Link to home
Start Free TrialLog in
Avatar of ricklr
ricklrFlag for Afghanistan

asked on

Configure 2 networks on VMWare 4.1 ESXi

I have built a VMWare server using ESXi 4.1 and installed 4 hosts on it. One of the hosts is a web server that gets traffic from internal users as well as external users. (At one time I had this host configured on an infrastructure 3.5 server, but it had hardware problems so I had to get a replacement server)

The 4 hosts that are accessed by internal users are connected to the same Nic (vswitch0).  The web server is connected to a 2nd nic (vswitch1). The internal connections work fine, but I can't get access to the web server thru the 2nd nic.

My mgmt network is connected to vswitch0 and is a 10.0.0.x address. I can access it with vspere client from the 10.0.0.x subnet.

The 2nd nic (vswitch1) is connected directly to a DMZ in one of my firewalls. This firewall has port 80 traffic directed to the IP address of the 2nd nic in the webserver (this used to work in the 3.5 setup). However, when I look at the settings of the 2nd nic from VMWare, the observed Ip range it shows is the single public ip address of my firewall.

I am using an IP range of 10.10.10.x on the DMZ and as the hard coded IP on the 2nd nic of the web server (no dhcp on this subnet).

But since the observed range is the external IP of the firewall, then it doesn't work, so I am really confused as to what to do to fix it.

Any help would be greatly appreciated.
Avatar of Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)
Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)
Flag of United Kingdom of Great Britain and Northern Ireland image

if you put a device on the DMZ network can you ping the interface

can you also upload screenshot of your networking

(also small thing, we refer to VMs as Guests, Hosts are the actual physical server that ESXi 4.1 is installed on).
When you say you cannot get access through the 2nd NIC, do you mean access from outside, or inside? Also, what sort of access - management or www/http access? Does it look to you as a L3 or above problem - for instance, can you ping the server? Can you telnet on port 80?

Could you provide a little diagram?

Avatar of ricklr


User generated imageHey thanks guys for getting back quickly.  I would've been here earlier, but I'm a one man IT shop, so things got in the way.....nobody here ever experiences, that right??? ;-)
I cannot ping from the DMZ. This web server cannot browse to the internet, as this is the gateway for that host (win2k3 server). If I switch the gateway to the 10.0.0.x network, it can browse the internet. The other 3 hosts can browse because they're on the 10.0.0.x subnet. If I put another device on the 10.10.10.x dmz and hard code the ip, I can browse the internet.
I'm not running any vLans or anything complicated. The DMZ is a physical network on a separate firewall with a separate public IP from my 10.0.0.x network.

I will try to post a pic with this of the networking setup from my vSphere screenshot. I will see if I can draw a pic of the connections to this server and post that.
Avatar of Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)
Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of ricklr


That may be part of my problem.  I assigned the vmnic to the host and it has 2 nics shown active. Where do I look to make sure it's assigned?
Avatar of ricklr


ok, that was a dumb question on my part.  I see that and I'm changing it and restarting the host
You say you are not running any vlans ... are you actually saying both physical NICs of you ESXi host are connected to a switch which by default would have all ports in vlan 1?? Not very good practice!

Also, hanccocka did make a good point! You are suppose to be able to ping once you connect another device to the same DMZ network! Though make sure you are setting up the same ip/mask on that device! On the same network, there is no gateways involved ... so you should really just get connectivity. Since you are not, you may have a misconfiguration on the vSwitch.

When you say the server cannot access the Internet, do you actually mean it is not meant to access the internet?

Regardless you do or do not access the Internet from that server, it doesn't really matter in terms of IP connectivity - say for example you use ping to test; when you ping your server, the reply will have to come back from that server! Firewalls normally dont' like asymetric traffic either ...

To be honest, quite a few things could be wrong here ... and you haven't yet provided enough info. You could have gateways wrong, or missing; or maybe windows firewall has got a funky config, is it even enabled; or maybe your firewall is lacking a policy, maybe it lost config, maybe your vSwitch has got something wrongly configured.

I could gamble through solutions but that's not the point for it might confuse things even more.

From my understanding based on details you provided, I've put together a lil' diagram. Does this match your setup at all??

Attaching ... give me a minute ...
And yes ...  hanccocka made again a good point which I actually missed. The VM is not even attached to that 2nd network - I may not have to add a diagram after all... will wait for now!

And you shouldn't need to restart the host really!

Avatar of ricklr


hancocka hit the nail on the head.  I thought I had assigned the 2nd nic in the guest to the 2nd nic in the VMWare server, but they were both assigned to the same one.  I missed that.  I should've remembered that from the v3.5 setup I had.  argh.

Anyway, by assigning the 2nd nic in the guest, I can access it from outside and browse like it was before my reinstall.  YAY!!!!  I'll have a few happy least until something else annoys them!
lol. Well done mate!
Happy employees is always good news!
it always helps to have a second pair of eyes!

Good Luck!
Avatar of ricklr


hey thanks again fellas!  Have a great day!