the virtual machines that need to use the DMZ, you select this network label, in the VM settings, and edit the Network Intwrface Card and select DMZ.

To create the vSwitch, you select the Host, Configuration, Networking, Add Networking, and Follow the Wizard, to create new Virtual Switch for Virtual Machines.

If you follow the above, this will allow you to create, a DMZ Network on your vSwitch1.

Think of vSwitches, virtual switches as "separate physical switches inside the ESXi server", traffic CANNOT pass between these vSwitches. So Internal LAN on vSwitch0, DMZ on vSwitch1, traffic cannot pass between the two.

VLANs can be used, but you would have to create a network trunk to your ESXi servers, and create VLAN Tags for your Virtual Machine Portgroups, and configure the physical network to support Trunk Ports and VLAN tags.

If you want to read more on networking in VMware ESX/ESXi, then I recommend the following:-

I would also recommend reading through the Networking Sections of the following guides to gain a better understanding of Networking in VMware ESX/ESXi.

Pages 13 - 73 Discuss Networking in Detail, including trunks, VLANs, switches, and load balancing

ESXi Configuration Guide ESXi 4.1

Virtual Networking

Virtual Networking Concepts

VLANs Have a look here

Pages 13 - 73 Discuss Networking in Detail, iuncluding trunks, VLANs, switches, and load balancing

ESXi Configuration Guide ESXi 4.1

Virtual Networking

Virtual Networking Concepts
Sample configuration of virtual switch VLAN tagging (VST Mode)

How to Setup VLANs

VMware ESX Server 3: 802.1Q VLAN Solutions

Any issues, or are unsure, please just ask
garconerAuthor Commented:
wouldnt have a better answer somewhere else. That's the answer from someone that wants really to help others.

Thanks very much!
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Thanks for your kinds words, if you get issues, on the Question asked, please post, back, I usually "watch all questions"!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.