Expanding my VM infrustructure

Current Infrastructure

vSphere 4.1 Essential Plus
2 x R710, 72 GB RAM – SAU-Cluster []
EqualLogic 6 TB [] iscsi
We have an ISA 2006 for routing traffic and internal firewalling.


1 x R720 72 GB RAM
PowerVault 24 TB NAS – [] [Windows Server 2012] iscsi
Juniper Switch to ISP and R720 DMZ  – then some routing to our internal network.

Plan is to host 30 Windows 7 VMs to be accessed remotely – these PCs will access in house application. I thought I could use Terminal Services, but the application does not run on 64 bit OS.
So if I put 32 Bit, it will only see 4 GB, thus I ended up with 30 Windows 7 VMs.

This new host will be in the DMZ, I need to be able to add it to my vCenter Server, and Create a new Cluster called  [SIL-Cluster]. Would like to know if I can add it to HA on SAU-Cluster; It should also be able to see the EqualLogic.

Then I need to add the PowerVault NAS to the clusters and then move some of the VMs from the EqualLogic to  the new NAS to make room for the 30 VMs.

I cannot upgrade to vSphere 5 yet, so I need ideas around my current version of VMWare.

….you are allowed to scrap the idea down and post a new idea or approach  – I am still at planning stages.
LVL 17
Sikhumbuzo NtsadaIT AdministrationAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Neil RussellTechnical Development LeadCommented:
My first comment would be DMZ? Its hardly a DMZ if you are goint to start opening ALL the ports that you will need for this setup.
The 30 VM's will be accessing an inhouse application? More holes in the DMZ firewall..

AD Authentication on these machines? AD In the DMZ? More holes in the firewall?

Equalogic accessible accros the DMZ Firewall? .....

Need I go on?

Personally I would go with having the host internal and have better F/W / VPN rules to bring your external connections inside.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Why would you put the Host in the DMZ?

You just need to  add a network to the host which is in the DMZ foir your VMs, which can be done with creating a vSwitch in the DMZ.
Sikhumbuzo NtsadaIT AdministrationAuthor Commented:
@Neilsr; this setup came from the manager, and the client does not want to use VPN.
That would have solved my problem.

@hanccoka; I  already have this setup for another server actually, I suggested the same thing to the manager, he did not budge.

Hence I thought I should post here to see if this would work or not.

Anyway I kind of feared the response would be like this, I guess I wanted confirmation.

Thanks, time to go back to the drawing board - I will update you how things turn.
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Okay, put the Host in the DMZ more exposure and complicated because of firewalls required between vCenter and Hosts, but it is possible.
TO help with secure I would suggest to place a Windows 2012 RDS Gateway server in the DMZ to proxy connections into your internal network. ALso, regarding you Windows 7 VM's are you hosting 30 Windows 7 VM's or are you using some type of VDI solution?
Sikhumbuzo NtsadaIT AdministrationAuthor Commented:
Still waiting for D*ll to deliver the new toys.

Will update you all soon.
Sikhumbuzo NtsadaIT AdministrationAuthor Commented:
I left the host internally, got a Cisco switch and set up NAT to the VMs.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.