Solved

Best Practices for VMWare, VCenter, SAN topology and configuration

Posted on 2014-01-09
3
1,683 Views
Last Modified: 2014-01-09
Can someone let me know if this sounds like a normal VMWare deployment scenario?

We are having an outside consultant setup our virtual infrastructure and from what I've seen so far, I have some concerns.

1. The management network, VMotion network, and SAN network are all on the same IP subnet, but different VLANS and different physical ports.  They are on separate virtual switches within VCenter, which I was told was the reason the overlap doesn't matter.  I'm having a hard time wrapping my head around how the server even knows which port to send traffic out of.  If I was to try and setup a router with overlapping subnets on different interfaces, it wouldn't even let me bring both of them online at the same time.  I was told it was set up this way because VCenter had to have access to the SAN, but I've looked at more than a few network diagrams of VCenter deployments, and non of them show the VCenter server with a direct link to the storage VLAN.  I've also never seen the management subnet overlapping the SAN or VMotion networks.  

2.  We are having some major problems just doing a P2V on a print server.  If I'm reading the documentation correctly for the stand alone converter; once the agent is installed on the physical machine, it has to have access to the management network to setup and deliver the VM to the ESXi host, which requires routing since they are on a different subnet from the production LAN.  The only device we have available for that task is already overworked, so we don't want to push that additional traffic through it.  

When I suggested moving the management traffic to the production network until the conversions are finished, I was told that it wouldn't be a good idea because the SAN would need to be reconfigured for the production network as well.  

Now, I'm not a storage expert by any stretch, but I believe I understand the theory and I've played around a bit with a couple ESXi hosts and OpenFiler as an iSCSI target.    

As I understand it, the SAN traffic should be as isolated as possible from the production network.  The only things that should be hooked up are the physical ESXi hosts and the device(s) serving as the iSCSI target itself.  

The consultant seems to believe that when the physical server is converted, that the agent needs to deliver the data directly to the SAN and not to one of the ESXi hosts.  One of us seems to have a fundamental misunderstanding about how a SAN works, and I actually hope it's me, because the alternative isn't pleasant to think about.
0
Comment
Question by:KMDComp
  • 2
3 Comments
 
LVL 118

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE) earned 500 total points
ID: 39767555
1. The management network, VMotion network, and SAN network are all on the same IP subnet, but different VLANS and different physical ports.  They are on separate virtual switches within VCenter, which I was told was the reason the overlap doesn't matter.  I'm having a hard time wrapping my head around how the server even knows which port to send traffic out of.  If I was to try and setup a router with overlapping subnets on different interfaces, it wouldn't even let me bring both of them online at the same time.  I was told it was set up this way because VCenter had to have access to the SAN, but I've looked at more than a few network diagrams of VCenter deployments, and non of them show the VCenter server with a direct link to the storage VLAN.  I've also never seen the management subnet overlapping the SAN or VMotion networks.  

Improvements could be made, but different clients do different things.

vCenter does not access the SAN, only the Hosts are connected to the SAN.

Different physical ports are correct, different vSwitches are correct, same IP ok, but usually you would create different IP networks, but your networks are separated by VLANs.

Storage Traffic is sent over VMKernel Portgroups, Management Network is sent over Management Network, vMotion is tagged onto a VMKernel Portgrpoup, which should really be isolated if you have network interfaces and VLANs.

e.g.

Management Network - at least two nics - IP Address here
vMotion - at least two nics - IP Address here
VMs - at least two nics (VMs pass through this switch)
Storage Network - at least two nics (IP Address here)

As I understand it, the SAN traffic should be as isolated as possible from the production network.  The only things that should be hooked up are the physical ESXi hosts and the device(s) serving as the iSCSI target itself.  

Correct.

HOW TO: Add an iSCSI Software Adaptor and Create an iSCSI Multipath Network in VMware vSphere Hypervisor ESXi 5.0

HOW TO: Enable Jumbo Frames on a VMware vSphere Hypervisor (ESXi 5.0) host server using the VMware vSphere Client


2.  We are having some major problems just doing a P2V on a print server.  If I'm reading the documentation correctly for the stand alone converter; once the agent is installed on the physical machine, it has to have access to the management network to setup and deliver the VM to the ESXi host, which requires routing since they are on a different subnet from the production LAN.  The only device we have available for that task is already overworked, so we don't want to push that additional traffic through it.  

Correct - P2V can be troublesome.

see my EE Article, Step by Step Tutorial Instructions with Screenshots

HOW TO: FAQ VMware P2V Troubleshooting

HOW TO:  P2V, V2V for FREE - VMware vCenter Converter Standalone 5.5

HOW TO: Improve the transfer rate of a Physical to Virtual (P2V), Virtual to Virtual Conversion (V2V) using VMware vCenter Converter Standalone 5.0

It's recommended, to install VMware Converter on the computer to be converted.

When I suggested moving the management traffic to the production network until the conversions are finished, I was told that it wouldn't be a good idea because the SAN would need to be reconfigured for the production network as well.  

Now, I'm not a storage expert by any stretch, but I believe I understand the theory and I've played around a bit with a couple ESXi hosts and OpenFiler as an iSCSI target.    

As I understand it, the SAN traffic should be as isolated as possible from the production network.  The only things that should be hooked up are the physical ESXi hosts and the device(s) serving as the iSCSI target itself.  

The consultant seems to believe that when the physical server is converted, that the agent needs to deliver the data directly to the SAN and not to one of the ESXi hosts.  One of us seems to have a fundamental misunderstanding about how a SAN works, and I actually hope it's me, because the alternative isn't pleasant to think about.

Management Network should be on Production Network, unless you have an isolated Management Network for ALL devices.

SAN reconfigured for Production Network, - not sure what is going on here.

SAN traffic should be on it's on network, physical is best, or VLAN etc

Not sure what the last paragraph is about Agents....? which agent?

ESXi <----> SAN

On the SAN, the VMs are stored, and when powered ON, VM traffic goes through ESXi VM vswitch
0
 

Author Comment

by:KMDComp
ID: 39767671
The way they are trying to do the P2V is by installing the converter on the VCenter VM and pushing a remote agent to the physical machine.  The agent then takes care of the P2V which can be monitored from the other server.  The consultant seems to think that the agent copies the physical machine's drives directly to the SAN, even bypassing the ESXi hosts.

Thanks a lot for your response, and I'll check out the links.
0
 
LVL 118
ID: 39767756
It does not copy direct to the SAN!
0

Featured Post

Save on storage to protect fatherhood memories

You're the dad who has everything. This Father's Day, make sure your family memories are protected. My Passport Ultra has automatic backup and password protection to keep your cherished photos and videos safe. With up to 3TB, you have plenty of room to hold the adventures ahead.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
External Hard Drives - Vmware 6.0 5 74
Right-size volumes on ESXi 1 36
VMware 6.0 second VCenter question 3 26
vCenter 6.5 install woes 2 34
If we need to check who deleted a Virtual Machine from our vCenter. Looking this task in logs can be painful and spend lot of time, so the best way to check this is in the vCenter DB. Just connect to vCenter DB(default DB should be VCDB and using…
Last article we focus in how to VMware: How to create and use VMs TAGs – Part 1 so before follow this article and perform the next tasks, you should read the first article how to create the TAG before using them in Veeam Backup Jobs.
Teach the user how to use configure the vCenter Server storage filters Open vSphere Web Client:  Navigate to vCenter Server Advanced Settings: Add the four vCenter Server storage filters: Review the advanced settings: Modify the values of the four v…
This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility. Plug in the external drive you wish to encrypt: Make sure all previous data on the drive has been …

912 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now