?
Solved

Best Practices for VMWare, VCenter, SAN topology and configuration

Posted on 2014-01-09
3
Medium Priority
?
1,747 Views
Last Modified: 2014-01-09
Can someone let me know if this sounds like a normal VMWare deployment scenario?

We are having an outside consultant setup our virtual infrastructure and from what I've seen so far, I have some concerns.

1. The management network, VMotion network, and SAN network are all on the same IP subnet, but different VLANS and different physical ports.  They are on separate virtual switches within VCenter, which I was told was the reason the overlap doesn't matter.  I'm having a hard time wrapping my head around how the server even knows which port to send traffic out of.  If I was to try and setup a router with overlapping subnets on different interfaces, it wouldn't even let me bring both of them online at the same time.  I was told it was set up this way because VCenter had to have access to the SAN, but I've looked at more than a few network diagrams of VCenter deployments, and non of them show the VCenter server with a direct link to the storage VLAN.  I've also never seen the management subnet overlapping the SAN or VMotion networks.  

2.  We are having some major problems just doing a P2V on a print server.  If I'm reading the documentation correctly for the stand alone converter; once the agent is installed on the physical machine, it has to have access to the management network to setup and deliver the VM to the ESXi host, which requires routing since they are on a different subnet from the production LAN.  The only device we have available for that task is already overworked, so we don't want to push that additional traffic through it.  

When I suggested moving the management traffic to the production network until the conversions are finished, I was told that it wouldn't be a good idea because the SAN would need to be reconfigured for the production network as well.  

Now, I'm not a storage expert by any stretch, but I believe I understand the theory and I've played around a bit with a couple ESXi hosts and OpenFiler as an iSCSI target.    

As I understand it, the SAN traffic should be as isolated as possible from the production network.  The only things that should be hooked up are the physical ESXi hosts and the device(s) serving as the iSCSI target itself.  

The consultant seems to believe that when the physical server is converted, that the agent needs to deliver the data directly to the SAN and not to one of the ESXi hosts.  One of us seems to have a fundamental misunderstanding about how a SAN works, and I actually hope it's me, because the alternative isn't pleasant to think about.
0
Comment
Question by:KMDComp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 123

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE^2) earned 2000 total points
ID: 39767555
1. The management network, VMotion network, and SAN network are all on the same IP subnet, but different VLANS and different physical ports.  They are on separate virtual switches within VCenter, which I was told was the reason the overlap doesn't matter.  I'm having a hard time wrapping my head around how the server even knows which port to send traffic out of.  If I was to try and setup a router with overlapping subnets on different interfaces, it wouldn't even let me bring both of them online at the same time.  I was told it was set up this way because VCenter had to have access to the SAN, but I've looked at more than a few network diagrams of VCenter deployments, and non of them show the VCenter server with a direct link to the storage VLAN.  I've also never seen the management subnet overlapping the SAN or VMotion networks.  

Improvements could be made, but different clients do different things.

vCenter does not access the SAN, only the Hosts are connected to the SAN.

Different physical ports are correct, different vSwitches are correct, same IP ok, but usually you would create different IP networks, but your networks are separated by VLANs.

Storage Traffic is sent over VMKernel Portgroups, Management Network is sent over Management Network, vMotion is tagged onto a VMKernel Portgrpoup, which should really be isolated if you have network interfaces and VLANs.

e.g.

Management Network - at least two nics - IP Address here
vMotion - at least two nics - IP Address here
VMs - at least two nics (VMs pass through this switch)
Storage Network - at least two nics (IP Address here)

As I understand it, the SAN traffic should be as isolated as possible from the production network.  The only things that should be hooked up are the physical ESXi hosts and the device(s) serving as the iSCSI target itself.  

Correct.

HOW TO: Add an iSCSI Software Adaptor and Create an iSCSI Multipath Network in VMware vSphere Hypervisor ESXi 5.0

HOW TO: Enable Jumbo Frames on a VMware vSphere Hypervisor (ESXi 5.0) host server using the VMware vSphere Client


2.  We are having some major problems just doing a P2V on a print server.  If I'm reading the documentation correctly for the stand alone converter; once the agent is installed on the physical machine, it has to have access to the management network to setup and deliver the VM to the ESXi host, which requires routing since they are on a different subnet from the production LAN.  The only device we have available for that task is already overworked, so we don't want to push that additional traffic through it.  

Correct - P2V can be troublesome.

see my EE Article, Step by Step Tutorial Instructions with Screenshots

HOW TO: FAQ VMware P2V Troubleshooting

HOW TO:  P2V, V2V for FREE - VMware vCenter Converter Standalone 5.5

HOW TO: Improve the transfer rate of a Physical to Virtual (P2V), Virtual to Virtual Conversion (V2V) using VMware vCenter Converter Standalone 5.0

It's recommended, to install VMware Converter on the computer to be converted.

When I suggested moving the management traffic to the production network until the conversions are finished, I was told that it wouldn't be a good idea because the SAN would need to be reconfigured for the production network as well.  

Now, I'm not a storage expert by any stretch, but I believe I understand the theory and I've played around a bit with a couple ESXi hosts and OpenFiler as an iSCSI target.    

As I understand it, the SAN traffic should be as isolated as possible from the production network.  The only things that should be hooked up are the physical ESXi hosts and the device(s) serving as the iSCSI target itself.  

The consultant seems to believe that when the physical server is converted, that the agent needs to deliver the data directly to the SAN and not to one of the ESXi hosts.  One of us seems to have a fundamental misunderstanding about how a SAN works, and I actually hope it's me, because the alternative isn't pleasant to think about.

Management Network should be on Production Network, unless you have an isolated Management Network for ALL devices.

SAN reconfigured for Production Network, - not sure what is going on here.

SAN traffic should be on it's on network, physical is best, or VLAN etc

Not sure what the last paragraph is about Agents....? which agent?

ESXi <----> SAN

On the SAN, the VMs are stored, and when powered ON, VM traffic goes through ESXi VM vswitch
0
 

Author Comment

by:KMDComp
ID: 39767671
The way they are trying to do the P2V is by installing the converter on the VCenter VM and pushing a remote agent to the physical machine.  The agent then takes care of the P2V which can be monitored from the other server.  The consultant seems to think that the agent copies the physical machine's drives directly to the SAN, even bypassing the ESXi hosts.

Thanks a lot for your response, and I'll check out the links.
0
 
LVL 123
ID: 39767756
It does not copy direct to the SAN!
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Each year, investment in cloud platforms grows more than 20% (https://www.immun.io/hubfs/Immunio_2016/Content/Marketing/Cloud-Security-Report-2016.pdf?submissionGuid=a8d80a00-6fee-4b85-81db-a4e28f681762) as an increasing number of companies begin to…
Giving access to ESXi shell console is always an issue for IT departments to other Teams, or Projects. We need to find a way so that teams can use ESXTOP for their POCs, or tests without giving them the access to ESXi host shell console with a root …
Teach the user how to install and configure the vCenter Orchestrator virtual appliance Open vSphere Web Client: Deploy vCenter Orchestrator virtual appliance OVA file: Verify vCenter Orchestrator virtual appliance boots successfully: Connect to the …
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question