Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

VMware, watchguard, vlan, switching question

Posted on 2013-11-11
12
Medium Priority
?
928 Views
Last Modified: 2013-11-12
I have a basic private cloud infrastructure setup in a vmware environment. My firewall is a XTMv and with an external and a trusted and our remote backup server is on the trusted. I'm not sure how the provider configured the switching for the external NIC but obviously the Trusted is on a vswitch with the backup server VM.

I want to expand on this setup. My idea was to add another NIC to the XTMv, which will give us an optional interface. Then, I was going to set that optional interface to "VLAN."

Once I do this I would setup VLAN 2,3,4,5, etc.
So, if I set it up this way, I'm assuming I'll need a new vSwitch, which is where the XTMv Optional NIC will reside on and then I'll have create a new "VM network" VLAN on that vSwitch which is where the VM will reside.

So, for example.. if I setup the firewall with Optional-1 VLAN 2, then I will create "VLAN 2" inside the new vSwitch I just created and I should be able to get from the VM on this VLAN 2 VMNetwork I've created, right?

Looking for someone to tell me if this should work, or won't work and why and perhaps some suggestions on how to make it work.
0
Comment
Question by:Metaltree
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 6
12 Comments
 
LVL 123
ID: 39641029
To isolate traffic, you can setup a new vSwitch, with different virtual machine portgroups, with different VLAN Tag numbers, so ESXi can add the Tag virtual machine portgroups.

This is all possible, but your XTMv  needs to be able to understand the 802.1Q tags on the traffic.
0
 
LVL 5

Author Comment

by:Metaltree
ID: 39641642
>>This is all possible, but your XTMv  needs to be able to understand the 802.1Q tags on the traffic.

What I said I was originally going to do is possible? Or what you said is possible?

>>To isolate traffic, you can setup a new vSwitch, with different virtual machine portgroups, with different VLAN Tag numbers, so ESXi can add the Tag virtual machine portgroups.

What do you mean by "portgroups" like a new VMNetwork ?

So all new portgroups, or VLANs, would point to the same gateway? How does the routing work in that situation?
0
 
LVL 123
ID: 39641660
This is technically possible.

Yes, VMNetwork is an example of a virtual machine port group , the correct term is a virtual machine port group.

VMware ESXi provides NO ROUTING between networks, e.g. VLANs.

So you would need to create your own virtual router, to route between networks and/or VLANs, or use an additional router.
0
Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

 
LVL 5

Author Comment

by:Metaltree
ID: 39641685
The XTMv can handle the routing with the virtual optional interfaces, so in essence we are actually saying the same thing, the only difference is I'm putting your suggestions behind the XTMv virtual interface, right?

So, here is an example..

1. I have two VMs - Machine1 and Machine 2.
2. I have an Optional interface, which is split into 2 virtual interfaces. ("VIF-1" and "VIF-2")
3. I have a new vSwitch. These machines and interfaces listed above are on this vSwitch.
4. I put VIF1 on VLAN20 and VIF2 on VLAN30
5. I create a Virtual Machine port group for VLAN 20. I then make sure that Machinei1 is on this virtual machine port group. I do the same for VLAN30 and Machine2

This should allow me to IP the gateway for VIF1 and VIF2 on their respective VLANs and the VMs on this vSwitch in virtual machine port groups with the same VLAN ID, should be able to communicate with the IP on its respective gateway?
0
 
LVL 123
ID: 39641735
That's correct.

I would be tempted to try this first without the VLANs, (as this can often add a layer of complication, if VLAN Tagging is not working!)
0
 
LVL 5

Author Comment

by:Metaltree
ID: 39641742
How could I do this without using VLANs?
0
 
LVL 123
ID: 39641772
different IP Address ranges, two nics and a vSwitch.
0
 
LVL 5

Author Comment

by:Metaltree
ID: 39641810
I'm assuming you mean just give each machine its own NIC straight up and make sure to use different IPs? If I did that, I would need an optional interface for each network right? The problem is routing, right? Because if I only have 1 optional interface which isn't split into 2 VLANs, then I only have 1 IP on that interface, which means only 1 of those networks can get to that gateway. So Just giving each VM its own NIC on different address ranges doesn't really solve the problem to get out to the internet.

This is on a hosted infrastructure and needs to be scalable, so doing without VLANs isn't really an option unless I want to keep spinning up new XTMv devices every time I run out of optional interfaces, If what i'm assuming above is correct

Is that what you meant?  If so, how does both networks get OUT if I only have 1 optional interface?
0
 
LVL 123
ID: 39641826
Okay, just make sure VLANs are working correctly, many issues occur outside the VMware environment, because devices to not understand the tags, or configurations of VLANs have been done incorrectly.

All ESXi does, is add the numbered tag to the traffic on the virtual machine portgroup, it does nothing clever.

Many faults recorded on EE, due to lack of correct VLAN config, on external devices.
0
 
LVL 5

Author Comment

by:Metaltree
ID: 39641891
So I just thought of something. As long as all of this is on the same vSwitch, I should not have to include the optional interface in the VMNetwork correct? Because obviously that NIC can only be in one VMNetwork, so this all would go out the window.

So assuming i'm using "VLAN 10" and I have a VMNetwork created with the VLANID of 10 and I have Machine1 on this VMNetwork, as long as its on the same vswitch it should be able to hit the optional interface with VLAN10, right?
0
 
LVL 123

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE^2) earned 2000 total points
ID: 39641906
That's correct.
0
 
LVL 5

Author Closing Comment

by:Metaltree
ID: 39642788
It's working :) We ended up actually creating a new vswitch and we isolated the optional port and new VMs to that vswitch. We tagged our VLAN IDs on the switchport that is "plugged" into the optional interface.

I then created subinterfaces on the watchguard optional interface with said VLAN IDs, and it worked :)
0

Featured Post

Survive A High-Traffic Event with Percona

Your application or website rely on your database to deliver information about products and services to your customers. You can’t afford to have your database lose performance, lose availability or become unresponsive – even for just a few minutes.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article we will learn how to backup a VMware farm using Nakivo Backup & Replication. In this tutorial we will install the software on a Windows 2012 R2 Server.
Make the most of your online learning experience.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question